High level conclusions

Fuzzer bndiv_30 is blocked:

The runtime code coverage of bndiv_30 covers 18.95% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer ct is blocked:

The runtime code coverage of ct covers 24.21% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer v3name is blocked:

The runtime code coverage of v3name covers 27.07% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer bndiv_111 is blocked:

The runtime code coverage of bndiv_111 covers 18.46% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer bignum_30 is blocked:

The runtime code coverage of bignum_30 covers 21.87% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer bignum is blocked:

The runtime code coverage of bignum covers 17.60% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer bndiv is blocked:

The runtime code coverage of bndiv covers 14.69% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer asn1parse_30 is blocked:

The runtime code coverage of asn1parse_30 covers 24.29% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer bignum_111 is blocked:

The runtime code coverage of bignum_111 covers 22.36% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer conf is blocked:

The runtime code coverage of conf covers 22.38% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer ct_111 is blocked:

The runtime code coverage of ct_111 covers 22.79% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer conf_30 is blocked:

The runtime code coverage of conf_30 covers 19.93% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer asn1parse is blocked:

The runtime code coverage of asn1parse covers 26.69% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer asn1parse_111 is blocked:

The runtime code coverage of asn1parse_111 covers 22.40% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer punycode is blocked:

The runtime code coverage of punycode covers 1.603% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer ct_30 is blocked:

The runtime code coverage of ct_30 covers 22.10% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer pem is blocked:

The runtime code coverage of pem covers 21.27% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer conf_111 is blocked:

The runtime code coverage of conf_111 covers 20.18% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzers reach 28.16% of cyclomatic complexity.

Fuzzers reach 27.91% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

4518 / 16184

Cyclomatic complexity statically reachable by fuzzers

23939 / 84994

Runtime code coverage of functions

3044 / 16184

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: conf_111

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2516	88.9%
gold	[1:9]	172	6.08%
yellow	[10:29]	1	0.03%
greenyellow	[30:49]	3	0.10%
lawngreen	50+	135	4.77%
All colors	2827	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
3454	3454	1 : View List ['ENGINE_register_all_complete']	3454	3459	OPENSSL_init_crypto	call site: 00012	/src/openssl111/crypto/init.c:737
3452	3452	1 : View List ['drbg_delete_thread_state']	3452	3456	ossl_init_thread_stop	call site: 00040	/src/openssl111/crypto/init.c:440
104	104	1 : View List ['sec_alloc_realloc']	104	3559	BUF_MEM_grow	call site: 00000	/src/openssl111/crypto/buffer/buffer.c:94
104	104	1 : View List ['sec_alloc_realloc']	104	3559	BUF_MEM_grow_clean	call site: 02236	/src/openssl111/crypto/buffer/buffer.c:132
80	80	1 : View List ['CRYPTO_secure_clear_free']	80	84	BUF_MEM_free	call site: 00000	/src/openssl111/crypto/buffer/buffer.c:48
47	56	6 : View List ['lh_OBJ_NAME_doall', 'lh_OBJ_NAME_free', 'CRYPTO_THREAD_lock_free', 'lh_OBJ_NAME_get_down_load', 'sk_NAME_FUNCS_pop_free', 'lh_OBJ_NAME_set_down_load']	47	56	OBJ_NAME_cleanup	call site: 00286	/src/openssl111/crypto/objects/o_names.c:393
46	46	1 : View List ['async_delete_thread_state']	3498	3523	ossl_init_thread_stop	call site: 00017	/src/openssl111/crypto/init.c:424
45	45	3 : View List ['lh_ADDED_OBJ_set_down_load', 'lh_ADDED_OBJ_doall', 'lh_ADDED_OBJ_free']	45	45	obj_cleanup_int	call site: 00338	/src/openssl111/crypto/objects/obj_dat.c:155
33	33	2 : View List ['ossl_strtouint64', 'ossl_strchr']	37	37	OPENSSL_cpuid_setup	call site: 02804	/src/openssl111/crypto/cryptlib.c:108
14	14	1 : View List ['bio_call_callback']	14	3489	BIO_free	call site: 01809	/src/openssl111/crypto/bio/bio_lib.c:125
14	14	1 : View List ['bio_call_callback']	14	14	BIO_gets	call site: 01739	/src/openssl111/crypto/bio/bio_lib.c:465
14	14	1 : View List ['bio_call_callback']	14	14	BIO_ctrl	call site: 01714	/src/openssl111/crypto/bio/bio_lib.c:530

Runtime coverage analysis

Covered functions

249

Functions that are reachable but not covered

708

Reachable functions

887

Percentage of reachable functions covered

20.18%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl111/fuzz/driver.c	1
openssl111/fuzz/conf.c	1
openssl111/crypto/conf/conf_lib.c	9
openssl111/crypto/conf/conf_def.c	1
openssl111/crypto/err/err.c	30
openssl111/crypto/init.c	45
openssl111/crypto/mem.c	7
openssl111/crypto/threads_pthread.c	13
openssl111/crypto/async/async.c	10
openssl111/crypto/async/async_local.h	2
openssl111/crypto/stack/stack.c	10
openssl111/crypto/async/arch/async_posix.c	2
openssl111/crypto/rand/drbg_lib.c	4
openssl111/crypto/rand/rand_lib.c	5
openssl111/crypto/mem_sec.c	18
openssl111/crypto/cryptlib.c	6
openssl111/crypto/ex_data.c	10
openssl111/crypto/comp/c_zlib.c	1
openssl111/crypto/rand/rand_unix.c	4
openssl111/crypto/engine/eng_init.c	4
openssl111/crypto/engine/eng_lib.c	23
openssl111/include/internal/refcount.h	2
openssl111/crypto/engine/tb_pkmeth.c	4
openssl111/crypto/evp/pmeth_lib.c	4
openssl111/crypto/engine/tb_asnmth.c	9
openssl111/crypto/asn1/ameth_lib.c	8
openssl111/crypto/engine/eng_list.c	10
openssl111/include/internal/cryptlib.h	7
openssl111/include/openssl/crypto.h	6
openssl111/crypto/conf/conf_mod.c	15
openssl111/include/openssl/conf.h	18
openssl111/crypto/dso/dso_lib.c	8
openssl111/crypto/engine/eng_local.h	14
openssl111/crypto/store/store_init.c	1
openssl111/crypto/store/store_register.c	1
openssl111/crypto/store/store_local.h	2
openssl111/crypto/lhash/lhash.c	11
openssl111/crypto/bio/bio_lib.c	12
openssl111/crypto/bio/b_sock.c	1
openssl111/crypto/evp/names.c	5
openssl111/crypto/objects/o_names.c	10
openssl111/crypto/objects/obj_local.h	18
openssl111/crypto/mem_dbg.c	1
openssl111/crypto/ctype.c	2
openssl111/crypto/evp/evp_pbe.c	6
openssl111/crypto/evp/evp_local.h	3
openssl111/crypto/objects/obj_xref.c	2
openssl111/crypto/objects/obj_xref.h	2
openssl111/include/crypto/evp.h	1
openssl111/crypto/objects/obj_dat.c	22
openssl111/crypto/asn1/a_object.c	6
openssl111/include/openssl/err.h	5
openssl111/crypto/err/err_all.c	1
openssl111/crypto/evp/c_allc.c	1
openssl111/crypto/evp/e_des.c	6
openssl111/crypto/evp/e_des3.c	11
openssl111/crypto/evp/e_xcbc_d.c	1
openssl111/crypto/evp/e_rc4.c	2
openssl111/crypto/evp/e_rc4_hmac_md5.c	1
openssl111/crypto/evp/e_idea.c	4
openssl111/crypto/evp/e_seed.c	4
openssl111/crypto/evp/e_sm4.c	5
openssl111/crypto/evp/e_rc2.c	6
openssl111/crypto/evp/e_bf.c	4
openssl111/crypto/evp/e_cast.c	4
openssl111/crypto/evp/e_rc5.c	4
openssl111/crypto/evp/e_aes.c	38
openssl111/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl111/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl111/crypto/evp/e_aria.c	27
openssl111/crypto/evp/e_camellia.c	21
openssl111/crypto/evp/e_chacha20_poly1305.c	2
openssl111/crypto/evp/c_alld.c	1
openssl111/crypto/evp/m_md4.c	1
openssl111/crypto/evp/m_md5.c	1
openssl111/crypto/evp/m_md5_sha1.c	1
openssl111/crypto/evp/m_sha1.c	7
openssl111/crypto/evp/m_mdc2.c	1
openssl111/crypto/evp/m_ripemd.c	1
openssl111/crypto/evp/m_wp.c	1
openssl111/crypto/sm3/m_sm3.c	1
openssl111/crypto/blake2/m_blake2b.c	1
openssl111/crypto/blake2/m_blake2s.c	1
openssl111/crypto/evp/m_sha3.c	6
openssl111/crypto/conf/conf_sap.c	2
openssl111/crypto/conf/conf_mall.c	1
openssl111/crypto/asn1/asn_moid.c	3
openssl111/crypto/o_str.c	8
openssl111/crypto/conf/conf_api.c	3
openssl111/crypto/bn/bn_lib.c	17
openssl111/crypto/bn/bn_local.h	1
openssl111/crypto/bn/bn_word.c	4
openssl111/crypto/bn/asm/x86_64-gcc.c	2
openssl111/include/internal/constant_time.h	4
openssl111/crypto/bn/bn_shift.c	2
openssl111/crypto/asn1/asn1_lib.c	11
openssl111/crypto/objects/obj_lib.c	1
openssl111/crypto/asn1/asn_mstbl.c	3
openssl111/crypto/x509v3/v3_utl.c	6
openssl111/crypto/asn1/asn1_gen.c	3
openssl111/crypto/asn1/tasn_dec.c	13
openssl111/crypto/engine/eng_openssl.c	20
openssl111/crypto/engine/eng_rdrand.c	4
openssl111/crypto/engine/tb_rand.c	4
openssl111/crypto/engine/eng_dyn.c	12
openssl111/include/openssl/safestack.h	6
openssl111/crypto/dso/dso_dlfcn.c	1
openssl111/engines/e_padlock.c	1
openssl111/engines/e_afalg.c	28
openssl111/engines/e_afalg_err.c	3
openssl111/crypto/evp/cmeth_lib.c	8
openssl111/crypto/evp/evp_lib.c	28
openssl111/crypto/evp/evp_enc.c	14
openssl111/crypto/engine/eng_fat.c	5
openssl111/crypto/engine/tb_cipher.c	7
openssl111/crypto/engine/eng_table.c	8
openssl111/crypto/engine/tb_digest.c	5
openssl111/crypto/engine/tb_rsa.c	4
openssl111/crypto/engine/tb_dsa.c	4
openssl111/crypto/engine/tb_dh.c	4
openssl111/crypto/engine/tb_eckey.c	4
openssl111/crypto/async/async_wait.c	3
openssl111/crypto/async/arch/async_posix.h	1
openssl111/crypto/rsa/rsa_ossl.c	1
openssl111/crypto/dsa/dsa_ossl.c	1
openssl111/crypto/ec/ec_kmeth.c	1
openssl111/crypto/dh/dh_key.c	1
openssl111/crypto/sha/sha_local.h	1
openssl111/include/crypto/md32_common.h	2
openssl111/crypto/engine/eng_pkey.c	1
openssl111/crypto/bio/bss_file.c	2
openssl111/crypto/o_fopen.c	1
openssl111/crypto/pem/pem_pkey.c	1
openssl111/crypto/pem/pem_lib.c	14
openssl111/crypto/bio/bss_mem.c	2
openssl111/crypto/evp/encode.c	7
openssl111/include/crypto/asn1.h	3
openssl111/crypto/evp/evp_key.c	3
openssl111/crypto/ui/ui_lib.c	11
openssl111/crypto/ui/ui_openssl.c	1
openssl111/crypto/ui/ui_null.c	1
openssl111/include/openssl/ui.h	5
openssl111/crypto/err/err_prn.c	1
openssl111/crypto/bio/b_print.c	9
openssl111/crypto/evp/digest.c	7
openssl111/crypto/evp/p_lib.c	6
openssl111/include/openssl/x509.h	1
openssl111/crypto/x509/x_attrib.c	1
openssl111/crypto/asn1/tasn_fre.c	5
openssl111/include/openssl/asn1t.h	6
openssl111/crypto/asn1/tasn_utl.c	9
openssl111/crypto/asn1/a_int.c	8
openssl111/crypto/asn1/p8_pkey.c	3
openssl111/crypto/buffer/buffer.c	2
openssl111/crypto/asn1/tasn_typ.c	6
openssl111/crypto/asn1/tasn_new.c	8
openssl111/crypto/asn1/a_type.c	1
openssl111/crypto/asn1/a_bitstr.c	1
openssl111/crypto/evp/evp_pkey.c	1
openssl111/crypto/bn/bn_print.c	1
openssl111/crypto/asn1/x_sig.c	3
openssl111/crypto/pkcs12/p12_p8d.c	1
openssl111/crypto/pkcs12/p12_decr.c	2
openssl111/crypto/asn1/d2i_pr.c	1
openssl111/crypto/asn1/a_strnid.c	6
openssl111/include/openssl/asn1.h	4
openssl111/crypto/engine/eng_cnf.c	5
openssl111/crypto/engine/eng_ctrl.c	6
openssl111/crypto/getenv.c	1
openssl111/crypto/evp/evp_cnf.c	2
openssl111/crypto/conf/conf_ssl.c	3
openssl111/crypto/engine/eng_all.c	1
openssl111/crypto/x509/x509_def.c	1
openssl111/crypto/bn/bn_err.c	1
openssl111/crypto/rsa/rsa_err.c	1
openssl111/crypto/dh/dh_err.c	1
openssl111/crypto/evp/evp_err.c	1
openssl111/crypto/buffer/buf_err.c	1
openssl111/crypto/objects/obj_err.c	1
openssl111/crypto/pem/pem_err.c	1
openssl111/crypto/dsa/dsa_err.c	1
openssl111/crypto/x509/x509_err.c	1
openssl111/crypto/asn1/asn1_err.c	1
openssl111/crypto/conf/conf_err.c	1
openssl111/crypto/cpt_err.c	1
openssl111/crypto/comp/comp_err.c	1
openssl111/crypto/ec/ec_err.c	1
openssl111/crypto/bio/bio_err.c	1
openssl111/crypto/pkcs7/pkcs7err.c	1
openssl111/crypto/x509v3/v3err.c	1
openssl111/crypto/pkcs12/pk12err.c	1
openssl111/crypto/rand/rand_err.c	1
openssl111/crypto/dso/dso_err.c	1
openssl111/crypto/ts/ts_err.c	1
openssl111/crypto/engine/eng_err.c	1
openssl111/crypto/ocsp/ocsp_err.c	1
openssl111/crypto/ui/ui_err.c	1
openssl111/crypto/cms/cms_err.c	1
openssl111/crypto/ct/ct_err.c	1
openssl111/crypto/async/async_err.c	1
openssl111/crypto/kdf/kdf_err.c	1
openssl111/crypto/store/store_err.c	1

Fuzzer: cms_111

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2247	77.0%
gold	[1:9]	178	6.10%
yellow	[10:29]	34	1.16%
greenyellow	[30:49]	7	0.23%
lawngreen	50+	451	15.4%
All colors	2917	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
5391	5545	2 : View List ['EC_GROUP_free', 'EC_GROUP_new_from_ecpkparameters']	5391	16130	d2i_ECPKParameters	call site: 00000	/src/openssl111/crypto/ec/ec_asn1.c:960
4325	11535	9 : View List ['ED25519_public_from_private', 'CRYPTO_secure_malloc', 'X25519_public_from_private', 'RAND_priv_bytes', 'ERR_put_error', 'CRYPTO_secure_free', 'X448_public_from_private', 'ED448_public_from_private', 'CRYPTO_free']	4325	15103	ecx_key_op	call site: 00000	/src/openssl111/crypto/ec/ecx_meth.c:77
3959	7524	2 : View List ['rsa_mgf1_decode', 'RSA_PSS_PARAMS_free']	3959	7524	rsa_pss_decode	call site: 00000	/src/openssl111/crypto/rsa/rsa_ameth.c:441
3816	3816	1 : View List ['BN_mod_exp_recp']	3816	3816	BN_mod_exp	call site: 00000	/src/openssl111/crypto/bn/bn_exp.c:143
3729	3729	1 : View List ['bn_mod_inverse_no_branch']	3729	3729	int_bn_mod_inverse	call site: 00000	/src/openssl111/crypto/bn/bn_gcd.c:213
3665	3665	1 : View List ['rsa_multip_calc_product']	3665	3665	rsa_cb	call site: 00000	/src/openssl111/crypto/rsa/rsa_asn1.c:35
3594	3594	1 : View List ['rand_drbg_restart']	7063	27797	RAND_DRBG_generate	call site: 00000	/src/openssl111/crypto/rand/drbg_lib.c:573
3505	17383	9 : View List ['wait_random_seeded', 'rand_pool_entropy_available', '__errno_location', 'read', 'rand_pool_bytes_needed', 'get_random_device', 'rand_pool_add_end', 'rand_pool_add_begin', 'close_random_device']	3505	17383	rand_pool_acquire_entropy	call site: 00000	/src/openssl111/crypto/rand/rand_unix.c:662
3499	3499	1 : View List ['EVP_PKEY_asn1_find_str']	6955	17319	pkey_set_type	call site: 02386	/src/openssl111/crypto/evp/p_lib.c:201
3495	3495	1 : View List ['EVP_DecryptUpdate']	3495	3495	EVP_CipherUpdate	call site: 02480	/src/openssl111/crypto/evp/evp_enc.c:213
3484	3484	1 : View List ['RAND_bytes']	3484	6954	bnrand	call site: 00000	/src/openssl111/crypto/bn/bn_rand.c:50
3474	3474	1 : View List ['ASN1_INTEGER_get']	3474	10384	asn1_do_adb	call site: 02104	/src/openssl111/crypto/asn1/tasn_utl.c:219

Runtime coverage analysis

Covered functions

781

Functions that are reachable but not covered

674

Reachable functions

976

Percentage of reachable functions covered

30.94%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl111/fuzz/driver.c	1
openssl111/fuzz/cms.c	1
openssl111/crypto/bio/bss_mem.c	2
openssl111/crypto/bio/bio_lib.c	12
openssl111/crypto/mem.c	7
openssl111/crypto/err/err.c	30
openssl111/crypto/init.c	45
openssl111/crypto/threads_pthread.c	13
openssl111/crypto/async/async.c	10
openssl111/crypto/async/async_local.h	2
openssl111/crypto/stack/stack.c	10
openssl111/crypto/async/arch/async_posix.c	2
openssl111/crypto/rand/drbg_lib.c	4
openssl111/crypto/rand/rand_lib.c	5
openssl111/crypto/mem_sec.c	18
openssl111/crypto/cryptlib.c	6
openssl111/crypto/ex_data.c	10
openssl111/crypto/comp/c_zlib.c	1
openssl111/crypto/rand/rand_unix.c	4
openssl111/crypto/engine/eng_init.c	4
openssl111/crypto/engine/eng_lib.c	23
openssl111/include/internal/refcount.h	2
openssl111/crypto/engine/tb_pkmeth.c	4
openssl111/crypto/evp/pmeth_lib.c	4
openssl111/crypto/engine/tb_asnmth.c	9
openssl111/crypto/asn1/ameth_lib.c	8
openssl111/crypto/engine/eng_list.c	10
openssl111/include/internal/cryptlib.h	7
openssl111/include/openssl/crypto.h	6
openssl111/crypto/conf/conf_mod.c	15
openssl111/include/openssl/conf.h	18
openssl111/crypto/dso/dso_lib.c	8
openssl111/crypto/engine/eng_local.h	14
openssl111/crypto/store/store_init.c	1
openssl111/crypto/store/store_register.c	1
openssl111/crypto/store/store_local.h	2
openssl111/crypto/lhash/lhash.c	11
openssl111/crypto/bio/b_sock.c	1
openssl111/crypto/evp/names.c	5
openssl111/crypto/objects/o_names.c	10
openssl111/crypto/objects/obj_local.h	18
openssl111/crypto/mem_dbg.c	1
openssl111/crypto/ctype.c	2
openssl111/crypto/evp/evp_pbe.c	6
openssl111/crypto/evp/evp_local.h	3
openssl111/crypto/objects/obj_xref.c	2
openssl111/crypto/objects/obj_xref.h	2
openssl111/include/crypto/evp.h	1
openssl111/crypto/objects/obj_dat.c	22
openssl111/crypto/asn1/a_object.c	6
openssl111/include/openssl/err.h	5
openssl111/crypto/err/err_all.c	1
openssl111/crypto/evp/c_allc.c	1
openssl111/crypto/evp/e_des.c	6
openssl111/crypto/evp/e_des3.c	11
openssl111/crypto/evp/e_xcbc_d.c	1
openssl111/crypto/evp/e_rc4.c	2
openssl111/crypto/evp/e_rc4_hmac_md5.c	1
openssl111/crypto/evp/e_idea.c	4
openssl111/crypto/evp/e_seed.c	4
openssl111/crypto/evp/e_sm4.c	5
openssl111/crypto/evp/e_rc2.c	6
openssl111/crypto/evp/e_bf.c	4
openssl111/crypto/evp/e_cast.c	4
openssl111/crypto/evp/e_rc5.c	4
openssl111/crypto/evp/e_aes.c	38
openssl111/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl111/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl111/crypto/evp/e_aria.c	27
openssl111/crypto/evp/e_camellia.c	21
openssl111/crypto/evp/e_chacha20_poly1305.c	2
openssl111/crypto/evp/c_alld.c	1
openssl111/crypto/evp/m_md4.c	1
openssl111/crypto/evp/m_md5.c	1
openssl111/crypto/evp/m_md5_sha1.c	1
openssl111/crypto/evp/m_sha1.c	7
openssl111/crypto/evp/m_mdc2.c	1
openssl111/crypto/evp/m_ripemd.c	1
openssl111/crypto/evp/m_wp.c	1
openssl111/crypto/sm3/m_sm3.c	1
openssl111/crypto/blake2/m_blake2b.c	1
openssl111/crypto/blake2/m_blake2s.c	1
openssl111/crypto/evp/m_sha3.c	6
openssl111/crypto/conf/conf_sap.c	2
openssl111/crypto/conf/conf_mall.c	1
openssl111/crypto/asn1/asn_moid.c	3
openssl111/crypto/o_str.c	8
openssl111/crypto/conf/conf_lib.c	8
openssl111/crypto/conf/conf_api.c	3
openssl111/crypto/bn/bn_lib.c	17
openssl111/crypto/bn/bn_local.h	1
openssl111/crypto/bn/bn_word.c	4
openssl111/crypto/bn/asm/x86_64-gcc.c	2
openssl111/include/internal/constant_time.h	4
openssl111/crypto/bn/bn_shift.c	2
openssl111/crypto/asn1/asn1_lib.c	12
openssl111/crypto/objects/obj_lib.c	1
openssl111/crypto/asn1/asn_mstbl.c	3
openssl111/crypto/x509v3/v3_utl.c	6
openssl111/crypto/asn1/asn1_gen.c	3
openssl111/crypto/asn1/tasn_dec.c	13
openssl111/crypto/engine/eng_openssl.c	20
openssl111/crypto/engine/eng_rdrand.c	4
openssl111/crypto/engine/tb_rand.c	4
openssl111/crypto/engine/eng_dyn.c	12
openssl111/include/openssl/safestack.h	6
openssl111/crypto/dso/dso_dlfcn.c	1
openssl111/engines/e_padlock.c	1
openssl111/engines/e_afalg.c	28
openssl111/engines/e_afalg_err.c	3
openssl111/crypto/evp/cmeth_lib.c	8
openssl111/crypto/evp/evp_lib.c	28
openssl111/crypto/evp/evp_enc.c	14
openssl111/crypto/engine/eng_fat.c	5
openssl111/crypto/engine/tb_cipher.c	7
openssl111/crypto/engine/eng_table.c	8
openssl111/crypto/engine/tb_digest.c	5
openssl111/crypto/engine/tb_rsa.c	4
openssl111/crypto/engine/tb_dsa.c	4
openssl111/crypto/engine/tb_dh.c	4
openssl111/crypto/engine/tb_eckey.c	4
openssl111/crypto/async/async_wait.c	3
openssl111/crypto/async/arch/async_posix.h	1
openssl111/crypto/rsa/rsa_ossl.c	1
openssl111/crypto/dsa/dsa_ossl.c	1
openssl111/crypto/ec/ec_kmeth.c	1
openssl111/crypto/dh/dh_key.c	1
openssl111/crypto/sha/sha_local.h	1
openssl111/include/crypto/md32_common.h	2
openssl111/crypto/engine/eng_pkey.c	1
openssl111/crypto/bio/bss_file.c	2
openssl111/crypto/o_fopen.c	1
openssl111/crypto/pem/pem_pkey.c	1
openssl111/crypto/pem/pem_lib.c	14
openssl111/crypto/evp/encode.c	7
openssl111/include/crypto/asn1.h	3
openssl111/crypto/evp/evp_key.c	3
openssl111/crypto/ui/ui_lib.c	11
openssl111/crypto/ui/ui_openssl.c	1
openssl111/crypto/ui/ui_null.c	1
openssl111/include/openssl/ui.h	5
openssl111/crypto/err/err_prn.c	1
openssl111/crypto/bio/b_print.c	9
openssl111/crypto/evp/digest.c	7
openssl111/crypto/evp/p_lib.c	6
openssl111/include/openssl/x509.h	1
openssl111/crypto/x509/x_attrib.c	1
openssl111/crypto/asn1/tasn_fre.c	5
openssl111/include/openssl/asn1t.h	7
openssl111/crypto/asn1/tasn_utl.c	10
openssl111/crypto/asn1/a_int.c	10
openssl111/crypto/asn1/p8_pkey.c	3
openssl111/crypto/buffer/buffer.c	4
openssl111/crypto/asn1/tasn_typ.c	6
openssl111/crypto/asn1/tasn_new.c	8
openssl111/crypto/asn1/a_type.c	1
openssl111/crypto/asn1/a_bitstr.c	2
openssl111/crypto/evp/evp_pkey.c	1
openssl111/crypto/bn/bn_print.c	1
openssl111/crypto/asn1/x_sig.c	3
openssl111/crypto/pkcs12/p12_p8d.c	1
openssl111/crypto/pkcs12/p12_decr.c	2
openssl111/crypto/asn1/d2i_pr.c	1
openssl111/crypto/asn1/a_strnid.c	6
openssl111/include/openssl/asn1.h	4
openssl111/crypto/engine/eng_cnf.c	5
openssl111/crypto/engine/eng_ctrl.c	6
openssl111/crypto/getenv.c	1
openssl111/crypto/evp/evp_cnf.c	2
openssl111/crypto/conf/conf_ssl.c	3
openssl111/crypto/engine/eng_all.c	1
openssl111/crypto/conf/conf_def.c	1
openssl111/crypto/x509/x509_def.c	1
openssl111/crypto/bn/bn_err.c	1
openssl111/crypto/rsa/rsa_err.c	1
openssl111/crypto/dh/dh_err.c	1
openssl111/crypto/evp/evp_err.c	1
openssl111/crypto/buffer/buf_err.c	1
openssl111/crypto/objects/obj_err.c	1
openssl111/crypto/pem/pem_err.c	1
openssl111/crypto/dsa/dsa_err.c	1
openssl111/crypto/x509/x509_err.c	1
openssl111/crypto/asn1/asn1_err.c	1
openssl111/crypto/conf/conf_err.c	1
openssl111/crypto/cpt_err.c	1
openssl111/crypto/comp/comp_err.c	1
openssl111/crypto/ec/ec_err.c	1
openssl111/crypto/bio/bio_err.c	1
openssl111/crypto/pkcs7/pkcs7err.c	1
openssl111/crypto/x509v3/v3err.c	1
openssl111/crypto/pkcs12/pk12err.c	1
openssl111/crypto/rand/rand_err.c	1
openssl111/crypto/dso/dso_err.c	1
openssl111/crypto/ts/ts_err.c	1
openssl111/crypto/engine/eng_err.c	1
openssl111/crypto/ocsp/ocsp_err.c	1
openssl111/crypto/ui/ui_err.c	1
openssl111/crypto/cms/cms_err.c	1
openssl111/crypto/ct/ct_err.c	1
openssl111/crypto/async/async_err.c	1
openssl111/crypto/kdf/kdf_err.c	1
openssl111/crypto/store/store_err.c	1
openssl111/crypto/cms/cms_io.c	2
openssl111/crypto/asn1/a_d2i_fp.c	2
openssl111/crypto/bio/bss_null.c	1
openssl111/crypto/asn1/a_i2d_fp.c	1
openssl111/crypto/asn1/tasn_enc.c	8
openssl111/crypto/cms/cms_lib.c	1

Fuzzer: asn1_111

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2112	42.7%
gold	[1:9]	788	15.9%
yellow	[10:29]	56	1.13%
greenyellow	[30:49]	29	0.58%
lawngreen	50+	1954	39.5%
All colors	4939	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
25826	60544	14 : View List ['BN_mod_mul_reciprocal', 'BN_RECP_CTX_init', 'BN_RECP_CTX_free', 'BN_is_zero', 'BN_is_bit_set', 'BN_copy', 'BN_RECP_CTX_set', 'BN_abs_is_word', 'BN_num_bits', 'BN_CTX_get', 'BN_nnmod', 'BN_CTX_end', 'BN_set_word', 'BN_CTX_start']	25826	60544	BN_mod_exp_recp	call site: 04240	/src/openssl111/crypto/bn/bn_exp.c:180
7290	7290	2 : View List ['RAND_DRBG_get0_private', 'RAND_DRBG_bytes']	7290	7290	RAND_priv_bytes	call site: 00000	/src/openssl111/crypto/rand/rand_lib.c:930
4529	4529	1 : View List ['TS_TST_INFO_print_bio']	4529	4529	TS_RESP_print_bio	call site: 03208	/src/openssl111/crypto/ts/ts_rsp_print.c:34
3959	7524	2 : View List ['rsa_mgf1_decode', 'RSA_PSS_PARAMS_free']	3959	7524	rsa_pss_decode	call site: 00000	/src/openssl111/crypto/rsa/rsa_ameth.c:441
3732	7206	2 : View List ['BIO_free', 'def_load_bio']	3732	7206	def_load	call site: 00000	/src/openssl111/crypto/conf/conf_def.c:166
3729	3729	1 : View List ['bn_mod_inverse_no_branch']	3729	3729	int_bn_mod_inverse	call site: 03681	/src/openssl111/crypto/bn/bn_gcd.c:213
3590	3590	2 : View List ['ecp_nistz256_point_add', 'ecp_nistz256_windowed_mul']	3590	13976	ecp_nistz256_points_mul	call site: 00000	/src/openssl111/crypto/ec/ecp_nistz256.c:1142
3565	7020	2 : View List ['ERR_put_error', 'ECPARAMETERS_free']	3565	7020	EC_GROUP_get_ecparameters	call site: 00000	/src/openssl111/crypto/ec/ec_asn1.c:517
3565	3565	1 : View List ['ECPARAMETERS_free']	3565	18035	EC_GROUP_get_ecpkparameters	call site: 00000	/src/openssl111/crypto/ec/ec_asn1.c:538
3508	3508	1 : View List ['unsup_alg']	3508	3508	EVP_PKEY_print_private	call site: 03397	/src/openssl111/crypto/evp/p_lib.c:654
3508	3508	1 : View List ['unsup_alg']	3508	3508	EVP_PKEY_print_params	call site: 03425	/src/openssl111/crypto/evp/p_lib.c:663
3480	6938	5 : View List ['BIO_s_file', 'BIO_clear_flags', 'BIO_new', 'fclose', 'BIO_ctrl']	3480	6938	BIO_new_file	call site: 01695	/src/openssl111/crypto/bio/bss_file.c:68

Runtime coverage analysis

Covered functions

1583

Functions that are reachable but not covered

503

Reachable functions

1563

Percentage of reachable functions covered

67.82%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl111/fuzz/driver.c	1
openssl111/fuzz/asn1.c	1
openssl111/crypto/asn1/tasn_dec.c	13
openssl111/crypto/err/err.c	31
openssl111/crypto/init.c	46
openssl111/crypto/mem.c	7
openssl111/crypto/threads_pthread.c	13
openssl111/crypto/async/async.c	10
openssl111/crypto/async/async_local.h	2
openssl111/crypto/stack/stack.c	12
openssl111/crypto/async/arch/async_posix.c	2
openssl111/crypto/rand/drbg_lib.c	4
openssl111/crypto/rand/rand_lib.c	7
openssl111/crypto/mem_sec.c	18
openssl111/crypto/cryptlib.c	6
openssl111/crypto/ex_data.c	10
openssl111/crypto/comp/c_zlib.c	2
openssl111/crypto/rand/rand_unix.c	4
openssl111/crypto/engine/eng_init.c	4
openssl111/crypto/engine/eng_lib.c	23
openssl111/include/internal/refcount.h	2
openssl111/crypto/engine/tb_pkmeth.c	4
openssl111/crypto/evp/pmeth_lib.c	4
openssl111/crypto/engine/tb_asnmth.c	9
openssl111/crypto/asn1/ameth_lib.c	9
openssl111/crypto/engine/eng_list.c	10
openssl111/include/internal/cryptlib.h	7
openssl111/include/openssl/crypto.h	6
openssl111/crypto/conf/conf_mod.c	15
openssl111/include/openssl/conf.h	18
openssl111/crypto/dso/dso_lib.c	8
openssl111/crypto/engine/eng_local.h	14
openssl111/crypto/store/store_init.c	1
openssl111/crypto/store/store_register.c	1
openssl111/crypto/store/store_local.h	2
openssl111/crypto/lhash/lhash.c	11
openssl111/crypto/bio/bio_lib.c	13
openssl111/crypto/bio/b_sock.c	1
openssl111/crypto/evp/names.c	5
openssl111/crypto/objects/o_names.c	10
openssl111/crypto/objects/obj_local.h	18
openssl111/crypto/mem_dbg.c	1
openssl111/crypto/ctype.c	3
openssl111/crypto/evp/evp_pbe.c	6
openssl111/crypto/evp/evp_local.h	3
openssl111/crypto/objects/obj_xref.c	2
openssl111/crypto/objects/obj_xref.h	2
openssl111/include/crypto/evp.h	1
openssl111/crypto/objects/obj_dat.c	23
openssl111/crypto/asn1/a_object.c	7
openssl111/include/openssl/err.h	5
openssl111/crypto/err/err_all.c	1
openssl111/crypto/evp/c_allc.c	1
openssl111/crypto/evp/e_des.c	6
openssl111/crypto/evp/e_des3.c	11
openssl111/crypto/evp/e_xcbc_d.c	1
openssl111/crypto/evp/e_rc4.c	2
openssl111/crypto/evp/e_rc4_hmac_md5.c	1
openssl111/crypto/evp/e_idea.c	4
openssl111/crypto/evp/e_seed.c	4
openssl111/crypto/evp/e_sm4.c	5
openssl111/crypto/evp/e_rc2.c	6
openssl111/crypto/evp/e_bf.c	4
openssl111/crypto/evp/e_cast.c	4
openssl111/crypto/evp/e_rc5.c	4
openssl111/crypto/evp/e_aes.c	38
openssl111/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl111/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl111/crypto/evp/e_aria.c	27
openssl111/crypto/evp/e_camellia.c	21
openssl111/crypto/evp/e_chacha20_poly1305.c	2
openssl111/crypto/evp/c_alld.c	1
openssl111/crypto/evp/m_md4.c	1
openssl111/crypto/evp/m_md5.c	1
openssl111/crypto/evp/m_md5_sha1.c	1
openssl111/crypto/evp/m_sha1.c	7
openssl111/crypto/evp/m_mdc2.c	1
openssl111/crypto/evp/m_ripemd.c	1
openssl111/crypto/evp/m_wp.c	1
openssl111/crypto/sm3/m_sm3.c	1
openssl111/crypto/blake2/m_blake2b.c	1
openssl111/crypto/blake2/m_blake2s.c	1
openssl111/crypto/evp/m_sha3.c	6
openssl111/crypto/conf/conf_sap.c	2
openssl111/crypto/conf/conf_mall.c	1
openssl111/crypto/asn1/asn_moid.c	3
openssl111/crypto/o_str.c	8
openssl111/crypto/conf/conf_lib.c	8
openssl111/crypto/conf/conf_api.c	3
openssl111/crypto/bn/bn_lib.c	35
openssl111/crypto/bn/bn_local.h	1
openssl111/crypto/bn/bn_word.c	4
openssl111/crypto/bn/asm/x86_64-gcc.c	10
openssl111/include/internal/constant_time.h	6
openssl111/crypto/bn/bn_shift.c	6
openssl111/crypto/asn1/asn1_lib.c	12
openssl111/crypto/objects/obj_lib.c	1
openssl111/crypto/asn1/asn_mstbl.c	3
openssl111/crypto/x509v3/v3_utl.c	9
openssl111/crypto/asn1/asn1_gen.c	3
openssl111/crypto/engine/eng_openssl.c	20
openssl111/crypto/engine/eng_rdrand.c	4
openssl111/crypto/engine/tb_rand.c	6
openssl111/crypto/engine/eng_dyn.c	12
openssl111/include/openssl/safestack.h	6
openssl111/crypto/dso/dso_dlfcn.c	1
openssl111/engines/e_padlock.c	1
openssl111/engines/e_afalg.c	28
openssl111/engines/e_afalg_err.c	3
openssl111/crypto/evp/cmeth_lib.c	8
openssl111/crypto/evp/evp_lib.c	29
openssl111/crypto/evp/evp_enc.c	14
openssl111/crypto/engine/eng_fat.c	5
openssl111/crypto/engine/tb_cipher.c	7
openssl111/crypto/engine/eng_table.c	8
openssl111/crypto/engine/tb_digest.c	5
openssl111/crypto/engine/tb_rsa.c	4
openssl111/crypto/engine/tb_dsa.c	4
openssl111/crypto/engine/tb_dh.c	6
openssl111/crypto/engine/tb_eckey.c	5
openssl111/crypto/async/async_wait.c	3
openssl111/crypto/async/arch/async_posix.h	1
openssl111/crypto/rsa/rsa_ossl.c	1
openssl111/crypto/dsa/dsa_ossl.c	1
openssl111/crypto/ec/ec_kmeth.c	3
openssl111/crypto/dh/dh_key.c	1
openssl111/crypto/sha/sha_local.h	1
openssl111/include/crypto/md32_common.h	2
openssl111/crypto/engine/eng_pkey.c	1
openssl111/crypto/bio/bss_file.c	2
openssl111/crypto/o_fopen.c	1
openssl111/crypto/pem/pem_pkey.c	1
openssl111/crypto/pem/pem_lib.c	14
openssl111/crypto/bio/bss_mem.c	1
openssl111/crypto/evp/encode.c	7
openssl111/include/crypto/asn1.h	3
openssl111/crypto/evp/evp_key.c	3
openssl111/crypto/ui/ui_lib.c	11
openssl111/crypto/ui/ui_openssl.c	1
openssl111/crypto/ui/ui_null.c	1
openssl111/include/openssl/ui.h	5
openssl111/crypto/err/err_prn.c	1
openssl111/crypto/bio/b_print.c	11
openssl111/crypto/evp/digest.c	7
openssl111/crypto/evp/p_lib.c	12
openssl111/include/openssl/x509.h	6
openssl111/crypto/x509/x_attrib.c	1
openssl111/crypto/asn1/tasn_fre.c	5
openssl111/include/openssl/asn1t.h	7
openssl111/crypto/asn1/tasn_utl.c	10
openssl111/crypto/asn1/a_int.c	12
openssl111/crypto/asn1/p8_pkey.c	5
openssl111/crypto/evp/evp_pkey.c	2
openssl111/crypto/bn/bn_print.c	2
openssl111/crypto/asn1/x_sig.c	3
openssl111/crypto/pkcs12/p12_p8d.c	1
openssl111/crypto/pkcs12/p12_decr.c	2
openssl111/crypto/asn1/d2i_pr.c	3
openssl111/crypto/asn1/a_strnid.c	6
openssl111/include/openssl/asn1.h	8
openssl111/crypto/engine/eng_cnf.c	5
openssl111/crypto/engine/eng_ctrl.c	6
openssl111/crypto/getenv.c	1
openssl111/crypto/evp/evp_cnf.c	2
openssl111/crypto/conf/conf_ssl.c	3
openssl111/crypto/engine/eng_all.c	1
openssl111/crypto/conf/conf_def.c	1
openssl111/crypto/x509/x509_def.c	1
openssl111/crypto/bn/bn_err.c	1
openssl111/crypto/rsa/rsa_err.c	1
openssl111/crypto/dh/dh_err.c	1
openssl111/crypto/evp/evp_err.c	1
openssl111/crypto/buffer/buf_err.c	1
openssl111/crypto/objects/obj_err.c	1
openssl111/crypto/pem/pem_err.c	1
openssl111/crypto/dsa/dsa_err.c	1
openssl111/crypto/x509/x509_err.c	1
openssl111/crypto/asn1/asn1_err.c	1
openssl111/crypto/conf/conf_err.c	1
openssl111/crypto/cpt_err.c	1
openssl111/crypto/comp/comp_err.c	1
openssl111/crypto/ec/ec_err.c	1
openssl111/crypto/bio/bio_err.c	1
openssl111/crypto/pkcs7/pkcs7err.c	1
openssl111/crypto/x509v3/v3err.c	1
openssl111/crypto/pkcs12/pk12err.c	1
openssl111/crypto/rand/rand_err.c	1
openssl111/crypto/dso/dso_err.c	1
openssl111/crypto/ts/ts_err.c	1
openssl111/crypto/engine/eng_err.c	1
openssl111/crypto/ocsp/ocsp_err.c	1
openssl111/crypto/ui/ui_err.c	1
openssl111/crypto/cms/cms_err.c	1
openssl111/crypto/ct/ct_err.c	1
openssl111/crypto/async/async_err.c	1
openssl111/crypto/kdf/kdf_err.c	1
openssl111/crypto/store/store_err.c	1
openssl111/crypto/buffer/buffer.c	5
openssl111/crypto/asn1/tasn_typ.c	13
openssl111/crypto/asn1/tasn_new.c	8
openssl111/crypto/asn1/a_type.c	1
openssl111/crypto/asn1/a_bitstr.c	3
openssl111/crypto/bio/bss_null.c	1
openssl111/crypto/asn1/tasn_prn.c	9
openssl111/crypto/asn1/asn1_par.c	4
openssl111/crypto/asn1/a_utctm.c	1
openssl111/crypto/asn1/a_time.c	4
openssl111/crypto/o_time.c	4
openssl111/crypto/asn1/a_gentm.c	1
openssl111/crypto/bio/b_dump.c	4
openssl111/crypto/asn1/a_strex.c	6
openssl111/crypto/asn1/tasn_enc.c	8
openssl111/crypto/asn1/a_utf8.c	2
openssl111/crypto/ts/ts_asn1.c	9
openssl111/crypto/ts/ts_req_print.c	1
openssl111/crypto/ts/ts_req_utils.c	2
openssl111/crypto/ts/ts_lib.c	5
openssl111/crypto/x509/x509_v3.c	5
openssl111/crypto/x509v3/v3_prn.c	3
openssl111/crypto/x509v3/v3_lib.c	4
openssl111/include/openssl/x509v3.h	2
openssl111/crypto/asn1/a_print.c	1
openssl111/crypto/ts/ts_rsp_print.c	5
openssl111/crypto/x509v3/v3_alt.c	1
openssl111/crypto/x509/x509_obj.c	1
openssl111/crypto/dh/dh_asn1.c	3
openssl111/crypto/dh/dh_ameth.c	2
openssl111/crypto/asn1/t_pkey.c	2
openssl111/crypto/bn/bn_intern.c	1
openssl111/crypto/dh/dh_lib.c	3
openssl111/crypto/dsa/dsa_asn1.c	4
openssl111/crypto/dsa/dsa_prn.c	2
openssl111/crypto/dsa/dsa_lib.c	2
openssl111/crypto/rsa/rsa_asn1.c	2
openssl111/crypto/rsa/rsa_prn.c	1
openssl111/crypto/rsa/rsa_lib.c	2
openssl111/crypto/rsa/rsa_local.h	1
openssl111/crypto/rsa/rsa_mp.c	2
openssl111/crypto/bn/bn_blind.c	1
openssl111/crypto/ec/ec_asn1.c	11
openssl111/crypto/ec/ec_curve.c	4
openssl111/crypto/ec/ec_lib.c	37
openssl111/crypto/bn/bn_ctx.c	13
openssl111/crypto/ec/ec_cvt.c	2
openssl111/crypto/ec/ecp_mont.c	1
openssl111/crypto/ec/ecp_nistz256.c	2
openssl111/crypto/ec/ecp_nistp224.c	2
openssl111/crypto/ec/ecp_nistp256.c	2
openssl111/crypto/ec/ecp_nistp521.c	2
openssl111/crypto/ec/ec_mult.c	2
openssl111/crypto/bn/bn_mont.c	10
openssl111/crypto/ec/ec2_smpl.c	1
openssl111/crypto/ec/ec_local.h	1
openssl111/crypto/bn/bn_add.c	4
openssl111/crypto/bn/bn_div.c	3
openssl111/crypto/bn/bn_gcd.c	3
openssl111/crypto/bn/bn_mod.c	7
openssl111/crypto/bn/bn_mul.c	6
openssl111/crypto/ec/ec_oct.c	4
openssl111/crypto/ec/ecp_oct.c	3
openssl111/crypto/bn/bn_sqr.c	4
openssl111/crypto/bn/bn_sqrt.c	1
openssl111/crypto/bn/bn_exp.c	8
openssl111/crypto/bn/rsaz_exp.c	2
openssl111/crypto/bn/rsaz_exp.h	2
openssl111/crypto/bn/bn_recp.c	6
openssl111/crypto/bn/bn_rand.c	2
openssl111/crypto/bn/bn_kron.c	1
openssl111/crypto/ec/ec2_oct.c	3
openssl111/crypto/bn/bn_gf2m.c	7
openssl111/crypto/ec/eck_prn.c	2
openssl111/crypto/ec/ec_print.c	1
openssl111/crypto/ec/ec_key.c	10
openssl111/crypto/ec/ec_ameth.c	3
openssl111/crypto/asn1/i2d_pr.c	1
openssl111/ssl/ssl_asn1.c	4
openssl111/ssl/ssl_sess.c	2
openssl111/ssl/ssl_init.c	8
openssl111/ssl/ssl_ciph.c	11
openssl111/include/openssl/ssl.h	6
openssl111/crypto/comp/comp_lib.c	2
openssl111/ssl/s3_lib.c	3
openssl111/ssl/ssl_err.c	1
openssl111/ssl/ssl_lib.c	3
openssl111/crypto/x509/x_x509.c	1
openssl111/ssl/ssl_txt.c	1
openssl111/crypto/evp/e_null.c	1
openssl111/crypto/x509/x509_txt.c	1

Fuzzer: server_111

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2158	51.4%
gold	[1:9]	779	18.5%
yellow	[10:29]	46	1.09%
greenyellow	[30:49]	15	0.35%
lawngreen	50+	1198	28.5%
All colors	4196	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
26168	29743	8 : View List ['d2i_X509_SIG', 'X509_SIG_free', 'PKCS8_decrypt', 'PEM_def_callback', 'EVP_PKEY_free', 'PKCS8_PRIV_KEY_INFO_free', 'EVP_PKCS82PKEY', 'OPENSSL_cleanse']	26168	36813	PEM_read_bio_PrivateKey	call site: 02446	/src/openssl111/crypto/pem/pem_pkey.c:51
19882	19892	6 : View List ['verify_cb_cert', 'internal_verify', 'check_name_constraints', 'X509v3_asid_validate_path', 'X509v3_addr_validate_path', 'X509_chain_check_suiteb']	19882	19892	verify_chain	call site: 00000	/src/openssl111/crypto/x509/x509_vfy.c:222
14188	24886	11 : View List ['ssl_security', 'DH_free', 'EVP_PKEY_security_bits', 'DH_get0_pqg', 'EVP_PKEY_new', 'ssl_dh_to_pkey', 'EVP_PKEY_assign', 'DH_get0_key', 'ssl_generate_pkey', 'ssl_get_auto_dh', 'EVP_PKEY_get0_DH']	14190	168837	tls_construct_server_key_exchange	call site: 00000	/src/openssl111/ssl/statem/statem_srvr.c:2527
13447	68493	14 : View List ['X509_free', 'X509_up_ref', 'find_issuer', 'ERR_put_error', 'sk_X509_value.19362', 'sk_X509_delete_ptr', 'check_dane_issuer', 'sk_X509_push.19373', 'sk_X509_pop.19382', 'X509_cmp', 'ossl_assert_int.19380', 'sk_X509_set', 'get_issuer', 'cert_self_signed']	17543	82253	build_chain	call site: 00000	/src/openssl111/crypto/x509/x509_vfy.c:3203
11134	14738	4 : View List ['SSL_CTX_remove_session', 'ssl_update_cache', 'ssl3_cleanup_key_block', 'dtls1_clear_received_buffer']	11134	14742	tls_finish_handshake	call site: 00000	/src/openssl111/ssl/statem/statem_lib.c:1073
10501	13975	3 : View List ['ASN1_INTEGER_get', 'PROXY_CERT_INFO_EXTENSION_free', 'X509_get_ext_by_NID']	10501	72601	x509v3_cache_extensions	call site: 03606	/src/openssl111/crypto/x509v3/v3_purp.c:425
7528	14935	9 : View List ['X509_up_ref', 'X509_OBJECT_idx_by_subject', 'X509_STORE_lock', 'X509_get_subject_name', 'X509_NAME_cmp', 'x509_check_cert_time', 'sk_X509_OBJECT_value', 'sk_X509_OBJECT_num', 'X509_STORE_unlock']	7528	22077	X509_STORE_CTX_get1_issuer	call site: 00000	/src/openssl111/crypto/x509/x509_lu.c:689
7372	85955	13 : View List ['BN_is_zero', 'BN_copy', 'BN_mod_lshift1_quick', 'BN_mod_mul', 'BN_rshift1', 'BN_priv_rand', 'BN_is_one', 'BN_num_bits', 'BN_nnmod', 'BN_sub_word', 'BN_ucmp', 'BN_set_word', 'BN_kronecker']	7372	141079	BN_mod_sqrt	call site: 00000	/src/openssl111/crypto/bn/bn_sqrt.c:85
7366	7368	5 : View List ['sk_X509_NAME_num.1901', 'EVP_PKEY_id', 'sk_X509_num.1896', 'sk_X509_value.1895', 'ssl_check_ca_name']	7366	7372	tls1_check_chain	call site: 00000	/src/openssl111/ssl/t1_lib.c:2340
7290	7290	2 : View List ['RAND_DRBG_get0_private', 'RAND_DRBG_bytes']	7290	7290	RAND_priv_bytes	call site: 03165	/src/openssl111/crypto/rand/rand_lib.c:930
7268	28127	10 : View List ['EVP_DecryptInit_ex', 'EVP_BytesToKey', 'PEM_def_callback', 'ERR_put_error', 'EVP_md5', 'EVP_CIPHER_CTX_free', 'EVP_CIPHER_CTX_new', 'EVP_DecryptUpdate', 'OPENSSL_cleanse', 'EVP_DecryptFinal_ex']	7268	28127	PEM_do_header	call site: 01899	/src/openssl111/crypto/pem/pem_lib.c:427
6963	6963	2 : View List ['tls1_set_sigalgs_list', 'tls1_set_groups_list']	6963	6963	SSL_CTX_ctrl	call site: 03494	/src/openssl111/ssl/ssl_lib.c:2313

Runtime coverage analysis

Covered functions

2161

Functions that are reachable but not covered

598

Reachable functions

1570

Percentage of reachable functions covered

61.91%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl111/fuzz/driver.c	1
openssl111/fuzz/server.c	2
openssl111/ssl/methods.c	1
openssl111/ssl/ssl_lib.c	36
openssl111/crypto/err/err.c	30
openssl111/crypto/init.c	46
openssl111/crypto/mem.c	7
openssl111/crypto/threads_pthread.c	14
openssl111/crypto/async/async.c	17
openssl111/crypto/async/async_local.h	4
openssl111/crypto/stack/stack.c	12
openssl111/crypto/async/arch/async_posix.c	3
openssl111/crypto/rand/drbg_lib.c	20
openssl111/crypto/rand/rand_lib.c	17
openssl111/crypto/mem_sec.c	18
openssl111/crypto/cryptlib.c	6
openssl111/crypto/ex_data.c	10
openssl111/crypto/comp/c_zlib.c	2
openssl111/crypto/rand/rand_unix.c	6
openssl111/crypto/engine/eng_init.c	4
openssl111/crypto/engine/eng_lib.c	23
openssl111/include/internal/refcount.h	2
openssl111/crypto/engine/tb_pkmeth.c	4
openssl111/crypto/evp/pmeth_lib.c	4
openssl111/crypto/engine/tb_asnmth.c	9
openssl111/crypto/asn1/ameth_lib.c	9
openssl111/crypto/engine/eng_list.c	10
openssl111/include/internal/cryptlib.h	7
openssl111/include/openssl/crypto.h	6
openssl111/crypto/conf/conf_mod.c	15
openssl111/include/openssl/conf.h	18
openssl111/crypto/dso/dso_lib.c	8
openssl111/crypto/engine/eng_local.h	14
openssl111/crypto/store/store_init.c	1
openssl111/crypto/store/store_register.c	1
openssl111/crypto/store/store_local.h	2
openssl111/crypto/lhash/lhash.c	11
openssl111/crypto/bio/bio_lib.c	18
openssl111/crypto/bio/b_sock.c	1
openssl111/crypto/evp/names.c	5
openssl111/crypto/objects/o_names.c	10
openssl111/crypto/objects/obj_local.h	18
openssl111/crypto/mem_dbg.c	1
openssl111/crypto/ctype.c	2
openssl111/crypto/evp/evp_pbe.c	6
openssl111/crypto/evp/evp_local.h	3
openssl111/crypto/objects/obj_xref.c	5
openssl111/crypto/objects/obj_xref.h	4
openssl111/include/crypto/evp.h	1
openssl111/crypto/objects/obj_dat.c	22
openssl111/crypto/asn1/a_object.c	6
openssl111/include/openssl/err.h	5
openssl111/crypto/err/err_all.c	1
openssl111/crypto/evp/c_allc.c	1
openssl111/crypto/evp/e_des.c	6
openssl111/crypto/evp/e_des3.c	11
openssl111/crypto/evp/e_xcbc_d.c	1
openssl111/crypto/evp/e_rc4.c	2
openssl111/crypto/evp/e_rc4_hmac_md5.c	1
openssl111/crypto/evp/e_idea.c	4
openssl111/crypto/evp/e_seed.c	4
openssl111/crypto/evp/e_sm4.c	5
openssl111/crypto/evp/e_rc2.c	6
openssl111/crypto/evp/e_bf.c	4
openssl111/crypto/evp/e_cast.c	4
openssl111/crypto/evp/e_rc5.c	4
openssl111/crypto/evp/e_aes.c	38
openssl111/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl111/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl111/crypto/evp/e_aria.c	27
openssl111/crypto/evp/e_camellia.c	21
openssl111/crypto/evp/e_chacha20_poly1305.c	2
openssl111/crypto/evp/c_alld.c	1
openssl111/crypto/evp/m_md4.c	1
openssl111/crypto/evp/m_md5.c	1
openssl111/crypto/evp/m_md5_sha1.c	1
openssl111/crypto/evp/m_sha1.c	7
openssl111/crypto/evp/m_mdc2.c	1
openssl111/crypto/evp/m_ripemd.c	1
openssl111/crypto/evp/m_wp.c	1
openssl111/crypto/sm3/m_sm3.c	1
openssl111/crypto/blake2/m_blake2b.c	1
openssl111/crypto/blake2/m_blake2s.c	1
openssl111/crypto/evp/m_sha3.c	6
openssl111/crypto/conf/conf_sap.c	2
openssl111/crypto/conf/conf_mall.c	1
openssl111/crypto/asn1/asn_moid.c	3
openssl111/crypto/o_str.c	8
openssl111/crypto/conf/conf_lib.c	8
openssl111/crypto/conf/conf_api.c	3
openssl111/crypto/bn/bn_lib.c	18
openssl111/crypto/bn/bn_local.h	1
openssl111/crypto/bn/bn_word.c	4
openssl111/crypto/bn/asm/x86_64-gcc.c	2
openssl111/include/internal/constant_time.h	4
openssl111/crypto/bn/bn_shift.c	2
openssl111/crypto/asn1/asn1_lib.c	13
openssl111/crypto/objects/obj_lib.c	1
openssl111/crypto/asn1/asn_mstbl.c	3
openssl111/crypto/x509v3/v3_utl.c	6
openssl111/crypto/asn1/asn1_gen.c	3
openssl111/crypto/asn1/tasn_dec.c	13
openssl111/crypto/engine/eng_openssl.c	20
openssl111/crypto/engine/eng_rdrand.c	4
openssl111/crypto/engine/tb_rand.c	6
openssl111/crypto/engine/eng_dyn.c	12
openssl111/include/openssl/safestack.h	7
openssl111/crypto/dso/dso_dlfcn.c	1
openssl111/engines/e_padlock.c	1
openssl111/engines/e_afalg.c	28
openssl111/engines/e_afalg_err.c	3
openssl111/crypto/evp/cmeth_lib.c	8
openssl111/crypto/evp/evp_lib.c	29
openssl111/crypto/evp/evp_enc.c	14
openssl111/crypto/engine/eng_fat.c	5
openssl111/crypto/engine/tb_cipher.c	7
openssl111/crypto/engine/eng_table.c	8
openssl111/crypto/engine/tb_digest.c	5
openssl111/crypto/engine/tb_rsa.c	4
openssl111/crypto/engine/tb_dsa.c	4
openssl111/crypto/engine/tb_dh.c	4
openssl111/crypto/engine/tb_eckey.c	4
openssl111/crypto/async/async_wait.c	5
openssl111/crypto/async/arch/async_posix.h	1
openssl111/crypto/rsa/rsa_ossl.c	1
openssl111/crypto/dsa/dsa_ossl.c	1
openssl111/crypto/ec/ec_kmeth.c	1
openssl111/crypto/dh/dh_key.c	1
openssl111/crypto/sha/sha_local.h	1
openssl111/include/crypto/md32_common.h	2
openssl111/crypto/engine/eng_pkey.c	1
openssl111/crypto/bio/bss_file.c	3
openssl111/crypto/o_fopen.c	1
openssl111/crypto/pem/pem_pkey.c	1
openssl111/crypto/pem/pem_lib.c	15
openssl111/crypto/bio/bss_mem.c	2
openssl111/crypto/evp/encode.c	7
openssl111/include/crypto/asn1.h	3
openssl111/crypto/evp/evp_key.c	3
openssl111/crypto/ui/ui_lib.c	11
openssl111/crypto/ui/ui_openssl.c	1
openssl111/crypto/ui/ui_null.c	1
openssl111/include/openssl/ui.h	5
openssl111/crypto/err/err_prn.c	2
openssl111/crypto/bio/b_print.c	9
openssl111/crypto/evp/digest.c	8
openssl111/crypto/evp/p_lib.c	19
openssl111/include/openssl/x509.h	14
openssl111/crypto/x509/x_attrib.c	1
openssl111/crypto/asn1/tasn_fre.c	5
openssl111/include/openssl/asn1t.h	7
openssl111/crypto/asn1/tasn_utl.c	10
openssl111/crypto/asn1/a_int.c	11
openssl111/crypto/asn1/p8_pkey.c	3
openssl111/crypto/buffer/buffer.c	4
openssl111/crypto/asn1/tasn_typ.c	7
openssl111/crypto/asn1/tasn_new.c	8
openssl111/crypto/asn1/a_type.c	1
openssl111/crypto/asn1/a_bitstr.c	2
openssl111/crypto/evp/evp_pkey.c	1
openssl111/crypto/bn/bn_print.c	1
openssl111/crypto/asn1/x_sig.c	3
openssl111/crypto/pkcs12/p12_p8d.c	1
openssl111/crypto/pkcs12/p12_decr.c	2
openssl111/crypto/asn1/d2i_pr.c	3
openssl111/crypto/asn1/a_strnid.c	6
openssl111/include/openssl/asn1.h	11
openssl111/crypto/engine/eng_cnf.c	5
openssl111/crypto/engine/eng_ctrl.c	6
openssl111/crypto/getenv.c	1
openssl111/crypto/evp/evp_cnf.c	2
openssl111/crypto/conf/conf_ssl.c	6
openssl111/crypto/engine/eng_all.c	1
openssl111/crypto/conf/conf_def.c	1
openssl111/crypto/x509/x509_def.c	1
openssl111/crypto/bn/bn_err.c	1
openssl111/crypto/rsa/rsa_err.c	1
openssl111/crypto/dh/dh_err.c	1
openssl111/crypto/evp/evp_err.c	1
openssl111/crypto/buffer/buf_err.c	1
openssl111/crypto/objects/obj_err.c	1
openssl111/crypto/pem/pem_err.c	1
openssl111/crypto/dsa/dsa_err.c	1
openssl111/crypto/x509/x509_err.c	1
openssl111/crypto/asn1/asn1_err.c	1
openssl111/crypto/conf/conf_err.c	1
openssl111/crypto/cpt_err.c	1
openssl111/crypto/comp/comp_err.c	1
openssl111/crypto/ec/ec_err.c	1
openssl111/crypto/bio/bio_err.c	1
openssl111/crypto/pkcs7/pkcs7err.c	1
openssl111/crypto/x509v3/v3err.c	1
openssl111/crypto/pkcs12/pk12err.c	1
openssl111/crypto/rand/rand_err.c	1
openssl111/crypto/dso/dso_err.c	1
openssl111/crypto/ts/ts_err.c	1
openssl111/crypto/engine/eng_err.c	1
openssl111/crypto/ocsp/ocsp_err.c	1
openssl111/crypto/ui/ui_err.c	1
openssl111/crypto/cms/cms_err.c	1
openssl111/crypto/ct/ct_err.c	1
openssl111/crypto/async/async_err.c	1
openssl111/crypto/kdf/kdf_err.c	1
openssl111/crypto/store/store_err.c	1
openssl111/ssl/ssl_init.c	8
openssl111/ssl/ssl_ciph.c	23
openssl111/include/openssl/ssl.h	15
openssl111/crypto/comp/comp_lib.c	3
openssl111/ssl/s3_lib.c	3
openssl111/ssl/ssl_err.c	1
openssl111/ssl/ssl_cert.c	16
openssl111/ssl/ssl_local.h	7
openssl111/crypto/x509/x509_lu.c	8
openssl111/include/openssl/x509_vfy.h	7
openssl111/crypto/x509/x509_cmp.c	9
openssl111/crypto/x509/x_name.c	5
openssl111/crypto/asn1/tasn_enc.c	8
openssl111/crypto/x509/x509_vpm.c	10
openssl111/crypto/ct/ct_log.c	3
openssl111/include/openssl/ct.h	3
openssl111/crypto/rand/drbg_ctr.c	1
openssl111/ssl/tls_srp.c	2
openssl111/ssl/ssl_mcnf.c	2
openssl111/ssl/ssl_conf.c	13
openssl111/ssl/ssl_rsa.c	7
openssl111/crypto/x509/x_all.c	2
openssl111/crypto/asn1/a_d2i_fp.c	2
openssl111/crypto/x509/x_pubkey.c	2
openssl111/crypto/x509/x_x509.c	2
openssl111/ssl/ssl_sess.c	7
openssl111/crypto/x509/x_crl.c	1
openssl111/ssl/statem/extensions_cust.c	4
openssl111/ssl/t1_lib.c	11
openssl111/crypto/ec/ec_curve.c	1
openssl111/ssl/statem/statem_lib.c	1
openssl111/crypto/rsa/rsa_asn1.c	1
openssl111/crypto/x509v3/v3_purp.c	12
openssl111/crypto/asn1/a_digest.c	1
openssl111/crypto/x509/x509_set.c	6
openssl111/crypto/x509/x509_ext.c	4
openssl111/crypto/x509v3/v3_lib.c	6
openssl111/crypto/x509/x509_v3.c	5
openssl111/include/openssl/x509v3.h	8
openssl111/crypto/x509v3/v3_bcons.c	1
openssl111/crypto/x509v3/v3_pcia.c	1
openssl111/crypto/asn1/a_octet.c	1
openssl111/crypto/x509v3/v3_crld.c	1
openssl111/crypto/asn1/a_dup.c	1
openssl111/crypto/x509/x509name.c	1
openssl111/crypto/ec/ec_key.c	3
openssl111/crypto/pem/pem_all.c	4
openssl111/crypto/ec/ec_lib.c	3
openssl111/crypto/ec/ecp_nistz256.c	1
openssl111/crypto/ec/ecp_nistp224.c	1
openssl111/crypto/ec/ecp_nistp256.c	1
openssl111/crypto/ec/ecp_nistp521.c	1
openssl111/crypto/ec/ec_mult.c	1
openssl111/crypto/bn/bn_mont.c	1
openssl111/crypto/pem/pem_x509.c	1
openssl111/crypto/pem/pem_oth.c	1
openssl111/crypto/dsa/dsa_lib.c	2
openssl111/ssl/record/rec_layer_s3.c	6
openssl111/ssl/record/ssl3_record.c	2
openssl111/ssl/statem/statem.c	5
openssl111/ssl/record/ssl3_buffer.c	3
openssl111/ssl/record/rec_layer_d1.c	1
openssl111/ssl/pqueue.c	2
openssl111/include/internal/dane.h	1
openssl111/crypto/x509/x_exten.c	1
openssl111/include/openssl/ocsp.h	1
openssl111/crypto/ocsp/ocsp_asn.c	1
openssl111/crypto/ct/ct_sct.c	2

Fuzzer: pem

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4756	88.7%
gold	[1:9]	392	7.31%
yellow	[10:29]	33	0.61%
greenyellow	[30:49]	8	0.14%
lawngreen	50+	172	3.20%
All colors	5361	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
5924	11854	5 : View List ['EVP_RAND_CTX_free', 'CRYPTO_DOWN_REF.9536', 'CRYPTO_FREE_REF.9537', 'EVP_RAND_free', 'CRYPTO_free']	5924	11854	EVP_RAND_CTX_free	call site: 05156	/src/openssl/crypto/evp/evp_rand.c:378
5924	5924	1 : View List ['ossl_rand_crng_ctx_free']	5924	5954	context_deinit_objs	call site: 05200	/src/openssl/crypto/context.c:310
3455	3455	1 : View List ['ERR_put_error']	3455	3455	bio_read_intern	call site: 02917	/src/openssl111/crypto/bio/bio_lib.c:280
3455	3455	1 : View List ['ERR_put_error']	3455	3455	mem_write	call site: 00000	/src/openssl111/crypto/bio/bss_mem.c:227
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BUF_MEM_new	call site: 00000	/src/openssl111/crypto/buffer/buffer.c:36
6	12	2 : View List ['CRYPTO_malloc', 'sk_EX_CALLBACK_value']	20	35	ossl_crypto_new_ex_data_ex	call site: 00895	/src/openssl/crypto/ex_data.c:239
6	12	3 : View List ['property_free', 'ossl_check_OPENSSL_CSTRING_sk_type.13567', 'OPENSSL_sk_pop']	6	17	ossl_property_string	call site: 02310	/src/openssl/crypto/property/property_string.c:181
6	6	1 : View List ['sk_EX_CALLBACK_value']	6	11	ossl_crypto_free_ex_index_ex	call site: 00000	/src/openssl/crypto/ex_data.c:127
0	17774	3 : View List ['ERR_set_error', 'ERR_new', 'ERR_set_debug']	0	17774	do_init_module_list_lock	call site: 00482	/src/openssl/crypto/conf/conf_mod.c:102
0	5926	1 : View List ['ossl_method_store_free']	0	5926	ossl_method_store_new	call site: 00197	/src/openssl/crypto/property/property.c:247
0	5926	1 : View List ['ossl_provider_store_free']	0	5926	ossl_provider_store_new	call site: 05101	/src/openssl/crypto/provider_core.c:311
0	44	1 : View List ['ossl_property_string_data_free']	0	44	ossl_property_string_data_new	call site: 05114	/src/openssl/crypto/property/property_string.c:111

Runtime coverage analysis

Covered functions

331

Functions that are reachable but not covered

1136

Reachable functions

1443

Percentage of reachable functions covered

21.28%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl/fuzz/driver.c	1
openssl/fuzz/pem.c	1
openssl/crypto/bio/bss_mem.c	3
openssl/crypto/bio/bio_lib.c	16
openssl/crypto/mem.c	6
openssl/crypto/err/err_blocks.c	4
openssl/crypto/err/err.c	30
openssl/crypto/init.c	40
openssl/crypto/err/err_local.h	6
openssl/crypto/threads_pthread.c	14
openssl/crypto/cpuid.c	4
openssl/crypto/ctype.c	3
openssl/crypto/initthread.c	21
openssl/crypto/stack/stack.c	19
openssl/crypto/err/err_save.c	1
openssl/crypto/comp/c_zlib.c	1
openssl/crypto/comp/c_brotli.c	1
openssl/crypto/comp/c_zstd.c	1
openssl/crypto/async/async.c	6
openssl/crypto/async/arch/async_posix.c	2
openssl/crypto/rand/rand_lib.c	11
openssl/providers/implementations/rands/seeding/rand_unix.c	4
openssl/crypto/engine/eng_init.c	4
openssl/crypto/cryptlib.c	2
openssl/crypto/engine/eng_lib.c	21
openssl/include/internal/refcount.h	4
openssl/crypto/engine/tb_pkmeth.c	7
openssl/crypto/evp/pmeth_lib.c	31
openssl/crypto/engine/tb_asnmth.c	8
openssl/crypto/asn1/ameth_lib.c	9
openssl/crypto/engine/eng_list.c	10
openssl/crypto/ex_data.c	12
openssl/crypto/context.c	16
openssl/crypto/property/property.c	29
openssl/crypto/sparse_array.c	1
openssl/crypto/provider_conf.c	14
openssl/crypto/evp/c_allc.c	1
openssl/crypto/evp/e_des.c	6
openssl/crypto/evp/names.c	9
openssl/crypto/objects/obj_dat.c	29
openssl/crypto/evp/c_alld.c	1
openssl/crypto/evp/legacy_md4.c	1
openssl/crypto/objects/o_names.c	12
openssl/crypto/objects/obj_local.h	18
openssl/crypto/lhash/lhash.c	13
openssl/crypto/evp/legacy_md5.c	1
openssl/crypto/evp/legacy_md5_sha1.c	1
openssl/crypto/evp/legacy_sha.c	13
openssl/crypto/evp/legacy_mdc2.c	1
openssl/crypto/evp/legacy_ripemd.c	1
openssl/crypto/evp/legacy_wp.c	1
openssl/crypto/sm3/legacy_sm3.c	1
openssl/crypto/evp/legacy_blake2.c	2
openssl/crypto/conf/conf_sap.c	2
openssl/crypto/conf/conf_mod.c	33
openssl/crypto/err/err_mark.c	3
openssl/crypto/getenv.c	1
openssl/crypto/o_str.c	14
openssl/crypto/x509/x509_def.c	1
openssl/crypto/bio/bio_print.c	9
openssl/include/internal/common.h	1
openssl/crypto/conf/conf_lib.c	10
openssl/crypto/conf/conf_def.c	1
openssl/include/openssl/err.h	4
openssl/crypto/conf/conf_api.c	3
openssl/include/openssl/conf.h	3
openssl/crypto/conf/conf_mall.c	1
openssl/crypto/asn1/asn_moid.c	3
openssl/crypto/bsearch.c	1
openssl/crypto/asn1/a_object.c	6
openssl/crypto/bn/bn_lib.c	26
openssl/crypto/bn/bn_local.h	1
openssl/crypto/mem_sec.c	18
openssl/crypto/bn/bn_word.c	4
openssl/crypto/bn/asm/x86_64-gcc.c	2
openssl/crypto/bn/bn_shift.c	2
openssl/crypto/asn1/asn1_lib.c	13
openssl/crypto/objects/obj_lib.c	1
openssl/crypto/asn1/asn_mstbl.c	3
openssl/crypto/x509/v3_utl.c	6
openssl/crypto/asn1/asn1_gen.c	3
openssl/crypto/asn1/tasn_dec.c	14
openssl/crypto/asn1/a_strnid.c	6
openssl/include/openssl/asn1.h	3
openssl/crypto/engine/eng_openssl.c	20
openssl/include/internal/cryptlib.h	7
openssl/include/openssl/crypto.h	2
openssl/crypto/evp/evp_lib.c	37
openssl/crypto/provider_core.c	49
openssl/crypto/engine/eng_rdrand.c	4
openssl/crypto/engine/tb_rand.c	4
openssl/crypto/engine/eng_local.h	14
openssl/crypto/engine/eng_dyn.c	12
openssl/crypto/dso/dso_lib.c	9
openssl/include/openssl/safestack.h	4
openssl/crypto/dso/dso_dlfcn.c	1
openssl/engines/e_padlock.c	22
openssl/crypto/engine/tb_cipher.c	7
openssl/crypto/evp/cmeth_lib.c	8
openssl/crypto/evp/evp_enc.c	26
openssl/crypto/params.c	48
openssl/crypto/evp/evp_utils.c	5
openssl/crypto/asn1/evp_asn1.c	1
openssl/crypto/asn1/tasn_typ.c	9
openssl/crypto/asn1/a_octet.c	1
openssl/crypto/asn1/a_type.c	1
openssl/crypto/asn1/tasn_fre.c	5
openssl/engines/e_afalg.c	28
openssl/engines/e_afalg_err.c	3
openssl/crypto/provider_local.h	4
openssl/crypto/provider_child.c	4
openssl/providers/implementations/rands/crngt.c	2
openssl/crypto/evp/digest.c	18
openssl/crypto/evp/evp_fetch.c	16
openssl/crypto/core_namemap.c	22
openssl/crypto/engine/eng_fat.c	5
openssl/crypto/engine/eng_table.c	8
openssl/crypto/engine/tb_digest.c	7
openssl/crypto/engine/tb_rsa.c	4
openssl/crypto/engine/tb_dsa.c	4
openssl/crypto/engine/tb_dh.c	4
openssl/crypto/engine/tb_eckey.c	4
openssl/include/crypto/asn1.h	3
openssl/crypto/core_fetch.c	3
openssl/crypto/core_algorithm.c	4
openssl/include/openssl/core_dispatch.h	79
openssl/crypto/encode_decode/decoder_pkey.c	27
openssl/crypto/async/async_wait.c	3
openssl/crypto/async/arch/async_posix.h	1
openssl/crypto/rsa/rsa_ossl.c	1
openssl/crypto/dsa/dsa_ossl.c	1
openssl/crypto/ec/ec_kmeth.c	1
openssl/crypto/dh/dh_key.c	1
openssl/crypto/rand/rand_meth.c	1
openssl/crypto/sha/sha_local.h	1
openssl/include/crypto/md32_common.h	2
openssl/crypto/engine/eng_pkey.c	1
openssl/crypto/bio/bss_file.c	2
openssl/crypto/o_fopen.c	1
openssl/crypto/pem/pem_pkey.c	5
openssl/crypto/bio/bf_readbuff.c	1
openssl/crypto/pem/pem_lib.c	15
openssl/crypto/evp/evp_key.c	3
openssl/crypto/ui/ui_lib.c	27
openssl/crypto/ui/ui_openssl.c	1
openssl/crypto/ui/ui_null.c	1
openssl/include/openssl/ui.h	2
openssl/crypto/err/err_prn.c	1
openssl/crypto/passphrase.c	9
openssl/crypto/encode_decode/decoder_meth.c	21
openssl/crypto/encode_decode/decoder_lib.c	27
openssl/crypto/evp/keymgmt_meth.c	19
openssl/crypto/provider.c	2
openssl/crypto/property/property_query.c	3
openssl/crypto/property/property_string.c	17
openssl/crypto/property/property_parse.c	25
openssl/crypto/encode_decode/encoder_local.h	6
openssl/crypto/evp/keymgmt_lib.c	13
openssl/crypto/evp/p_lib.c	19
openssl/include/crypto/evp.h	8
openssl/include/openssl/x509.h	1
openssl/crypto/x509/x_attrib.c	2
openssl/include/openssl/asn1t.h	2
openssl/crypto/asn1/tasn_utl.c	9
openssl/crypto/asn1/a_int.c	8
openssl/crypto/bio/ossl_core_bio.c	3
openssl/crypto/ui/ui_util.c	8
openssl/crypto/evp/encode.c	7
openssl/crypto/evp/m_sigver.c	7
openssl/crypto/evp/signature.c	9
openssl/crypto/evp/exchange.c	2
openssl/crypto/evp/kem.c	2
openssl/crypto/evp/asymcipher.c	2
openssl/crypto/evp/ctrl_params_translate.c	10
openssl/crypto/params_from_text.c	3
openssl/crypto/bn/bn_conv.c	4
openssl/crypto/asn1/p8_pkey.c	4
openssl/crypto/buffer/buffer.c	2
openssl/crypto/asn1/tasn_new.c	9
openssl/crypto/asn1/a_bitstr.c	1
openssl/crypto/evp/evp_pkey.c	1
openssl/crypto/asn1/x_sig.c	3
openssl/crypto/pkcs12/p12_p8d.c	2
openssl/crypto/pkcs12/p12_decr.c	2
openssl/crypto/evp/evp_pbe.c	6
openssl/crypto/evp/evp_local.h	4
openssl/crypto/asn1/d2i_pr.c	1
openssl/crypto/x509/x_pubkey.c	7
openssl/crypto/engine/eng_cnf.c	5
openssl/crypto/engine/eng_all.c	1
openssl/crypto/engine/eng_ctrl.c	7
openssl/crypto/evp/evp_cnf.c	2
openssl/crypto/conf/conf_ssl.c	3
openssl/crypto/encode_decode/encoder_meth.c	3
openssl/crypto/store/store_meth.c	3
openssl/crypto/evp/e_des3.c	11
openssl/crypto/evp/e_xcbc_d.c	1
openssl/crypto/evp/e_rc4.c	2
openssl/crypto/evp/e_rc4_hmac_md5.c	1
openssl/crypto/evp/e_idea.c	4
openssl/crypto/evp/e_seed.c	4
openssl/crypto/evp/e_sm4.c	5
openssl/crypto/evp/e_rc2.c	6
openssl/crypto/evp/e_bf.c	4
openssl/crypto/evp/e_cast.c	4
openssl/crypto/evp/e_rc5.c	4
openssl/crypto/evp/e_aes.c	38
openssl/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl/crypto/evp/e_aria.c	27
openssl/crypto/evp/e_camellia.c	21
openssl/crypto/evp/e_chacha20_poly1305.c	2
openssl/crypto/err/err_all.c	1
openssl/crypto/bn/bn_err.c	1
openssl/crypto/rsa/rsa_err.c	1
openssl/crypto/dh/dh_err.c	1
openssl/crypto/evp/evp_err.c	1
openssl/crypto/buffer/buf_err.c	1
openssl/crypto/objects/obj_err.c	1
openssl/crypto/pem/pem_err.c	1
openssl/crypto/dsa/dsa_err.c	1
openssl/crypto/x509/x509_err.c	1
openssl/crypto/asn1/asn1_err.c	1
openssl/crypto/conf/conf_err.c	1
openssl/crypto/cpt_err.c	1
openssl/crypto/comp/comp_err.c	1
openssl/crypto/ec/ec_err.c	1
openssl/crypto/bio/bio_err.c	1
openssl/crypto/pkcs7/pkcs7err.c	1
openssl/crypto/x509/v3err.c	1
openssl/crypto/pkcs12/pk12err.c	1
openssl/crypto/rand/rand_err.c	1
openssl/crypto/dso/dso_err.c	1
openssl/crypto/ts/ts_err.c	1
openssl/crypto/engine/eng_err.c	1
openssl/crypto/http/http_err.c	1
openssl/crypto/ocsp/ocsp_err.c	1
openssl/crypto/ui/ui_err.c	1
openssl/crypto/cms/cms_err.c	1
openssl/crypto/crmf/crmf_err.c	1
openssl/crypto/cmp/cmp_err.c	1
openssl/crypto/ct/ct_err.c	1
openssl/crypto/ess/ess_err.c	1
openssl/crypto/async/async_err.c	1
openssl/crypto/store/store_err.c	1
openssl/crypto/property/property_err.c	1
openssl/providers/common/provider_err.c	1
openssl/crypto/property/defn_cache.c	5
openssl/crypto/bio/bss_core.c	2
openssl/providers/implementations/rands/drbg.c	2
openssl/crypto/self_test_core.c	2
openssl/crypto/thread/internal.c	2
openssl/crypto/thread/arch/thread_posix.c	4
openssl/crypto/evp/evp_rand.c	3
openssl/crypto/store/store_init.c	1
openssl/crypto/store/store_register.c	1
openssl/crypto/store/store_local.h	1
openssl/crypto/bio/bio_sock.c	1
openssl/crypto/objects/obj_xref.c	2
openssl/crypto/objects/obj_xref.h	2
openssl/crypto/cmp/cmp_util.c	1
openssl/crypto/trace.c	2

Fuzzer: ct_30

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4626	88.0%
gold	[1:9]	316	6.01%
yellow	[10:29]	27	0.51%
greenyellow	[30:49]	5	0.09%
lawngreen	50+	281	5.34%
All colors	5255	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
6016	6016	1 : View List ['ossl_asn1_template_free']	6016	6016	ossl_asn1_item_embed_free	call site: 02267	/src/openssl/crypto/asn1/tasn_fre.c:48
3455	3465	3 : View List ['ERR_put_error', 'CRYPTO_malloc', 'CRYPTO_free']	3455	3465	i2o_SCT_signature	call site: 05180	/src/openssl111/crypto/ct/ct_oct.c:176
3455	3461	2 : View List ['ERR_put_error', 'CRYPTO_malloc']	3455	6928	i2o_SCT	call site: 05176	/src/openssl111/crypto/ct/ct_oct.c:223
3455	3455	1 : View List ['ASN1_STRING_new']	3455	6928	ossl_asn1_time_from_tm	call site: 05113	/src/openssl/crypto/asn1/a_time.c:285
3455	3455	1 : View List ['ERR_put_error']	3455	3455	asn1_collect	call site: 04904	/src/openssl111/crypto/asn1/tasn_dec.c:1052
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BUF_MEM_grow_clean	call site: 04913	/src/openssl111/crypto/buffer/buffer.c:136
3455	3455	1 : View List ['ERR_put_error']	3455	3455	i2o_SCT_LIST	call site: 05166	/src/openssl111/crypto/ct/ct_oct.c:333
3455	3455	1 : View List ['ERR_put_error']	3455	3455	SCT_new	call site: 05044	/src/openssl111/crypto/ct/ct_sct.c:26
3455	3455	1 : View List ['ERR_put_error']	3455	3455	SCT_set1_signature	call site: 05052	/src/openssl111/crypto/ct/ct_sct.c:186
3452	3452	1 : View List ['sk_ENGINE_CLEANUP_ITEM_new_null']	3452	3452	int_cleanup_check	call site: 00982	/src/openssl111/crypto/engine/eng_lib.c:118
104	104	1 : View List ['sec_alloc_realloc']	3559	3559	BUF_MEM_grow_clean	call site: 04912	/src/openssl111/crypto/buffer/buffer.c:132
16	16	1 : View List ['CTLOG_STORE_get0_log_by_id']	18	21134	SCT_print	call site: 05070	/src/openssl111/crypto/ct/ct_prn.c:75

Runtime coverage analysis

Covered functions

330

Functions that are reachable but not covered

1117

Reachable functions

1434

Percentage of reachable functions covered

22.11%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl30/fuzz/driver.c	1
openssl30/fuzz/ct.c	1
openssl30/crypto/ct/ct_oct.c	8
openssl30/crypto/asn1/tasn_typ.c	14
openssl30/crypto/asn1/tasn_dec.c	14
openssl30/crypto/err/err_blocks.c	2
openssl30/crypto/err/err.c	31
openssl30/crypto/init.c	39
openssl30/crypto/err/err_local.h	5
openssl30/crypto/mem.c	7
openssl30/crypto/threads_pthread.c	13
openssl30/crypto/cpuid.c	4
openssl30/crypto/ctype.c	4
openssl30/crypto/initthread.c	21
openssl30/crypto/stack/stack.c	16
openssl30/crypto/comp/c_zlib.c	1
openssl30/crypto/async/async.c	6
openssl30/crypto/rand/rand_lib.c	10
openssl30/providers/implementations/rands/seeding/rand_unix.c	4
openssl30/crypto/engine/eng_init.c	4
openssl30/crypto/cryptlib.c	2
openssl30/crypto/engine/eng_lib.c	21
openssl30/include/internal/refcount.h	2
openssl30/crypto/engine/tb_pkmeth.c	7
openssl30/crypto/evp/pmeth_lib.c	31
openssl30/crypto/engine/tb_asnmth.c	9
openssl30/crypto/asn1/ameth_lib.c	9
openssl30/crypto/engine/eng_list.c	10
openssl30/crypto/ex_data.c	14
openssl30/crypto/context.c	17
openssl30/include/internal/cryptlib.h	8
openssl30/include/openssl/crypto.h	2
openssl30/crypto/property/property_parse.c	25
openssl30/crypto/property/property_string.c	12
openssl30/crypto/lhash/lhash.c	12
openssl30/crypto/evp/evp_rand.c	3
openssl30/crypto/provider_core.c	43
openssl30/crypto/err/err_all.c	1
openssl30/include/openssl/err.h	4
openssl30/crypto/bn/bn_err.c	1
openssl30/crypto/rsa/rsa_err.c	1
openssl30/crypto/dh/dh_err.c	1
openssl30/crypto/evp/evp_err.c	1
openssl30/crypto/buffer/buf_err.c	1
openssl30/crypto/objects/obj_err.c	1
openssl30/crypto/pem/pem_err.c	1
openssl30/crypto/dsa/dsa_err.c	1
openssl30/crypto/x509/x509_err.c	1
openssl30/crypto/asn1/asn1_err.c	1
openssl30/crypto/conf/conf_err.c	1
openssl30/crypto/cpt_err.c	1
openssl30/crypto/comp/comp_err.c	1
openssl30/crypto/ec/ec_err.c	1
openssl30/crypto/bio/bio_err.c	1
openssl30/crypto/pkcs7/pkcs7err.c	1
openssl30/crypto/x509/v3err.c	1
openssl30/crypto/pkcs12/pk12err.c	1
openssl30/crypto/rand/rand_err.c	1
openssl30/crypto/dso/dso_err.c	1
openssl30/crypto/ts/ts_err.c	1
openssl30/crypto/engine/eng_err.c	1
openssl30/crypto/http/http_err.c	1
openssl30/crypto/ocsp/ocsp_err.c	1
openssl30/crypto/ui/ui_err.c	1
openssl30/crypto/cms/cms_err.c	1
openssl30/crypto/crmf/crmf_err.c	1
openssl30/crypto/cmp/cmp_err.c	1
openssl30/crypto/ct/ct_err.c	1
openssl30/crypto/ess/ess_err.c	1
openssl30/crypto/async/async_err.c	1
openssl30/crypto/store/store_err.c	1
openssl30/crypto/property/property_err.c	1
openssl30/providers/common/provider_err.c	1
openssl30/crypto/evp/c_allc.c	1
openssl30/crypto/evp/e_des.c	6
openssl30/crypto/evp/names.c	9
openssl30/crypto/objects/obj_dat.c	23
openssl30/crypto/evp/c_alld.c	1
openssl30/crypto/evp/legacy_md4.c	1
openssl30/crypto/objects/obj_local.h	18
openssl30/crypto/objects/o_names.c	12
openssl30/crypto/conf/conf_sap.c	2
openssl30/crypto/conf/conf_mod.c	33
openssl30/crypto/engine/eng_openssl.c	20
openssl30/crypto/evp/evp_lib.c	37
openssl30/crypto/dso/dso_lib.c	9
openssl30/crypto/provider_local.h	4
openssl30/crypto/provider_child.c	2
openssl30/crypto/evp/cmeth_lib.c	8
openssl30/crypto/evp/evp_enc.c	24
openssl30/crypto/rsa/rsa_ossl.c	1
openssl30/crypto/engine/tb_rsa.c	4
openssl30/crypto/dsa/dsa_ossl.c	1
openssl30/crypto/engine/tb_dsa.c	4
openssl30/crypto/ec/ec_kmeth.c	1
openssl30/crypto/engine/tb_eckey.c	4
openssl30/crypto/dh/dh_key.c	1
openssl30/crypto/engine/tb_dh.c	4
openssl30/crypto/rand/rand_meth.c	1
openssl30/crypto/engine/tb_rand.c	4
openssl30/crypto/engine/tb_cipher.c	7
openssl30/crypto/params.c	47
openssl30/crypto/evp/evp_utils.c	5
openssl30/crypto/engine/tb_digest.c	7
openssl30/crypto/evp/digest.c	17
openssl30/crypto/sha/sha_local.h	1
openssl30/include/crypto/md32_common.h	2
openssl30/crypto/engine/eng_pkey.c	1
openssl30/crypto/bio/bss_file.c	2
openssl30/crypto/o_fopen.c	1
openssl30/crypto/bio/bio_lib.c	16
openssl30/crypto/pem/pem_pkey.c	5
openssl30/crypto/bio/bf_readbuff.c	1
openssl30/crypto/pem/pem_lib.c	15
openssl30/crypto/evp/evp_key.c	3
openssl30/crypto/ui/ui_lib.c	27
openssl30/crypto/ui/ui_openssl.c	1
openssl30/crypto/ui/ui_null.c	1
openssl30/include/openssl/ui.h	2
openssl30/crypto/err/err_prn.c	1
openssl30/crypto/o_str.c	12
openssl30/crypto/bio/bio_print.c	11
openssl30/crypto/passphrase.c	9
openssl30/crypto/encode_decode/decoder_pkey.c	13
openssl30/crypto/encode_decode/decoder_meth.c	16
openssl30/crypto/encode_decode/decoder_lib.c	23
openssl30/crypto/evp/keymgmt_meth.c	21
openssl30/crypto/evp/evp_fetch.c	16
openssl30/crypto/core_namemap.c	19
openssl30/crypto/engine/eng_rdrand.c	4
openssl30/crypto/engine/eng_local.h	14
openssl30/crypto/engine/eng_dyn.c	12
openssl30/include/openssl/safestack.h	4
openssl30/crypto/dso/dso_dlfcn.c	1
openssl30/engines/e_padlock.c	22
openssl30/crypto/asn1/evp_asn1.c	1
openssl30/crypto/asn1/asn1_lib.c	14
openssl30/crypto/asn1/a_octet.c	1
openssl30/crypto/asn1/a_type.c	1
openssl30/crypto/asn1/tasn_fre.c	5
openssl30/crypto/asn1/a_object.c	6
openssl30/engines/e_afalg.c	27
openssl30/engines/e_afalg_err.c	3
openssl30/crypto/engine/eng_fat.c	5
openssl30/crypto/engine/eng_table.c	8
openssl30/crypto/async/async_wait.c	3
openssl30/crypto/async/arch/async_posix.h	1
openssl30/crypto/bsearch.c	1
openssl30/crypto/bn/bn_word.c	4
openssl30/crypto/bn/bn_lib.c	23
openssl30/crypto/bn/bn_local.h	1
openssl30/crypto/mem_sec.c	18
openssl30/crypto/bn/bn_shift.c	2
openssl30/crypto/bn/bn_conv.c	4
openssl30/include/internal/constant_time.h	4
openssl30/crypto/bn/asm/x86_64-gcc.c	2
openssl30/include/crypto/asn1.h	3
openssl30/crypto/property/property.c	25
openssl30/crypto/sparse_array.c	1
openssl30/crypto/core_fetch.c	3
openssl30/crypto/core_algorithm.c	4
openssl30/crypto/getenv.c	1
openssl30/include/openssl/core_dispatch.h	81
openssl30/crypto/provider.c	2
openssl30/crypto/property/property_query.c	3
openssl30/crypto/encode_decode/encoder_local.h	5
openssl30/crypto/evp/keymgmt_lib.c	14
openssl30/crypto/evp/p_lib.c	19
openssl30/include/crypto/evp.h	8
openssl30/include/openssl/x509.h	1
openssl30/crypto/x509/x_attrib.c	2
openssl30/include/openssl/asn1t.h	2
openssl30/crypto/asn1/tasn_utl.c	13
openssl30/crypto/asn1/a_int.c	10
openssl30/crypto/bio/bss_mem.c	3
openssl30/crypto/bio/ossl_core_bio.c	3
openssl30/crypto/ui/ui_util.c	8
openssl30/crypto/evp/encode.c	7
openssl30/crypto/evp/legacy_md5.c	1
openssl30/crypto/evp/m_sigver.c	7
openssl30/crypto/evp/signature.c	9
openssl30/crypto/evp/exchange.c	2
openssl30/crypto/evp/kem.c	2
openssl30/crypto/evp/asymcipher.c	2
openssl30/crypto/evp/ctrl_params_translate.c	10
openssl30/crypto/params_from_text.c	3
openssl30/crypto/asn1/p8_pkey.c	4
openssl30/crypto/evp/evp_pkey.c	1
openssl30/crypto/asn1/x_sig.c	3
openssl30/crypto/pkcs12/p12_p8d.c	2
openssl30/crypto/pkcs12/p12_decr.c	2
openssl30/crypto/evp/evp_pbe.c	6
openssl30/crypto/evp/evp_local.h	3
openssl30/crypto/asn1/d2i_pr.c	1
openssl30/crypto/x509/x_pubkey.c	7
openssl30/crypto/x509/x509_def.c	1
openssl30/crypto/conf/conf_lib.c	10
openssl30/crypto/conf/conf_def.c	1
openssl30/crypto/conf/conf_api.c	3
openssl30/include/openssl/conf.h	3
openssl30/crypto/conf/conf_mall.c	1
openssl30/crypto/asn1/asn_moid.c	3
openssl30/crypto/objects/obj_lib.c	1
openssl30/crypto/asn1/asn_mstbl.c	3
openssl30/crypto/x509/v3_utl.c	6
openssl30/crypto/asn1/asn1_gen.c	3
openssl30/crypto/asn1/a_strnid.c	6
openssl30/include/openssl/asn1.h	3
openssl30/crypto/engine/eng_cnf.c	5
openssl30/crypto/engine/eng_all.c	1
openssl30/crypto/engine/eng_ctrl.c	7
openssl30/crypto/evp/evp_cnf.c	2
openssl30/crypto/conf/conf_ssl.c	3
openssl30/crypto/provider_conf.c	10
openssl30/crypto/encode_decode/encoder_meth.c	3
openssl30/crypto/store/store_meth.c	3
openssl30/crypto/evp/legacy_md5_sha1.c	1
openssl30/crypto/evp/legacy_sha.c	13
openssl30/crypto/evp/legacy_mdc2.c	1
openssl30/crypto/evp/legacy_ripemd.c	1
openssl30/crypto/evp/legacy_wp.c	1
openssl30/crypto/sm3/legacy_sm3.c	1
openssl30/crypto/evp/legacy_blake2.c	2
openssl30/crypto/evp/e_des3.c	11
openssl30/crypto/evp/e_xcbc_d.c	1
openssl30/crypto/evp/e_rc4.c	2
openssl30/crypto/evp/e_rc4_hmac_md5.c	1
openssl30/crypto/evp/e_idea.c	4
openssl30/crypto/evp/e_seed.c	4
openssl30/crypto/evp/e_sm4.c	5
openssl30/crypto/evp/e_rc2.c	6
openssl30/crypto/evp/e_bf.c	4
openssl30/crypto/evp/e_cast.c	4
openssl30/crypto/evp/e_rc5.c	4
openssl30/crypto/evp/e_aes.c	38
openssl30/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl30/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl30/crypto/evp/e_aria.c	27
openssl30/crypto/evp/e_camellia.c	21
openssl30/crypto/evp/e_chacha20_poly1305.c	2
openssl30/crypto/store/store_init.c	1
openssl30/crypto/store/store_register.c	1
openssl30/crypto/store/store_local.h	1
openssl30/crypto/bio/bio_sock.c	1
openssl30/crypto/objects/obj_xref.c	2
openssl30/crypto/objects/obj_xref.h	2
openssl30/crypto/cmp/cmp_util.c	1
openssl30/crypto/trace.c	2
openssl30/crypto/buffer/buffer.c	2
openssl30/crypto/asn1/tasn_new.c	9
openssl30/crypto/asn1/a_bitstr.c	2
openssl30/include/openssl/ct.h	3
openssl30/crypto/ct/ct_sct.c	7
openssl30/crypto/bio/bss_null.c	1
openssl30/crypto/ct/ct_prn.c	4
openssl30/crypto/ct/ct_log.c	2
openssl30/crypto/bio/bio_dump.c	1
openssl30/crypto/asn1/a_gentm.c	5
openssl30/crypto/o_time.c	5
openssl30/crypto/asn1/a_time.c	8
openssl30/crypto/asn1/tasn_enc.c	8
openssl30/crypto/asn1/asn1_local.h	3

Fuzzer: cms_30

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3141	60.6%
gold	[1:9]	853	16.4%
yellow	[10:29]	82	1.58%
greenyellow	[30:49]	18	0.34%
lawngreen	50+	1089	21.0%
All colors	5183	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
9914	9914	2 : View List ['ec_GF2m_simple_oct2point', 'ec_GFp_simple_oct2point']	9914	9914	EC_POINT_oct2point	call site: 00000	/src/openssl111/crypto/ec/ec_oct.c:113
9386	9386	2 : View List ['conf_diagnostics', 'CONF_modules_load']	9386	16308	CONF_modules_load_file_ex	call site: 03829	/src/openssl/crypto/conf/conf_mod.c:206
8805	8805	2 : View List ['ec_GF2m_simple_set_compressed_coordinates', 'ec_GFp_simple_set_compressed_coordinates']	8805	8805	EC_POINT_set_compressed_coordinates	call site: 00000	/src/openssl111/crypto/ec/ec_oct.c:32
6157	6161	2 : View List ['ossl_cipher_tlsunpadblock', 'CRYPTO_free']	6157	112805	ossl_cipher_generic_block_update	call site: 00000	/src/openssl/providers/implementations/ciphers/ciphercommon.c:252
5960	5960	1 : View List ['ossl_dh_key2buf']	5960	18059	dh_get_params	call site: 00000	/src/openssl/providers/implementations/keymgmt/dh_kmgmt.c:328
5947	5947	1 : View List ['OSSL_PARAM_set_long']	5947	5947	ossl_param_build_set_long	call site: 00000	/src/openssl/crypto/param_build_set.c:39
5942	118642	6 : View List ['ERR_set_error', 'ERR_new', 'OSSL_PARAM_get_size_t', 'OSSL_PARAM_locate_const', 'ERR_set_debug', 'OSSL_PARAM_get_uint']	5942	118642	ossl_cipher_generic_set_ctx_params	call site: 00000	/src/openssl/providers/implementations/ciphers/ciphercommon.c:596
5937	5937	1 : View List ['OSSL_PARAM_BLD_push_int']	5937	5937	ossl_param_build_set_int	call site: 00000	/src/openssl/crypto/param_build_set.c:25
5937	5937	1 : View List ['OSSL_PARAM_BLD_push_long']	5937	5937	ossl_param_build_set_long	call site: 00000	/src/openssl/crypto/param_build_set.c:36
5936	5936	1 : View List ['OSSL_PARAM_BLD_push_utf8_string']	5936	5936	ossl_param_build_set_utf8_string	call site: 00000	/src/openssl/crypto/param_build_set.c:47
5935	5935	1 : View List ['OSSL_PARAM_BLD_push_octet_string']	5935	5935	ossl_param_build_set_octet_string	call site: 00000	/src/openssl/crypto/param_build_set.c:60
5933	5933	1 : View List ['ossl_property_merge']	5933	6001	ossl_method_store_fetch	call site: 00000	/src/openssl/crypto/property/property.c:526

Runtime coverage analysis

Covered functions

2210

Functions that are reachable but not covered

574

Reachable functions

1408

Percentage of reachable functions covered

59.23%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl30/fuzz/driver.c	1
openssl30/fuzz/cms.c	1
openssl30/crypto/bio/bss_mem.c	3
openssl30/crypto/bio/bio_lib.c	16
openssl30/crypto/mem.c	7
openssl30/crypto/err/err_blocks.c	2
openssl30/crypto/err/err.c	31
openssl30/crypto/init.c	39
openssl30/crypto/err/err_local.h	5
openssl30/crypto/threads_pthread.c	13
openssl30/crypto/cpuid.c	4
openssl30/crypto/ctype.c	3
openssl30/crypto/initthread.c	21
openssl30/crypto/stack/stack.c	16
openssl30/crypto/comp/c_zlib.c	1
openssl30/crypto/async/async.c	6
openssl30/crypto/rand/rand_lib.c	10
openssl30/providers/implementations/rands/seeding/rand_unix.c	4
openssl30/crypto/engine/eng_init.c	4
openssl30/crypto/cryptlib.c	2
openssl30/crypto/engine/eng_lib.c	21
openssl30/include/internal/refcount.h	2
openssl30/crypto/engine/tb_pkmeth.c	7
openssl30/crypto/evp/pmeth_lib.c	31
openssl30/crypto/engine/tb_asnmth.c	9
openssl30/crypto/asn1/ameth_lib.c	9
openssl30/crypto/engine/eng_list.c	10
openssl30/crypto/ex_data.c	14
openssl30/crypto/context.c	17
openssl30/include/internal/cryptlib.h	8
openssl30/include/openssl/crypto.h	2
openssl30/crypto/property/property_parse.c	25
openssl30/crypto/property/property_string.c	12
openssl30/crypto/lhash/lhash.c	12
openssl30/crypto/evp/evp_rand.c	3
openssl30/crypto/provider_core.c	43
openssl30/crypto/err/err_all.c	1
openssl30/include/openssl/err.h	4
openssl30/crypto/bn/bn_err.c	1
openssl30/crypto/rsa/rsa_err.c	1
openssl30/crypto/dh/dh_err.c	1
openssl30/crypto/evp/evp_err.c	1
openssl30/crypto/buffer/buf_err.c	1
openssl30/crypto/objects/obj_err.c	1
openssl30/crypto/pem/pem_err.c	1
openssl30/crypto/dsa/dsa_err.c	1
openssl30/crypto/x509/x509_err.c	1
openssl30/crypto/asn1/asn1_err.c	1
openssl30/crypto/conf/conf_err.c	1
openssl30/crypto/cpt_err.c	1
openssl30/crypto/comp/comp_err.c	1
openssl30/crypto/ec/ec_err.c	1
openssl30/crypto/bio/bio_err.c	1
openssl30/crypto/pkcs7/pkcs7err.c	1
openssl30/crypto/x509/v3err.c	1
openssl30/crypto/pkcs12/pk12err.c	1
openssl30/crypto/rand/rand_err.c	1
openssl30/crypto/dso/dso_err.c	1
openssl30/crypto/ts/ts_err.c	1
openssl30/crypto/engine/eng_err.c	1
openssl30/crypto/http/http_err.c	1
openssl30/crypto/ocsp/ocsp_err.c	1
openssl30/crypto/ui/ui_err.c	1
openssl30/crypto/cms/cms_err.c	1
openssl30/crypto/crmf/crmf_err.c	1
openssl30/crypto/cmp/cmp_err.c	1
openssl30/crypto/ct/ct_err.c	1
openssl30/crypto/ess/ess_err.c	1
openssl30/crypto/async/async_err.c	1
openssl30/crypto/store/store_err.c	1
openssl30/crypto/property/property_err.c	1
openssl30/providers/common/provider_err.c	1
openssl30/crypto/evp/c_allc.c	1
openssl30/crypto/evp/e_des.c	6
openssl30/crypto/evp/names.c	9
openssl30/crypto/objects/obj_dat.c	23
openssl30/crypto/evp/c_alld.c	1
openssl30/crypto/evp/legacy_md4.c	1
openssl30/crypto/objects/obj_local.h	18
openssl30/crypto/objects/o_names.c	12
openssl30/crypto/conf/conf_sap.c	2
openssl30/crypto/conf/conf_mod.c	33
openssl30/crypto/engine/eng_openssl.c	20
openssl30/crypto/evp/evp_lib.c	37
openssl30/crypto/dso/dso_lib.c	9
openssl30/crypto/provider_local.h	4
openssl30/crypto/provider_child.c	2
openssl30/crypto/evp/cmeth_lib.c	8
openssl30/crypto/evp/evp_enc.c	24
openssl30/crypto/rsa/rsa_ossl.c	1
openssl30/crypto/engine/tb_rsa.c	4
openssl30/crypto/dsa/dsa_ossl.c	1
openssl30/crypto/engine/tb_dsa.c	4
openssl30/crypto/ec/ec_kmeth.c	1
openssl30/crypto/engine/tb_eckey.c	4
openssl30/crypto/dh/dh_key.c	1
openssl30/crypto/engine/tb_dh.c	4
openssl30/crypto/rand/rand_meth.c	1
openssl30/crypto/engine/tb_rand.c	4
openssl30/crypto/engine/tb_cipher.c	7
openssl30/crypto/params.c	47
openssl30/crypto/evp/evp_utils.c	5
openssl30/crypto/engine/tb_digest.c	7
openssl30/crypto/evp/digest.c	17
openssl30/crypto/sha/sha_local.h	1
openssl30/include/crypto/md32_common.h	2
openssl30/crypto/engine/eng_pkey.c	1
openssl30/crypto/bio/bss_file.c	2
openssl30/crypto/o_fopen.c	1
openssl30/crypto/pem/pem_pkey.c	5
openssl30/crypto/bio/bf_readbuff.c	1
openssl30/crypto/pem/pem_lib.c	15
openssl30/crypto/evp/evp_key.c	3
openssl30/crypto/ui/ui_lib.c	27
openssl30/crypto/ui/ui_openssl.c	1
openssl30/crypto/ui/ui_null.c	1
openssl30/include/openssl/ui.h	2
openssl30/crypto/err/err_prn.c	1
openssl30/crypto/o_str.c	12
openssl30/crypto/bio/bio_print.c	9
openssl30/crypto/passphrase.c	9
openssl30/crypto/encode_decode/decoder_pkey.c	13
openssl30/crypto/encode_decode/decoder_meth.c	16
openssl30/crypto/encode_decode/decoder_lib.c	23
openssl30/crypto/evp/keymgmt_meth.c	21
openssl30/crypto/evp/evp_fetch.c	16
openssl30/crypto/core_namemap.c	19
openssl30/crypto/engine/eng_rdrand.c	4
openssl30/crypto/engine/eng_local.h	14
openssl30/crypto/engine/eng_dyn.c	12
openssl30/include/openssl/safestack.h	4
openssl30/crypto/dso/dso_dlfcn.c	1
openssl30/engines/e_padlock.c	22
openssl30/crypto/asn1/evp_asn1.c	1
openssl30/crypto/asn1/tasn_typ.c	9
openssl30/crypto/asn1/asn1_lib.c	12
openssl30/crypto/asn1/a_octet.c	1
openssl30/crypto/asn1/a_type.c	1
openssl30/crypto/asn1/tasn_fre.c	5
openssl30/crypto/asn1/a_object.c	6
openssl30/engines/e_afalg.c	27
openssl30/engines/e_afalg_err.c	3
openssl30/crypto/engine/eng_fat.c	5
openssl30/crypto/engine/eng_table.c	8
openssl30/crypto/async/async_wait.c	3
openssl30/crypto/async/arch/async_posix.h	1
openssl30/crypto/bsearch.c	1
openssl30/crypto/bn/bn_word.c	4
openssl30/crypto/bn/bn_lib.c	23
openssl30/crypto/bn/bn_local.h	1
openssl30/crypto/mem_sec.c	18
openssl30/crypto/bn/bn_shift.c	2
openssl30/crypto/bn/bn_conv.c	4
openssl30/include/internal/constant_time.h	4
openssl30/crypto/bn/asm/x86_64-gcc.c	2
openssl30/include/crypto/asn1.h	3
openssl30/crypto/property/property.c	25
openssl30/crypto/sparse_array.c	1
openssl30/crypto/core_fetch.c	3
openssl30/crypto/core_algorithm.c	4
openssl30/crypto/getenv.c	1
openssl30/include/openssl/core_dispatch.h	81
openssl30/crypto/provider.c	2
openssl30/crypto/property/property_query.c	3
openssl30/crypto/encode_decode/encoder_local.h	5
openssl30/crypto/evp/keymgmt_lib.c	14
openssl30/crypto/evp/p_lib.c	19
openssl30/include/crypto/evp.h	8
openssl30/include/openssl/x509.h	1
openssl30/crypto/x509/x_attrib.c	2
openssl30/include/openssl/asn1t.h	2
openssl30/crypto/asn1/tasn_utl.c	13
openssl30/crypto/asn1/a_int.c	10
openssl30/crypto/bio/ossl_core_bio.c	3
openssl30/crypto/ui/ui_util.c	8
openssl30/crypto/evp/encode.c	7
openssl30/crypto/evp/legacy_md5.c	1
openssl30/crypto/evp/m_sigver.c	7
openssl30/crypto/evp/signature.c	9
openssl30/crypto/evp/exchange.c	2
openssl30/crypto/evp/kem.c	2
openssl30/crypto/evp/asymcipher.c	2
openssl30/crypto/evp/ctrl_params_translate.c	10
openssl30/crypto/params_from_text.c	3
openssl30/crypto/asn1/p8_pkey.c	4
openssl30/crypto/asn1/tasn_dec.c	14
openssl30/crypto/buffer/buffer.c	4
openssl30/crypto/asn1/tasn_new.c	9
openssl30/crypto/asn1/a_bitstr.c	2
openssl30/crypto/evp/evp_pkey.c	1
openssl30/crypto/asn1/x_sig.c	3
openssl30/crypto/pkcs12/p12_p8d.c	2
openssl30/crypto/pkcs12/p12_decr.c	2
openssl30/crypto/evp/evp_pbe.c	6
openssl30/crypto/evp/evp_local.h	3
openssl30/crypto/asn1/d2i_pr.c	1
openssl30/crypto/x509/x_pubkey.c	7
openssl30/crypto/x509/x509_def.c	1
openssl30/crypto/conf/conf_lib.c	10
openssl30/crypto/conf/conf_def.c	1
openssl30/crypto/conf/conf_api.c	3
openssl30/include/openssl/conf.h	3
openssl30/crypto/conf/conf_mall.c	1
openssl30/crypto/asn1/asn_moid.c	3
openssl30/crypto/objects/obj_lib.c	1
openssl30/crypto/asn1/asn_mstbl.c	3
openssl30/crypto/x509/v3_utl.c	6
openssl30/crypto/asn1/asn1_gen.c	3
openssl30/crypto/asn1/a_strnid.c	6
openssl30/include/openssl/asn1.h	3
openssl30/crypto/engine/eng_cnf.c	5
openssl30/crypto/engine/eng_all.c	1
openssl30/crypto/engine/eng_ctrl.c	7
openssl30/crypto/evp/evp_cnf.c	2
openssl30/crypto/conf/conf_ssl.c	3
openssl30/crypto/provider_conf.c	10
openssl30/crypto/encode_decode/encoder_meth.c	3
openssl30/crypto/store/store_meth.c	3
openssl30/crypto/evp/legacy_md5_sha1.c	1
openssl30/crypto/evp/legacy_sha.c	13
openssl30/crypto/evp/legacy_mdc2.c	1
openssl30/crypto/evp/legacy_ripemd.c	1
openssl30/crypto/evp/legacy_wp.c	1
openssl30/crypto/sm3/legacy_sm3.c	1
openssl30/crypto/evp/legacy_blake2.c	2
openssl30/crypto/evp/e_des3.c	11
openssl30/crypto/evp/e_xcbc_d.c	1
openssl30/crypto/evp/e_rc4.c	2
openssl30/crypto/evp/e_rc4_hmac_md5.c	1
openssl30/crypto/evp/e_idea.c	4
openssl30/crypto/evp/e_seed.c	4
openssl30/crypto/evp/e_sm4.c	5
openssl30/crypto/evp/e_rc2.c	6
openssl30/crypto/evp/e_bf.c	4
openssl30/crypto/evp/e_cast.c	4
openssl30/crypto/evp/e_rc5.c	4
openssl30/crypto/evp/e_aes.c	38
openssl30/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl30/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl30/crypto/evp/e_aria.c	27
openssl30/crypto/evp/e_camellia.c	21
openssl30/crypto/evp/e_chacha20_poly1305.c	2
openssl30/crypto/store/store_init.c	1
openssl30/crypto/store/store_register.c	1
openssl30/crypto/store/store_local.h	1
openssl30/crypto/bio/bio_sock.c	1
openssl30/crypto/objects/obj_xref.c	2
openssl30/crypto/objects/obj_xref.h	2
openssl30/crypto/cmp/cmp_util.c	1
openssl30/crypto/trace.c	2
openssl30/crypto/cms/cms_io.c	2
openssl30/crypto/cms/cms_lib.c	6
openssl30/crypto/cms/cms_asn1.c	1
openssl30/crypto/asn1/a_d2i_fp.c	2
openssl30/crypto/cms/cms_sd.c	3
openssl30/include/openssl/cms.h	2
openssl30/crypto/cms/cms_env.c	6
openssl30/crypto/x509/x_x509.c	1
openssl30/crypto/cms/cms_local.h	2
openssl30/crypto/bio/bss_null.c	1
openssl30/crypto/asn1/a_i2d_fp.c	1
openssl30/crypto/asn1/tasn_enc.c	8
openssl30/crypto/asn1/asn1_local.h	3

Fuzzer: crl_111

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2335	73.7%
gold	[1:9]	144	4.55%
yellow	[10:29]	36	1.13%
greenyellow	[30:49]	4	0.12%
lawngreen	50+	645	20.3%
All colors	3164	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
7150	10608	3 : View List ['ENGINE_finish', 'EVP_PKEY_free', 'CRYPTO_free']	7150	10608	EVP_PKEY_CTX_free	call site: 02069	/src/openssl111/crypto/evp/pmeth_lib.c:354
6926	6926	2 : View List ['ENGINE_get_pkey_asn1_meth_engine', 'ENGINE_get_pkey_asn1_meth']	6926	6926	EVP_PKEY_asn1_find	call site: 02207	/src/openssl111/crypto/asn1/ameth_lib.c:88
3462	3462	1 : View List ['EVP_PKEY_CTX_ctrl']	3462	3462	EVP_DigestInit_ex	call site: 02048	/src/openssl111/crypto/evp/digest.c:149
3458	6923	4 : View List ['engine_unlocked_finish', 'CRYPTO_THREAD_unlock', 'ERR_put_error', 'CRYPTO_THREAD_write_lock']	3458	6923	ENGINE_finish	call site: 00167	/src/openssl111/crypto/engine/eng_init.c:99
3456	6910	2 : View List ['ENGINE_finish', 'ENGINE_get_digest']	6918	17312	EVP_DigestInit_ex	call site: 02031	/src/openssl111/crypto/evp/digest.c:107
3456	3456	1 : View List ['ENGINE_init']	10374	24223	EVP_DigestInit_ex	call site: 02029	/src/openssl111/crypto/evp/digest.c:98
3455	3455	1 : View List ['ASN1_STRING_new']	3455	6928	asn1_time_from_tm	call site: 00000	/src/openssl111/crypto/asn1/a_time.c:283
3454	3454	1 : View List ['ENGINE_register_all_complete']	3454	3459	OPENSSL_init_crypto	call site: 00014	/src/openssl111/crypto/init.c:737
3452	3452	1 : View List ['drbg_delete_thread_state']	3452	3456	ossl_init_thread_stop	call site: 00042	/src/openssl111/crypto/init.c:440
104	104	1 : View List ['sec_alloc_realloc']	104	3559	BUF_MEM_grow	call site: 02874	/src/openssl111/crypto/buffer/buffer.c:94
104	104	1 : View List ['sec_alloc_realloc']	104	3559	BUF_MEM_grow_clean	call site: 02690	/src/openssl111/crypto/buffer/buffer.c:132
76	76	1 : View List ['CRYPTO_secure_malloc']	76	76	CRYPTO_secure_zalloc	call site: 00881	/src/openssl111/crypto/mem_sec.c:143

Runtime coverage analysis

Covered functions

630

Functions that are reachable but not covered

688

Reachable functions

1081

Percentage of reachable functions covered

36.36%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl111/fuzz/driver.c	1
openssl111/fuzz/crl.c	1
openssl111/crypto/x509/x_crl.c	3
openssl111/crypto/asn1/tasn_dec.c	13
openssl111/crypto/err/err.c	31
openssl111/crypto/init.c	45
openssl111/crypto/mem.c	7
openssl111/crypto/threads_pthread.c	13
openssl111/crypto/async/async.c	10
openssl111/crypto/async/async_local.h	2
openssl111/crypto/stack/stack.c	12
openssl111/crypto/async/arch/async_posix.c	2
openssl111/crypto/rand/drbg_lib.c	4
openssl111/crypto/rand/rand_lib.c	5
openssl111/crypto/mem_sec.c	18
openssl111/crypto/cryptlib.c	6
openssl111/crypto/ex_data.c	10
openssl111/crypto/comp/c_zlib.c	1
openssl111/crypto/rand/rand_unix.c	4
openssl111/crypto/engine/eng_init.c	4
openssl111/crypto/engine/eng_lib.c	23
openssl111/include/internal/refcount.h	2
openssl111/crypto/engine/tb_pkmeth.c	4
openssl111/crypto/evp/pmeth_lib.c	4
openssl111/crypto/engine/tb_asnmth.c	9
openssl111/crypto/asn1/ameth_lib.c	8
openssl111/crypto/engine/eng_list.c	10
openssl111/include/internal/cryptlib.h	7
openssl111/include/openssl/crypto.h	6
openssl111/crypto/conf/conf_mod.c	15
openssl111/include/openssl/conf.h	18
openssl111/crypto/dso/dso_lib.c	8
openssl111/crypto/engine/eng_local.h	14
openssl111/crypto/store/store_init.c	1
openssl111/crypto/store/store_register.c	1
openssl111/crypto/store/store_local.h	2
openssl111/crypto/lhash/lhash.c	11
openssl111/crypto/bio/bio_lib.c	13
openssl111/crypto/bio/b_sock.c	1
openssl111/crypto/evp/names.c	5
openssl111/crypto/objects/o_names.c	10
openssl111/crypto/objects/obj_local.h	18
openssl111/crypto/mem_dbg.c	1
openssl111/crypto/ctype.c	3
openssl111/crypto/evp/evp_pbe.c	6
openssl111/crypto/evp/evp_local.h	3
openssl111/crypto/objects/obj_xref.c	5
openssl111/crypto/objects/obj_xref.h	4
openssl111/include/crypto/evp.h	1
openssl111/crypto/objects/obj_dat.c	22
openssl111/crypto/asn1/a_object.c	7
openssl111/include/openssl/err.h	5
openssl111/crypto/err/err_all.c	1
openssl111/crypto/evp/c_allc.c	1
openssl111/crypto/evp/e_des.c	6
openssl111/crypto/evp/e_des3.c	11
openssl111/crypto/evp/e_xcbc_d.c	1
openssl111/crypto/evp/e_rc4.c	2
openssl111/crypto/evp/e_rc4_hmac_md5.c	1
openssl111/crypto/evp/e_idea.c	4
openssl111/crypto/evp/e_seed.c	4
openssl111/crypto/evp/e_sm4.c	5
openssl111/crypto/evp/e_rc2.c	6
openssl111/crypto/evp/e_bf.c	4
openssl111/crypto/evp/e_cast.c	4
openssl111/crypto/evp/e_rc5.c	4
openssl111/crypto/evp/e_aes.c	38
openssl111/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl111/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl111/crypto/evp/e_aria.c	27
openssl111/crypto/evp/e_camellia.c	21
openssl111/crypto/evp/e_chacha20_poly1305.c	2
openssl111/crypto/evp/c_alld.c	1
openssl111/crypto/evp/m_md4.c	1
openssl111/crypto/evp/m_md5.c	1
openssl111/crypto/evp/m_md5_sha1.c	1
openssl111/crypto/evp/m_sha1.c	7
openssl111/crypto/evp/m_mdc2.c	1
openssl111/crypto/evp/m_ripemd.c	1
openssl111/crypto/evp/m_wp.c	1
openssl111/crypto/sm3/m_sm3.c	1
openssl111/crypto/blake2/m_blake2b.c	1
openssl111/crypto/blake2/m_blake2s.c	1
openssl111/crypto/evp/m_sha3.c	6
openssl111/crypto/conf/conf_sap.c	2
openssl111/crypto/conf/conf_mall.c	1
openssl111/crypto/asn1/asn_moid.c	3
openssl111/crypto/o_str.c	8
openssl111/crypto/conf/conf_lib.c	8
openssl111/crypto/conf/conf_api.c	3
openssl111/crypto/bn/bn_lib.c	17
openssl111/crypto/bn/bn_local.h	1
openssl111/crypto/bn/bn_word.c	4
openssl111/crypto/bn/asm/x86_64-gcc.c	2
openssl111/include/internal/constant_time.h	4
openssl111/crypto/bn/bn_shift.c	2
openssl111/crypto/asn1/asn1_lib.c	12
openssl111/crypto/objects/obj_lib.c	1
openssl111/crypto/asn1/asn_mstbl.c	3
openssl111/crypto/x509v3/v3_utl.c	6
openssl111/crypto/asn1/asn1_gen.c	3
openssl111/crypto/engine/eng_openssl.c	20
openssl111/crypto/engine/eng_rdrand.c	4
openssl111/crypto/engine/tb_rand.c	4
openssl111/crypto/engine/eng_dyn.c	12
openssl111/include/openssl/safestack.h	6
openssl111/crypto/dso/dso_dlfcn.c	1
openssl111/engines/e_padlock.c	1
openssl111/engines/e_afalg.c	28
openssl111/engines/e_afalg_err.c	3
openssl111/crypto/evp/cmeth_lib.c	8
openssl111/crypto/evp/evp_lib.c	28
openssl111/crypto/evp/evp_enc.c	14
openssl111/crypto/engine/eng_fat.c	5
openssl111/crypto/engine/tb_cipher.c	7
openssl111/crypto/engine/eng_table.c	8
openssl111/crypto/engine/tb_digest.c	5
openssl111/crypto/engine/tb_rsa.c	4
openssl111/crypto/engine/tb_dsa.c	4
openssl111/crypto/engine/tb_dh.c	4
openssl111/crypto/engine/tb_eckey.c	4
openssl111/crypto/async/async_wait.c	3
openssl111/crypto/async/arch/async_posix.h	1
openssl111/crypto/rsa/rsa_ossl.c	1
openssl111/crypto/dsa/dsa_ossl.c	1
openssl111/crypto/ec/ec_kmeth.c	1
openssl111/crypto/dh/dh_key.c	1
openssl111/crypto/sha/sha_local.h	1
openssl111/include/crypto/md32_common.h	2
openssl111/crypto/engine/eng_pkey.c	1
openssl111/crypto/bio/bss_file.c	2
openssl111/crypto/o_fopen.c	1
openssl111/crypto/pem/pem_pkey.c	1
openssl111/crypto/pem/pem_lib.c	14
openssl111/crypto/bio/bss_mem.c	1
openssl111/crypto/evp/encode.c	7
openssl111/include/crypto/asn1.h	3
openssl111/crypto/evp/evp_key.c	3
openssl111/crypto/ui/ui_lib.c	11
openssl111/crypto/ui/ui_openssl.c	1
openssl111/crypto/ui/ui_null.c	1
openssl111/include/openssl/ui.h	5
openssl111/crypto/err/err_prn.c	1
openssl111/crypto/bio/b_print.c	11
openssl111/crypto/evp/digest.c	7
openssl111/crypto/evp/p_lib.c	6
openssl111/include/openssl/x509.h	7
openssl111/crypto/x509/x_attrib.c	1
openssl111/crypto/asn1/tasn_fre.c	5
openssl111/include/openssl/asn1t.h	7
openssl111/crypto/asn1/tasn_utl.c	10
openssl111/crypto/asn1/a_int.c	10
openssl111/crypto/asn1/p8_pkey.c	3
openssl111/crypto/evp/evp_pkey.c	1
openssl111/crypto/bn/bn_print.c	1
openssl111/crypto/asn1/x_sig.c	3
openssl111/crypto/pkcs12/p12_p8d.c	1
openssl111/crypto/pkcs12/p12_decr.c	2
openssl111/crypto/asn1/d2i_pr.c	1
openssl111/crypto/asn1/a_strnid.c	6
openssl111/include/openssl/asn1.h	4
openssl111/crypto/engine/eng_cnf.c	5
openssl111/crypto/engine/eng_ctrl.c	6
openssl111/crypto/getenv.c	1
openssl111/crypto/evp/evp_cnf.c	2
openssl111/crypto/conf/conf_ssl.c	3
openssl111/crypto/engine/eng_all.c	1
openssl111/crypto/conf/conf_def.c	1
openssl111/crypto/x509/x509_def.c	1
openssl111/crypto/bn/bn_err.c	1
openssl111/crypto/rsa/rsa_err.c	1
openssl111/crypto/dh/dh_err.c	1
openssl111/crypto/evp/evp_err.c	1
openssl111/crypto/buffer/buf_err.c	1
openssl111/crypto/objects/obj_err.c	1
openssl111/crypto/pem/pem_err.c	1
openssl111/crypto/dsa/dsa_err.c	1
openssl111/crypto/x509/x509_err.c	1
openssl111/crypto/asn1/asn1_err.c	1
openssl111/crypto/conf/conf_err.c	1
openssl111/crypto/cpt_err.c	1
openssl111/crypto/comp/comp_err.c	1
openssl111/crypto/ec/ec_err.c	1
openssl111/crypto/bio/bio_err.c	1
openssl111/crypto/pkcs7/pkcs7err.c	1
openssl111/crypto/x509v3/v3err.c	1
openssl111/crypto/pkcs12/pk12err.c	1
openssl111/crypto/rand/rand_err.c	1
openssl111/crypto/dso/dso_err.c	1
openssl111/crypto/ts/ts_err.c	1
openssl111/crypto/engine/eng_err.c	1
openssl111/crypto/ocsp/ocsp_err.c	1
openssl111/crypto/ui/ui_err.c	1
openssl111/crypto/cms/cms_err.c	1
openssl111/crypto/ct/ct_err.c	1
openssl111/crypto/async/async_err.c	1
openssl111/crypto/kdf/kdf_err.c	1
openssl111/crypto/store/store_err.c	1
openssl111/crypto/buffer/buffer.c	5
openssl111/crypto/asn1/tasn_typ.c	12
openssl111/crypto/asn1/tasn_new.c	8
openssl111/crypto/asn1/a_type.c	1
openssl111/crypto/asn1/a_bitstr.c	2
openssl111/crypto/bio/bss_null.c	1
openssl111/crypto/x509/t_crl.c	2
openssl111/crypto/x509/x509cset.c	10
openssl111/crypto/x509/t_x509.c	2
openssl111/crypto/bio/b_dump.c	4
openssl111/crypto/asn1/a_strex.c	8
openssl111/crypto/x509/x_name.c	1
openssl111/crypto/x509/x509_obj.c	1
openssl111/crypto/x509/x509name.c	5
openssl111/crypto/asn1/asn1_par.c	4
openssl111/crypto/asn1/tasn_enc.c	8
openssl111/crypto/asn1/a_utf8.c	2
openssl111/crypto/asn1/a_time.c	4
openssl111/crypto/o_time.c	4
openssl111/crypto/x509v3/v3_prn.c	4
openssl111/crypto/x509/x509_v3.c	3
openssl111/crypto/x509v3/v3_lib.c	4
openssl111/include/openssl/x509v3.h	2
openssl111/crypto/asn1/a_print.c	1
openssl111/crypto/asn1/f_int.c	1

Fuzzer: decoder

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3411	59.9%
gold	[1:9]	1061	18.6%
yellow	[10:29]	105	1.84%
greenyellow	[30:49]	33	0.57%
lawngreen	50+	1081	18.9%
All colors	5691	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
32875	39925	8 : View List ['do_b2i_key', 'EVP_DecryptInit_ex', 'EVP_CIPHER_fetch', 'derive_pvk_key', 'CRYPTO_malloc', 'read_ledword', 'EVP_DecryptUpdate', 'EVP_DecryptFinal_ex']	32877	84866	do_PVK_body_key	call site: 00000	/src/openssl/crypto/pem/pvkfmt.c:868
20741	30171	13 : View List ['DSO_free', 'DSO_merge', 'DSO_convert_filename', 'DSO_new', 'ossl_safe_getenv', 'CRYPTO_THREAD_read_lock', 'DSO_bind_func', 'get_provider_store', 'CRYPTO_THREAD_unlock', 'DSO_load', 'CRYPTO_strdup', 'CRYPTO_free', 'DSO_ctrl']	24200	86971	provider_init	call site: 01608	/src/openssl/crypto/provider_core.c:886
17064	27465	5 : View List ['BN_lshift', 'CRYPTO_malloc', 'BN_CTX_get', 'generate_q_fips186_4', 'generate_p']	31866	89661	ossl_ffc_params_FIPS186_4_gen_verify	call site: 00000	/src/openssl/crypto/ffc/ffc_params_generate.c:619
11909	17885	10 : View List ['ossl_assert_int.33564', 'evp_keymgmt_util_clear_operation_cache', 'evp_keymgmt_util_cache_keydata', 'CRYPTO_THREAD_read_lock', 'evp_keymgmt_util_find_operation_cache', 'evp_keymgmt_freedata', 'match_type', 'CRYPTO_THREAD_unlock', 'evp_keymgmt_util_export', 'CRYPTO_THREAD_write_lock']	11909	17885	evp_keymgmt_util_export_to_provider	call site: 03180	/src/openssl/crypto/evp/keymgmt_lib.c:117
11848	11848	2 : View List ['sk_INFOPAIR_new_null', 'ossl_provider_info_add_parameter']	11848	21247	ossl_provider_new	call site: 04480	/src/openssl/crypto/provider_core.c:558
10374	13837	5 : View List ['ENGINE_get_digest', 'ENGINE_finish', 'EVP_PKEY_CTX_ctrl', 'ENGINE_init', 'CRYPTO_zalloc']	10374	61260	evp_md_init_internal	call site: 03582	/src/openssl/crypto/evp/digest.c:226
9914	9914	2 : View List ['ec_GF2m_simple_oct2point', 'ec_GFp_simple_oct2point']	9914	9914	EC_POINT_oct2point	call site: 00000	/src/openssl111/crypto/ec/ec_oct.c:113
9528	9550	4 : View List ['UI_destroy_method', 'do_ui_passphrase', 'OPENSSL_cleanse', 'CRYPTO_clear_realloc']	9528	9550	ossl_pw_get_passphrase	call site: 02768	/src/openssl/crypto/passphrase.c:274
9386	9386	2 : View List ['conf_diagnostics', 'CONF_modules_load']	9386	16308	CONF_modules_load_file_ex	call site: 00418	/src/openssl/crypto/conf/conf_mod.c:206
8805	8805	2 : View List ['ec_GF2m_simple_set_compressed_coordinates', 'ec_GFp_simple_set_compressed_coordinates']	8805	8805	EC_POINT_set_compressed_coordinates	call site: 00000	/src/openssl111/crypto/ec/ec_oct.c:32
8644	17330	2 : View List ['ossl_ffc_params_FIPS186_4_validate', 'ossl_ffc_params_FIPS186_2_validate']	8644	17330	ossl_ffc_params_full_validate	call site: 00000	/src/openssl/crypto/ffc/ffc_params_validate.c:154
8644	8644	1 : View List ['ossl_ffc_params_FIPS186_2_validate']	8644	26517	ossl_ffc_params_simple_validate	call site: 00000	/src/openssl/crypto/ffc/ffc_params_validate.c:115

Runtime coverage analysis

Covered functions

2609

Functions that are reachable but not covered

730

Reachable functions

1855

Percentage of reachable functions covered

60.65%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl/fuzz/driver.c	1
openssl/fuzz/decoder.c	1
openssl/crypto/bio/bss_null.c	1
openssl/crypto/bio/bio_lib.c	17
openssl/crypto/mem.c	6
openssl/crypto/err/err_blocks.c	4
openssl/crypto/err/err.c	30
openssl/crypto/init.c	40
openssl/crypto/err/err_local.h	6
openssl/crypto/threads_pthread.c	14
openssl/crypto/cpuid.c	4
openssl/crypto/ctype.c	3
openssl/crypto/initthread.c	21
openssl/crypto/stack/stack.c	19
openssl/crypto/err/err_save.c	1
openssl/crypto/comp/c_zlib.c	1
openssl/crypto/comp/c_brotli.c	1
openssl/crypto/comp/c_zstd.c	1
openssl/crypto/async/async.c	6
openssl/crypto/async/arch/async_posix.c	2
openssl/crypto/rand/rand_lib.c	11
openssl/providers/implementations/rands/seeding/rand_unix.c	4
openssl/crypto/engine/eng_init.c	4
openssl/crypto/cryptlib.c	2
openssl/crypto/engine/eng_lib.c	21
openssl/include/internal/refcount.h	4
openssl/crypto/engine/tb_pkmeth.c	7
openssl/crypto/evp/pmeth_lib.c	31
openssl/crypto/engine/tb_asnmth.c	8
openssl/crypto/asn1/ameth_lib.c	9
openssl/crypto/engine/eng_list.c	10
openssl/crypto/ex_data.c	13
openssl/crypto/context.c	16
openssl/crypto/property/property.c	29
openssl/crypto/sparse_array.c	1
openssl/crypto/provider_conf.c	14
openssl/crypto/evp/c_allc.c	1
openssl/crypto/evp/e_des.c	6
openssl/crypto/evp/names.c	9
openssl/crypto/objects/obj_dat.c	29
openssl/crypto/evp/c_alld.c	1
openssl/crypto/evp/legacy_md4.c	1
openssl/crypto/objects/o_names.c	12
openssl/crypto/objects/obj_local.h	18
openssl/crypto/lhash/lhash.c	13
openssl/crypto/evp/legacy_md5.c	1
openssl/crypto/evp/legacy_md5_sha1.c	1
openssl/crypto/evp/legacy_sha.c	13
openssl/crypto/evp/legacy_mdc2.c	1
openssl/crypto/evp/legacy_ripemd.c	1
openssl/crypto/evp/legacy_wp.c	1
openssl/crypto/sm3/legacy_sm3.c	1
openssl/crypto/evp/legacy_blake2.c	2
openssl/crypto/conf/conf_sap.c	2
openssl/crypto/conf/conf_mod.c	33
openssl/crypto/err/err_mark.c	3
openssl/crypto/getenv.c	1
openssl/crypto/o_str.c	14
openssl/crypto/x509/x509_def.c	1
openssl/crypto/bio/bio_print.c	11
openssl/include/internal/common.h	1
openssl/crypto/conf/conf_lib.c	10
openssl/crypto/conf/conf_def.c	1
openssl/include/openssl/err.h	4
openssl/crypto/conf/conf_api.c	3
openssl/include/openssl/conf.h	3
openssl/crypto/conf/conf_mall.c	1
openssl/crypto/asn1/asn_moid.c	3
openssl/crypto/bsearch.c	1
openssl/crypto/asn1/a_object.c	6
openssl/crypto/bn/bn_lib.c	26
openssl/crypto/bn/bn_local.h	1
openssl/crypto/mem_sec.c	18
openssl/crypto/bn/bn_word.c	4
openssl/crypto/bn/asm/x86_64-gcc.c	2
openssl/crypto/bn/bn_shift.c	2
openssl/crypto/asn1/asn1_lib.c	14
openssl/crypto/objects/obj_lib.c	2
openssl/crypto/asn1/asn_mstbl.c	3
openssl/crypto/x509/v3_utl.c	6
openssl/crypto/asn1/asn1_gen.c	3
openssl/crypto/asn1/tasn_dec.c	14
openssl/crypto/asn1/a_strnid.c	6
openssl/include/openssl/asn1.h	3
openssl/crypto/engine/eng_openssl.c	20
openssl/include/internal/cryptlib.h	7
openssl/include/openssl/crypto.h	2
openssl/crypto/evp/evp_lib.c	37
openssl/crypto/provider_core.c	49
openssl/crypto/engine/eng_rdrand.c	4
openssl/crypto/engine/tb_rand.c	4
openssl/crypto/engine/eng_local.h	14
openssl/crypto/engine/eng_dyn.c	12
openssl/crypto/dso/dso_lib.c	9
openssl/include/openssl/safestack.h	4
openssl/crypto/dso/dso_dlfcn.c	1
openssl/engines/e_padlock.c	22
openssl/crypto/engine/tb_cipher.c	7
openssl/crypto/evp/cmeth_lib.c	8
openssl/crypto/evp/evp_enc.c	26
openssl/crypto/params.c	48
openssl/crypto/evp/evp_utils.c	5
openssl/crypto/asn1/evp_asn1.c	1
openssl/crypto/asn1/tasn_typ.c	9
openssl/crypto/asn1/a_octet.c	1
openssl/crypto/asn1/a_type.c	1
openssl/crypto/asn1/tasn_fre.c	5
openssl/engines/e_afalg.c	28
openssl/engines/e_afalg_err.c	3
openssl/crypto/provider_local.h	4
openssl/crypto/provider_child.c	4
openssl/providers/implementations/rands/crngt.c	2
openssl/crypto/evp/digest.c	18
openssl/crypto/evp/evp_fetch.c	16
openssl/crypto/core_namemap.c	22
openssl/crypto/engine/eng_fat.c	5
openssl/crypto/engine/eng_table.c	8
openssl/crypto/engine/tb_digest.c	7
openssl/crypto/engine/tb_rsa.c	4
openssl/crypto/engine/tb_dsa.c	4
openssl/crypto/engine/tb_dh.c	4
openssl/crypto/engine/tb_eckey.c	4
openssl/include/crypto/asn1.h	3
openssl/crypto/core_fetch.c	3
openssl/crypto/core_algorithm.c	4
openssl/include/openssl/core_dispatch.h	79
openssl/crypto/encode_decode/decoder_pkey.c	27
openssl/crypto/async/async_wait.c	3
openssl/crypto/async/arch/async_posix.h	1
openssl/crypto/rsa/rsa_ossl.c	1
openssl/crypto/dsa/dsa_ossl.c	1
openssl/crypto/ec/ec_kmeth.c	1
openssl/crypto/dh/dh_key.c	1
openssl/crypto/rand/rand_meth.c	1
openssl/crypto/sha/sha_local.h	1
openssl/include/crypto/md32_common.h	2
openssl/crypto/engine/eng_pkey.c	1
openssl/crypto/bio/bss_file.c	2
openssl/crypto/o_fopen.c	1
openssl/crypto/pem/pem_pkey.c	5
openssl/crypto/bio/bf_readbuff.c	1
openssl/crypto/pem/pem_lib.c	15
openssl/crypto/evp/evp_key.c	3
openssl/crypto/ui/ui_lib.c	27
openssl/crypto/ui/ui_openssl.c	1
openssl/crypto/ui/ui_null.c	1
openssl/include/openssl/ui.h	2
openssl/crypto/err/err_prn.c	1
openssl/crypto/passphrase.c	10
openssl/crypto/encode_decode/decoder_meth.c	21
openssl/crypto/encode_decode/decoder_lib.c	28
openssl/crypto/evp/keymgmt_meth.c	21
openssl/crypto/provider.c	2
openssl/crypto/property/property_query.c	3
openssl/crypto/property/property_string.c	17
openssl/crypto/property/property_parse.c	25
openssl/crypto/encode_decode/encoder_local.h	11
openssl/crypto/evp/keymgmt_lib.c	15
openssl/crypto/evp/p_lib.c	27
openssl/include/crypto/evp.h	8
openssl/include/openssl/x509.h	2
openssl/crypto/x509/x_attrib.c	3
openssl/include/openssl/asn1t.h	2
openssl/crypto/asn1/tasn_utl.c	13
openssl/crypto/asn1/a_int.c	10
openssl/crypto/bio/bss_mem.c	3
openssl/crypto/bio/ossl_core_bio.c	3
openssl/crypto/ui/ui_util.c	8
openssl/crypto/evp/encode.c	7
openssl/crypto/evp/m_sigver.c	7
openssl/crypto/evp/signature.c	9
openssl/crypto/evp/exchange.c	2
openssl/crypto/evp/kem.c	2
openssl/crypto/evp/asymcipher.c	2
openssl/crypto/evp/ctrl_params_translate.c	10
openssl/crypto/params_from_text.c	3
openssl/crypto/bn/bn_conv.c	4
openssl/crypto/asn1/p8_pkey.c	4
openssl/crypto/buffer/buffer.c	2
openssl/crypto/asn1/tasn_new.c	9
openssl/crypto/asn1/a_bitstr.c	2
openssl/crypto/evp/evp_pkey.c	1
openssl/crypto/asn1/x_sig.c	3
openssl/crypto/pkcs12/p12_p8d.c	2
openssl/crypto/pkcs12/p12_decr.c	2
openssl/crypto/evp/evp_pbe.c	6
openssl/crypto/evp/evp_local.h	4
openssl/crypto/asn1/d2i_pr.c	1
openssl/crypto/x509/x_pubkey.c	7
openssl/crypto/engine/eng_cnf.c	5
openssl/crypto/engine/eng_all.c	1
openssl/crypto/engine/eng_ctrl.c	7
openssl/crypto/evp/evp_cnf.c	2
openssl/crypto/conf/conf_ssl.c	3
openssl/crypto/encode_decode/encoder_meth.c	18
openssl/crypto/store/store_meth.c	3
openssl/crypto/evp/e_des3.c	11
openssl/crypto/evp/e_xcbc_d.c	1
openssl/crypto/evp/e_rc4.c	2
openssl/crypto/evp/e_rc4_hmac_md5.c	1
openssl/crypto/evp/e_idea.c	4
openssl/crypto/evp/e_seed.c	4
openssl/crypto/evp/e_sm4.c	5
openssl/crypto/evp/e_rc2.c	6
openssl/crypto/evp/e_bf.c	4
openssl/crypto/evp/e_cast.c	4
openssl/crypto/evp/e_rc5.c	4
openssl/crypto/evp/e_aes.c	38
openssl/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl/crypto/evp/e_aria.c	27
openssl/crypto/evp/e_camellia.c	21
openssl/crypto/evp/e_chacha20_poly1305.c	2
openssl/crypto/err/err_all.c	1
openssl/crypto/bn/bn_err.c	1
openssl/crypto/rsa/rsa_err.c	1
openssl/crypto/dh/dh_err.c	1
openssl/crypto/evp/evp_err.c	1
openssl/crypto/buffer/buf_err.c	1
openssl/crypto/objects/obj_err.c	1
openssl/crypto/pem/pem_err.c	1
openssl/crypto/dsa/dsa_err.c	1
openssl/crypto/x509/x509_err.c	1
openssl/crypto/asn1/asn1_err.c	1
openssl/crypto/conf/conf_err.c	1
openssl/crypto/cpt_err.c	1
openssl/crypto/comp/comp_err.c	1
openssl/crypto/ec/ec_err.c	1
openssl/crypto/bio/bio_err.c	1
openssl/crypto/pkcs7/pkcs7err.c	1
openssl/crypto/x509/v3err.c	1
openssl/crypto/pkcs12/pk12err.c	1
openssl/crypto/rand/rand_err.c	1
openssl/crypto/dso/dso_err.c	1
openssl/crypto/ts/ts_err.c	1
openssl/crypto/engine/eng_err.c	1
openssl/crypto/http/http_err.c	1
openssl/crypto/ocsp/ocsp_err.c	1
openssl/crypto/ui/ui_err.c	1
openssl/crypto/cms/cms_err.c	1
openssl/crypto/crmf/crmf_err.c	1
openssl/crypto/cmp/cmp_err.c	1
openssl/crypto/ct/ct_err.c	1
openssl/crypto/ess/ess_err.c	1
openssl/crypto/async/async_err.c	1
openssl/crypto/store/store_err.c	1
openssl/crypto/property/property_err.c	1
openssl/providers/common/provider_err.c	1
openssl/crypto/property/defn_cache.c	5
openssl/crypto/bio/bss_core.c	2
openssl/providers/implementations/rands/drbg.c	2
openssl/crypto/self_test_core.c	2
openssl/crypto/thread/internal.c	2
openssl/crypto/thread/arch/thread_posix.c	4
openssl/crypto/evp/evp_rand.c	3
openssl/crypto/store/store_init.c	1
openssl/crypto/store/store_register.c	1
openssl/crypto/store/store_local.h	1
openssl/crypto/bio/bio_sock.c	1
openssl/crypto/objects/obj_xref.c	2
openssl/crypto/objects/obj_xref.h	2
openssl/crypto/cmp/cmp_util.c	1
openssl/crypto/trace.c	2
openssl/crypto/bio/bf_prefix.c	1
openssl/crypto/encode_decode/encoder_pkey.c	7
openssl/crypto/encode_decode/encoder_lib.c	18
openssl/crypto/x509/x509_att.c	3
openssl/crypto/asn1/a_dup.c	1
openssl/crypto/asn1/tasn_enc.c	8
openssl/crypto/asn1/asn1_local.h	3
openssl/crypto/evp/pmeth_check.c	7

Fuzzer: smime

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3488	61.8%
gold	[1:9]	940	16.6%
yellow	[10:29]	103	1.82%
greenyellow	[30:49]	59	1.04%
lawngreen	50+	1050	18.6%
All colors	5640	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
47407	47409	8 : View List ['sk_BIGNUM_const_push', 'RSA_get0_q', 'RSA_get0_iqmp', 'RSA_get_multi_prime_extra_count', 'sk_RSA_PRIME_INFO_value.14409', 'RSA_get0_p', 'RSA_get0_dmq1', 'RSA_get0_dmp1']	47407	47409	ossl_rsa_get0_all_params	call site: 00000	/src/openssl/crypto/rsa/rsa_lib.c:856
20741	30171	13 : View List ['DSO_free', 'DSO_merge', 'DSO_convert_filename', 'DSO_new', 'ossl_safe_getenv', 'CRYPTO_THREAD_read_lock', 'DSO_bind_func', 'get_provider_store', 'CRYPTO_THREAD_unlock', 'DSO_load', 'CRYPTO_strdup', 'CRYPTO_free', 'DSO_ctrl']	24200	86971	provider_init	call site: 01586	/src/openssl/crypto/provider_core.c:886
18426	21991	4 : View List ['ossl_rsa_pss_decode', 'ossl_rsa_sync_to_pss_params_30', 'ossl_rsa_set0_pss_params', 'RSA_PSS_PARAMS_free']	18426	21991	ossl_rsa_param_decode	call site: 00000	/src/openssl/crypto/rsa/rsa_backend.c:544
10374	13837	5 : View List ['ENGINE_get_digest', 'ENGINE_finish', 'EVP_PKEY_CTX_ctrl', 'ENGINE_init', 'CRYPTO_zalloc']	10374	61260	evp_md_init_internal	call site: 03570	/src/openssl/crypto/evp/digest.c:226
9386	9386	2 : View List ['conf_diagnostics', 'CONF_modules_load']	9386	16308	CONF_modules_load_file_ex	call site: 00396	/src/openssl/crypto/conf/conf_mod.c:206
7508	7508	2 : View List ['EVP_DigestVerifyInit', 'EVP_DigestSignInit']	7508	25282	evp_md_init_internal	call site: 02984	/src/openssl/crypto/evp/digest.c:166
5952	5952	1 : View List ['OSSL_PARAM_set_BN']	5952	5952	ossl_param_build_set_bn	call site: 00000	/src/openssl/crypto/param_build_set.c:93
5948	5948	1 : View List ['OSSL_PARAM_BLD_push_BN']	5948	5948	ossl_param_build_set_bn	call site: 00000	/src/openssl/crypto/param_build_set.c:89
5933	5933	1 : View List ['parse_oct']	5933	5933	parse_value	call site: 04314	/src/openssl/crypto/property/property_parse.c:244
5930	5930	1 : View List ['parse_hex']	5930	5930	parse_value	call site: 04306	/src/openssl/crypto/property/property_parse.c:241
5929	5929	1 : View List ['parse_string']	5929	5929	parse_value	call site: 04296	/src/openssl/crypto/property/property_parse.c:231
5929	5929	1 : View List ['parse_number']	5929	5929	parse_value	call site: 04319	/src/openssl/crypto/property/property_parse.c:247

Runtime coverage analysis

Covered functions

1555

Functions that are reachable but not covered

665

Reachable functions

1587

Percentage of reachable functions covered

58.1%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl/fuzz/driver.c	1
openssl/fuzz/smime.c	1
openssl/crypto/bio/bss_mem.c	3
openssl/crypto/err/err_blocks.c	4
openssl/crypto/err/err.c	30
openssl/crypto/init.c	40
openssl/crypto/err/err_local.h	6
openssl/crypto/mem.c	6
openssl/crypto/threads_pthread.c	14
openssl/crypto/err/err_save.c	1
openssl/crypto/initthread.c	21
openssl/crypto/stack/stack.c	19
openssl/crypto/comp/c_zlib.c	1
openssl/crypto/comp/c_brotli.c	1
openssl/crypto/comp/c_zstd.c	1
openssl/crypto/async/async.c	6
openssl/crypto/async/arch/async_posix.c	2
openssl/crypto/rand/rand_lib.c	11
openssl/providers/implementations/rands/seeding/rand_unix.c	4
openssl/crypto/engine/eng_init.c	4
openssl/crypto/cryptlib.c	2
openssl/crypto/engine/eng_lib.c	21
openssl/include/internal/refcount.h	4
openssl/crypto/engine/tb_pkmeth.c	7
openssl/crypto/evp/pmeth_lib.c	31
openssl/crypto/engine/tb_asnmth.c	8
openssl/crypto/asn1/ameth_lib.c	9
openssl/crypto/engine/eng_list.c	10
openssl/crypto/ex_data.c	12
openssl/crypto/context.c	16
openssl/crypto/property/property.c	29
openssl/crypto/sparse_array.c	1
openssl/crypto/provider_conf.c	14
openssl/crypto/evp/c_allc.c	1
openssl/crypto/evp/e_des.c	6
openssl/crypto/evp/names.c	9
openssl/crypto/objects/obj_dat.c	29
openssl/crypto/evp/c_alld.c	1
openssl/crypto/evp/legacy_md4.c	1
openssl/crypto/objects/o_names.c	12
openssl/crypto/objects/obj_local.h	18
openssl/crypto/lhash/lhash.c	13
openssl/crypto/evp/legacy_md5.c	1
openssl/crypto/evp/legacy_md5_sha1.c	1
openssl/crypto/evp/legacy_sha.c	13
openssl/crypto/evp/legacy_mdc2.c	1
openssl/crypto/evp/legacy_ripemd.c	1
openssl/crypto/evp/legacy_wp.c	1
openssl/crypto/sm3/legacy_sm3.c	1
openssl/crypto/evp/legacy_blake2.c	2
openssl/crypto/conf/conf_sap.c	2
openssl/crypto/conf/conf_mod.c	33
openssl/crypto/err/err_mark.c	3
openssl/crypto/getenv.c	1
openssl/crypto/o_str.c	14
openssl/crypto/x509/x509_def.c	1
openssl/crypto/bio/bio_print.c	9
openssl/include/internal/common.h	1
openssl/crypto/ctype.c	3
openssl/crypto/conf/conf_lib.c	10
openssl/crypto/conf/conf_def.c	1
openssl/include/openssl/err.h	4
openssl/crypto/conf/conf_api.c	3
openssl/include/openssl/conf.h	3
openssl/crypto/conf/conf_mall.c	1
openssl/crypto/asn1/asn_moid.c	3
openssl/crypto/bsearch.c	1
openssl/crypto/asn1/a_object.c	6
openssl/crypto/bn/bn_lib.c	26
openssl/crypto/bn/bn_local.h	1
openssl/crypto/mem_sec.c	18
openssl/crypto/bn/bn_word.c	4
openssl/crypto/bn/asm/x86_64-gcc.c	2
openssl/crypto/bn/bn_shift.c	2
openssl/crypto/asn1/asn1_lib.c	15
openssl/crypto/objects/obj_lib.c	2
openssl/crypto/asn1/asn_mstbl.c	3
openssl/crypto/x509/v3_utl.c	6
openssl/crypto/asn1/asn1_gen.c	3
openssl/crypto/asn1/tasn_dec.c	14
openssl/crypto/asn1/a_strnid.c	6
openssl/include/openssl/asn1.h	4
openssl/crypto/engine/eng_openssl.c	20
openssl/include/internal/cryptlib.h	7
openssl/include/openssl/crypto.h	2
openssl/crypto/evp/evp_lib.c	37
openssl/crypto/provider_core.c	49
openssl/crypto/engine/eng_rdrand.c	4
openssl/crypto/engine/tb_rand.c	4
openssl/crypto/engine/eng_local.h	14
openssl/crypto/engine/eng_dyn.c	12
openssl/crypto/dso/dso_lib.c	9
openssl/include/openssl/safestack.h	4
openssl/crypto/dso/dso_dlfcn.c	1
openssl/engines/e_padlock.c	22
openssl/crypto/engine/tb_cipher.c	7
openssl/crypto/evp/cmeth_lib.c	8
openssl/crypto/evp/evp_enc.c	26
openssl/crypto/params.c	48
openssl/crypto/evp/evp_utils.c	5
openssl/crypto/asn1/evp_asn1.c	1
openssl/crypto/asn1/tasn_typ.c	9
openssl/crypto/asn1/a_octet.c	1
openssl/crypto/asn1/a_type.c	1
openssl/crypto/asn1/tasn_fre.c	5
openssl/engines/e_afalg.c	28
openssl/engines/e_afalg_err.c	3
openssl/crypto/provider_local.h	4
openssl/crypto/provider_child.c	4
openssl/providers/implementations/rands/crngt.c	2
openssl/crypto/evp/digest.c	18
openssl/crypto/evp/evp_fetch.c	16
openssl/crypto/core_namemap.c	22
openssl/crypto/engine/eng_fat.c	5
openssl/crypto/engine/eng_table.c	8
openssl/crypto/engine/tb_digest.c	7
openssl/crypto/engine/tb_rsa.c	4
openssl/crypto/engine/tb_dsa.c	4
openssl/crypto/engine/tb_dh.c	4
openssl/crypto/engine/tb_eckey.c	4
openssl/include/crypto/asn1.h	3
openssl/crypto/core_fetch.c	3
openssl/crypto/core_algorithm.c	4
openssl/include/openssl/core_dispatch.h	79
openssl/crypto/encode_decode/decoder_pkey.c	27
openssl/crypto/async/async_wait.c	3
openssl/crypto/async/arch/async_posix.h	1
openssl/crypto/rsa/rsa_ossl.c	1
openssl/crypto/dsa/dsa_ossl.c	1
openssl/crypto/ec/ec_kmeth.c	1
openssl/crypto/dh/dh_key.c	1
openssl/crypto/rand/rand_meth.c	1
openssl/crypto/sha/sha_local.h	1
openssl/include/crypto/md32_common.h	2
openssl/crypto/engine/eng_pkey.c	1
openssl/crypto/bio/bss_file.c	2
openssl/crypto/o_fopen.c	1
openssl/crypto/bio/bio_lib.c	18
openssl/crypto/pem/pem_pkey.c	5
openssl/crypto/bio/bf_readbuff.c	1
openssl/crypto/pem/pem_lib.c	15
openssl/crypto/evp/evp_key.c	3
openssl/crypto/ui/ui_lib.c	27
openssl/crypto/ui/ui_openssl.c	1
openssl/crypto/ui/ui_null.c	1
openssl/include/openssl/ui.h	2
openssl/crypto/err/err_prn.c	1
openssl/crypto/passphrase.c	9
openssl/crypto/encode_decode/decoder_meth.c	21
openssl/crypto/encode_decode/decoder_lib.c	27
openssl/crypto/evp/keymgmt_meth.c	19
openssl/crypto/provider.c	2
openssl/crypto/property/property_query.c	3
openssl/crypto/property/property_string.c	17
openssl/crypto/property/property_parse.c	25
openssl/crypto/encode_decode/encoder_local.h	6
openssl/crypto/evp/keymgmt_lib.c	13
openssl/crypto/evp/p_lib.c	19
openssl/include/crypto/evp.h	8
openssl/include/openssl/x509.h	3
openssl/crypto/x509/x_attrib.c	2
openssl/include/openssl/asn1t.h	2
openssl/crypto/asn1/tasn_utl.c	13
openssl/crypto/asn1/a_int.c	11
openssl/crypto/bio/ossl_core_bio.c	3
openssl/crypto/ui/ui_util.c	8
openssl/crypto/evp/encode.c	7
openssl/crypto/evp/m_sigver.c	7
openssl/crypto/evp/signature.c	9
openssl/crypto/evp/exchange.c	2
openssl/crypto/evp/kem.c	2
openssl/crypto/evp/asymcipher.c	2
openssl/crypto/evp/ctrl_params_translate.c	10
openssl/crypto/params_from_text.c	3
openssl/crypto/bn/bn_conv.c	4
openssl/crypto/asn1/p8_pkey.c	4
openssl/crypto/buffer/buffer.c	4
openssl/crypto/asn1/tasn_new.c	9
openssl/crypto/asn1/a_bitstr.c	2
openssl/crypto/evp/evp_pkey.c	1
openssl/crypto/asn1/x_sig.c	3
openssl/crypto/pkcs12/p12_p8d.c	2
openssl/crypto/pkcs12/p12_decr.c	2
openssl/crypto/evp/evp_pbe.c	6
openssl/crypto/evp/evp_local.h	4
openssl/crypto/asn1/d2i_pr.c	1
openssl/crypto/x509/x_pubkey.c	7
openssl/crypto/engine/eng_cnf.c	5
openssl/crypto/engine/eng_all.c	1
openssl/crypto/engine/eng_ctrl.c	7
openssl/crypto/evp/evp_cnf.c	2
openssl/crypto/conf/conf_ssl.c	3
openssl/crypto/encode_decode/encoder_meth.c	3
openssl/crypto/store/store_meth.c	3
openssl/crypto/evp/e_des3.c	11
openssl/crypto/evp/e_xcbc_d.c	1
openssl/crypto/evp/e_rc4.c	2
openssl/crypto/evp/e_rc4_hmac_md5.c	1
openssl/crypto/evp/e_idea.c	4
openssl/crypto/evp/e_seed.c	4
openssl/crypto/evp/e_sm4.c	5
openssl/crypto/evp/e_rc2.c	6
openssl/crypto/evp/e_bf.c	4
openssl/crypto/evp/e_cast.c	4
openssl/crypto/evp/e_rc5.c	4
openssl/crypto/evp/e_aes.c	38
openssl/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl/crypto/evp/e_aria.c	27
openssl/crypto/evp/e_camellia.c	21
openssl/crypto/evp/e_chacha20_poly1305.c	2
openssl/crypto/err/err_all.c	1
openssl/crypto/bn/bn_err.c	1
openssl/crypto/rsa/rsa_err.c	1
openssl/crypto/dh/dh_err.c	1
openssl/crypto/evp/evp_err.c	1
openssl/crypto/buffer/buf_err.c	1
openssl/crypto/objects/obj_err.c	1
openssl/crypto/pem/pem_err.c	1
openssl/crypto/dsa/dsa_err.c	1
openssl/crypto/x509/x509_err.c	1
openssl/crypto/asn1/asn1_err.c	1
openssl/crypto/conf/conf_err.c	1
openssl/crypto/cpt_err.c	1
openssl/crypto/comp/comp_err.c	1
openssl/crypto/ec/ec_err.c	1
openssl/crypto/bio/bio_err.c	1
openssl/crypto/pkcs7/pkcs7err.c	1
openssl/crypto/x509/v3err.c	1
openssl/crypto/pkcs12/pk12err.c	1
openssl/crypto/rand/rand_err.c	1
openssl/crypto/dso/dso_err.c	1
openssl/crypto/ts/ts_err.c	1
openssl/crypto/engine/eng_err.c	1
openssl/crypto/http/http_err.c	1
openssl/crypto/ocsp/ocsp_err.c	1
openssl/crypto/ui/ui_err.c	1
openssl/crypto/cms/cms_err.c	1
openssl/crypto/crmf/crmf_err.c	1
openssl/crypto/cmp/cmp_err.c	1
openssl/crypto/ct/ct_err.c	1
openssl/crypto/ess/ess_err.c	1
openssl/crypto/async/async_err.c	1
openssl/crypto/store/store_err.c	1
openssl/crypto/property/property_err.c	1
openssl/providers/common/provider_err.c	1
openssl/crypto/property/defn_cache.c	5
openssl/crypto/bio/bss_core.c	2
openssl/providers/implementations/rands/drbg.c	2
openssl/crypto/self_test_core.c	2
openssl/crypto/thread/internal.c	2
openssl/crypto/thread/arch/thread_posix.c	4
openssl/crypto/evp/evp_rand.c	3
openssl/crypto/store/store_init.c	1
openssl/crypto/store/store_register.c	1
openssl/crypto/store/store_local.h	1
openssl/crypto/bio/bio_sock.c	1
openssl/crypto/objects/obj_xref.c	2
openssl/crypto/objects/obj_xref.h	2
openssl/crypto/cmp/cmp_util.c	1
openssl/crypto/trace.c	2
openssl/crypto/cpuid.c	4
openssl/crypto/pkcs7/pk7_mime.c	2
openssl/crypto/pkcs7/pk7_asn1.c	2
openssl/crypto/asn1/asn_mime.c	13
openssl/crypto/asn1/asn1_local.h	14
openssl/include/openssl/bio.h	2
openssl/crypto/evp/bio_b64.c	1
openssl/crypto/asn1/a_d2i_fp.c	2
openssl/crypto/pkcs7/pk7_lib.c	8
openssl/crypto/x509/x_x509.c	1
openssl/include/openssl/pkcs7.h	2
openssl/crypto/x509/x509_cmp.c	3
openssl/crypto/x509/x_name.c	2
openssl/crypto/asn1/tasn_enc.c	8
openssl/crypto/pkcs7/pk7_attr.c	1
openssl/crypto/pkcs7/pk7_doit.c	2
openssl/crypto/x509/x509_att.c	3
openssl/crypto/asn1/x_algor.c	3

Fuzzer: punycode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5342	99.3%
gold	[1:9]	2	0.03%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	32	0.59%
All colors	5376	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	None	6	17481	ossl_a2ulabel	call site: 05349	/src/openssl/crypto/punycode.c:263
0	0	None	6	13988	ossl_a2ulabel	call site: 05350	/src/openssl/crypto/punycode.c:266
0	0	1 : View List ['malloc']	0	0	CRYPTO_malloc	call site: 00002	/src/openssl111/crypto/mem.c:197
0	0	None	0	0	ossl_punycode_decode	call site: 05346	/src/openssl/crypto/punycode.c:173

Runtime coverage analysis

Covered functions

25

Functions that are reachable but not covered

1411

Reachable functions

1434

Percentage of reachable functions covered

1.6%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl/fuzz/driver.c	1
openssl/fuzz/punycode.c	1
openssl/crypto/mem.c	6
openssl/crypto/err/err_blocks.c	4
openssl/crypto/err/err.c	30
openssl/crypto/init.c	40
openssl/crypto/err/err_local.h	6
openssl/crypto/threads_pthread.c	14
openssl/crypto/err/err_save.c	1
openssl/crypto/initthread.c	21
openssl/crypto/stack/stack.c	19
openssl/crypto/comp/c_zlib.c	1
openssl/crypto/comp/c_brotli.c	1
openssl/crypto/comp/c_zstd.c	1
openssl/crypto/async/async.c	6
openssl/crypto/async/arch/async_posix.c	2
openssl/crypto/rand/rand_lib.c	11
openssl/providers/implementations/rands/seeding/rand_unix.c	4
openssl/crypto/engine/eng_init.c	4
openssl/crypto/cryptlib.c	2
openssl/crypto/engine/eng_lib.c	21
openssl/include/internal/refcount.h	4
openssl/crypto/engine/tb_pkmeth.c	7
openssl/crypto/evp/pmeth_lib.c	31
openssl/crypto/engine/tb_asnmth.c	8
openssl/crypto/asn1/ameth_lib.c	9
openssl/crypto/engine/eng_list.c	10
openssl/crypto/ex_data.c	12
openssl/crypto/context.c	16
openssl/crypto/property/property.c	29
openssl/crypto/sparse_array.c	1
openssl/crypto/provider_conf.c	14
openssl/crypto/evp/c_allc.c	1
openssl/crypto/evp/e_des.c	6
openssl/crypto/evp/names.c	9
openssl/crypto/objects/obj_dat.c	29
openssl/crypto/evp/c_alld.c	1
openssl/crypto/evp/legacy_md4.c	1
openssl/crypto/objects/o_names.c	12
openssl/crypto/objects/obj_local.h	18
openssl/crypto/lhash/lhash.c	13
openssl/crypto/evp/legacy_md5.c	1
openssl/crypto/evp/legacy_md5_sha1.c	1
openssl/crypto/evp/legacy_sha.c	13
openssl/crypto/evp/legacy_mdc2.c	1
openssl/crypto/evp/legacy_ripemd.c	1
openssl/crypto/evp/legacy_wp.c	1
openssl/crypto/sm3/legacy_sm3.c	1
openssl/crypto/evp/legacy_blake2.c	2
openssl/crypto/conf/conf_sap.c	2
openssl/crypto/conf/conf_mod.c	33
openssl/crypto/err/err_mark.c	3
openssl/crypto/getenv.c	1
openssl/crypto/o_str.c	14
openssl/crypto/x509/x509_def.c	1
openssl/crypto/bio/bio_print.c	9
openssl/include/internal/common.h	1
openssl/crypto/ctype.c	3
openssl/crypto/conf/conf_lib.c	10
openssl/crypto/conf/conf_def.c	1
openssl/include/openssl/err.h	4
openssl/crypto/conf/conf_api.c	3
openssl/include/openssl/conf.h	3
openssl/crypto/conf/conf_mall.c	1
openssl/crypto/asn1/asn_moid.c	3
openssl/crypto/bsearch.c	1
openssl/crypto/asn1/a_object.c	6
openssl/crypto/bn/bn_lib.c	26
openssl/crypto/bn/bn_local.h	1
openssl/crypto/mem_sec.c	18
openssl/crypto/bn/bn_word.c	4
openssl/crypto/bn/asm/x86_64-gcc.c	2
openssl/crypto/bn/bn_shift.c	2
openssl/crypto/asn1/asn1_lib.c	13
openssl/crypto/objects/obj_lib.c	1
openssl/crypto/asn1/asn_mstbl.c	3
openssl/crypto/x509/v3_utl.c	6
openssl/crypto/asn1/asn1_gen.c	3
openssl/crypto/asn1/tasn_dec.c	14
openssl/crypto/asn1/a_strnid.c	6
openssl/include/openssl/asn1.h	3
openssl/crypto/engine/eng_openssl.c	20
openssl/include/internal/cryptlib.h	7
openssl/include/openssl/crypto.h	2
openssl/crypto/evp/evp_lib.c	37
openssl/crypto/provider_core.c	49
openssl/crypto/engine/eng_rdrand.c	4
openssl/crypto/engine/tb_rand.c	4
openssl/crypto/engine/eng_local.h	14
openssl/crypto/engine/eng_dyn.c	12
openssl/crypto/dso/dso_lib.c	9
openssl/include/openssl/safestack.h	4
openssl/crypto/dso/dso_dlfcn.c	1
openssl/engines/e_padlock.c	22
openssl/crypto/engine/tb_cipher.c	7
openssl/crypto/evp/cmeth_lib.c	8
openssl/crypto/evp/evp_enc.c	26
openssl/crypto/params.c	48
openssl/crypto/evp/evp_utils.c	5
openssl/crypto/asn1/evp_asn1.c	1
openssl/crypto/asn1/tasn_typ.c	9
openssl/crypto/asn1/a_octet.c	1
openssl/crypto/asn1/a_type.c	1
openssl/crypto/asn1/tasn_fre.c	5
openssl/engines/e_afalg.c	28
openssl/engines/e_afalg_err.c	3
openssl/crypto/provider_local.h	4
openssl/crypto/provider_child.c	4
openssl/providers/implementations/rands/crngt.c	2
openssl/crypto/evp/digest.c	18
openssl/crypto/evp/evp_fetch.c	16
openssl/crypto/core_namemap.c	22
openssl/crypto/engine/eng_fat.c	5
openssl/crypto/engine/eng_table.c	8
openssl/crypto/engine/tb_digest.c	7
openssl/crypto/engine/tb_rsa.c	4
openssl/crypto/engine/tb_dsa.c	4
openssl/crypto/engine/tb_dh.c	4
openssl/crypto/engine/tb_eckey.c	4
openssl/include/crypto/asn1.h	3
openssl/crypto/core_fetch.c	3
openssl/crypto/core_algorithm.c	4
openssl/include/openssl/core_dispatch.h	79
openssl/crypto/encode_decode/decoder_pkey.c	27
openssl/crypto/async/async_wait.c	3
openssl/crypto/async/arch/async_posix.h	1
openssl/crypto/rsa/rsa_ossl.c	1
openssl/crypto/dsa/dsa_ossl.c	1
openssl/crypto/ec/ec_kmeth.c	1
openssl/crypto/dh/dh_key.c	1
openssl/crypto/rand/rand_meth.c	1
openssl/crypto/sha/sha_local.h	1
openssl/include/crypto/md32_common.h	2
openssl/crypto/engine/eng_pkey.c	1
openssl/crypto/bio/bss_file.c	2
openssl/crypto/o_fopen.c	1
openssl/crypto/bio/bio_lib.c	14
openssl/crypto/pem/pem_pkey.c	5
openssl/crypto/bio/bf_readbuff.c	1
openssl/crypto/pem/pem_lib.c	15
openssl/crypto/evp/evp_key.c	3
openssl/crypto/ui/ui_lib.c	27
openssl/crypto/ui/ui_openssl.c	1
openssl/crypto/ui/ui_null.c	1
openssl/include/openssl/ui.h	2
openssl/crypto/err/err_prn.c	1
openssl/crypto/passphrase.c	9
openssl/crypto/encode_decode/decoder_meth.c	21
openssl/crypto/encode_decode/decoder_lib.c	27
openssl/crypto/evp/keymgmt_meth.c	19
openssl/crypto/provider.c	2
openssl/crypto/property/property_query.c	3
openssl/crypto/property/property_string.c	17
openssl/crypto/property/property_parse.c	25
openssl/crypto/encode_decode/encoder_local.h	6
openssl/crypto/evp/keymgmt_lib.c	13
openssl/crypto/evp/p_lib.c	19
openssl/include/crypto/evp.h	8
openssl/include/openssl/x509.h	1
openssl/crypto/x509/x_attrib.c	2
openssl/include/openssl/asn1t.h	2
openssl/crypto/asn1/tasn_utl.c	9
openssl/crypto/asn1/a_int.c	8
openssl/crypto/bio/bss_mem.c	3
openssl/crypto/bio/ossl_core_bio.c	3
openssl/crypto/ui/ui_util.c	8
openssl/crypto/evp/encode.c	7
openssl/crypto/evp/m_sigver.c	7
openssl/crypto/evp/signature.c	9
openssl/crypto/evp/exchange.c	2
openssl/crypto/evp/kem.c	2
openssl/crypto/evp/asymcipher.c	2
openssl/crypto/evp/ctrl_params_translate.c	10
openssl/crypto/params_from_text.c	3
openssl/crypto/bn/bn_conv.c	4
openssl/crypto/asn1/p8_pkey.c	4
openssl/crypto/buffer/buffer.c	3
openssl/crypto/asn1/tasn_new.c	9
openssl/crypto/asn1/a_bitstr.c	1
openssl/crypto/evp/evp_pkey.c	1
openssl/crypto/asn1/x_sig.c	3
openssl/crypto/pkcs12/p12_p8d.c	2
openssl/crypto/pkcs12/p12_decr.c	2
openssl/crypto/evp/evp_pbe.c	6
openssl/crypto/evp/evp_local.h	4
openssl/crypto/asn1/d2i_pr.c	1
openssl/crypto/x509/x_pubkey.c	7
openssl/crypto/engine/eng_cnf.c	5
openssl/crypto/engine/eng_all.c	1
openssl/crypto/engine/eng_ctrl.c	7
openssl/crypto/evp/evp_cnf.c	2
openssl/crypto/conf/conf_ssl.c	3
openssl/crypto/encode_decode/encoder_meth.c	3
openssl/crypto/store/store_meth.c	3
openssl/crypto/evp/e_des3.c	11
openssl/crypto/evp/e_xcbc_d.c	1
openssl/crypto/evp/e_rc4.c	2
openssl/crypto/evp/e_rc4_hmac_md5.c	1
openssl/crypto/evp/e_idea.c	4
openssl/crypto/evp/e_seed.c	4
openssl/crypto/evp/e_sm4.c	5
openssl/crypto/evp/e_rc2.c	6
openssl/crypto/evp/e_bf.c	4
openssl/crypto/evp/e_cast.c	4
openssl/crypto/evp/e_rc5.c	4
openssl/crypto/evp/e_aes.c	38
openssl/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl/crypto/evp/e_aria.c	27
openssl/crypto/evp/e_camellia.c	21
openssl/crypto/evp/e_chacha20_poly1305.c	2
openssl/crypto/err/err_all.c	1
openssl/crypto/bn/bn_err.c	1
openssl/crypto/rsa/rsa_err.c	1
openssl/crypto/dh/dh_err.c	1
openssl/crypto/evp/evp_err.c	1
openssl/crypto/buffer/buf_err.c	1
openssl/crypto/objects/obj_err.c	1
openssl/crypto/pem/pem_err.c	1
openssl/crypto/dsa/dsa_err.c	1
openssl/crypto/x509/x509_err.c	1
openssl/crypto/asn1/asn1_err.c	1
openssl/crypto/conf/conf_err.c	1
openssl/crypto/cpt_err.c	1
openssl/crypto/comp/comp_err.c	1
openssl/crypto/ec/ec_err.c	1
openssl/crypto/bio/bio_err.c	1
openssl/crypto/pkcs7/pkcs7err.c	1
openssl/crypto/x509/v3err.c	1
openssl/crypto/pkcs12/pk12err.c	1
openssl/crypto/rand/rand_err.c	1
openssl/crypto/dso/dso_err.c	1
openssl/crypto/ts/ts_err.c	1
openssl/crypto/engine/eng_err.c	1
openssl/crypto/http/http_err.c	1
openssl/crypto/ocsp/ocsp_err.c	1
openssl/crypto/ui/ui_err.c	1
openssl/crypto/cms/cms_err.c	1
openssl/crypto/crmf/crmf_err.c	1
openssl/crypto/cmp/cmp_err.c	1
openssl/crypto/ct/ct_err.c	1
openssl/crypto/ess/ess_err.c	1
openssl/crypto/async/async_err.c	1
openssl/crypto/store/store_err.c	1
openssl/crypto/property/property_err.c	1
openssl/providers/common/provider_err.c	1
openssl/crypto/property/defn_cache.c	5
openssl/crypto/bio/bss_core.c	2
openssl/providers/implementations/rands/drbg.c	2
openssl/crypto/self_test_core.c	2
openssl/crypto/thread/internal.c	2
openssl/crypto/thread/arch/thread_posix.c	4
openssl/crypto/evp/evp_rand.c	3
openssl/crypto/store/store_init.c	1
openssl/crypto/store/store_register.c	1
openssl/crypto/store/store_local.h	1
openssl/crypto/bio/bio_sock.c	1
openssl/crypto/objects/obj_xref.c	2
openssl/crypto/objects/obj_xref.h	2
openssl/crypto/cmp/cmp_util.c	1
openssl/crypto/trace.c	2
openssl/crypto/cpuid.c	4
openssl/crypto/punycode.c	6
openssl/crypto/packet.c	10

Fuzzer: asn1parse_111

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2466	84.9%
gold	[1:9]	162	5.58%
yellow	[10:29]	35	1.20%
greenyellow	[30:49]	3	0.10%
lawngreen	50+	236	8.13%
All colors	2902	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
10856	14311	3 : View List ['ERR_put_error', 'ERR_add_error_data', 'asn1_template_ex_d2i']	10856	14311	asn1_item_embed_d2i	call site: 02190	/src/openssl111/crypto/asn1/tasn_dec.c:166
6994	13904	3 : View List ['ERR_put_error', 'BUF_MEM_grow_clean', 'asn1_collect']	6994	17643	asn1_d2i_ex_primitive	call site: 02221	/src/openssl111/crypto/asn1/tasn_dec.c:745
3675	3675	2 : View List ['ASN1_TYPE_set', 'ASN1_TYPE_new']	7153	45354	asn1_ex_c2i	call site: 02251	/src/openssl111/crypto/asn1/tasn_dec.c:807
3566	3566	1 : View List ['asn1_template_free']	3566	3566	asn1_item_embed_free	call site: 02079	/src/openssl111/crypto/asn1/tasn_fre.c:48
3486	3486	1 : View List ['asn1_find_end']	3486	10680	asn1_d2i_ex_primitive	call site: 02219	/src/openssl111/crypto/asn1/tasn_dec.c:719
3458	13823	3 : View List ['ERR_put_error', 'ERR_add_error_data', '__errno_location']	3458	13823	BIO_new_file	call site: 01696	/src/openssl111/crypto/bio/bss_file.c:68
3458	3458	1 : View List ['OBJ_nid2sn']	3464	24441	OBJ_obj2txt	call site: 02407	/src/openssl111/crypto/objects/obj_dat.c:415
3454	3454	1 : View List ['ENGINE_register_all_complete']	3454	3459	OPENSSL_init_crypto	call site: 00013	/src/openssl111/crypto/init.c:737
3452	3452	1 : View List ['drbg_delete_thread_state']	3452	3456	ossl_init_thread_stop	call site: 00041	/src/openssl111/crypto/init.c:440
82	82	1 : View List ['CRYPTO_secure_zalloc']	82	3537	bn_expand_internal	call site: 00879	/src/openssl111/crypto/bn/bn_lib.c:277
80	80	1 : View List ['CRYPTO_secure_clear_free']	80	80	bn_free_d	call site: 00913	/src/openssl111/crypto/bn/bn_lib.c:203
47	56	6 : View List ['lh_OBJ_NAME_doall', 'lh_OBJ_NAME_free', 'CRYPTO_THREAD_lock_free', 'lh_OBJ_NAME_get_down_load', 'sk_NAME_FUNCS_pop_free', 'lh_OBJ_NAME_set_down_load']	47	56	OBJ_NAME_cleanup	call site: 00287	/src/openssl111/crypto/objects/o_names.c:393

Runtime coverage analysis

Covered functions

233

Functions that are reachable but not covered

755

Reachable functions

973

Percentage of reachable functions covered

22.4%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl111/fuzz/driver.c	1
openssl111/fuzz/asn1parse.c	1
openssl111/crypto/asn1/asn1_par.c	4
openssl111/crypto/bio/bio_lib.c	13
openssl111/crypto/err/err.c	30
openssl111/crypto/init.c	45
openssl111/crypto/mem.c	7
openssl111/crypto/threads_pthread.c	13
openssl111/crypto/async/async.c	10
openssl111/crypto/async/async_local.h	2
openssl111/crypto/stack/stack.c	10
openssl111/crypto/async/arch/async_posix.c	2
openssl111/crypto/rand/drbg_lib.c	4
openssl111/crypto/rand/rand_lib.c	5
openssl111/crypto/mem_sec.c	18
openssl111/crypto/cryptlib.c	6
openssl111/crypto/ex_data.c	10
openssl111/crypto/comp/c_zlib.c	1
openssl111/crypto/rand/rand_unix.c	4
openssl111/crypto/engine/eng_init.c	4
openssl111/crypto/engine/eng_lib.c	23
openssl111/include/internal/refcount.h	2
openssl111/crypto/engine/tb_pkmeth.c	4
openssl111/crypto/evp/pmeth_lib.c	4
openssl111/crypto/engine/tb_asnmth.c	9
openssl111/crypto/asn1/ameth_lib.c	8
openssl111/crypto/engine/eng_list.c	10
openssl111/include/internal/cryptlib.h	7
openssl111/include/openssl/crypto.h	6
openssl111/crypto/conf/conf_mod.c	15
openssl111/include/openssl/conf.h	18
openssl111/crypto/dso/dso_lib.c	8
openssl111/crypto/engine/eng_local.h	14
openssl111/crypto/store/store_init.c	1
openssl111/crypto/store/store_register.c	1
openssl111/crypto/store/store_local.h	2
openssl111/crypto/lhash/lhash.c	11
openssl111/crypto/bio/b_sock.c	1
openssl111/crypto/evp/names.c	5
openssl111/crypto/objects/o_names.c	10
openssl111/crypto/objects/obj_local.h	18
openssl111/crypto/mem_dbg.c	1
openssl111/crypto/ctype.c	2
openssl111/crypto/evp/evp_pbe.c	6
openssl111/crypto/evp/evp_local.h	3
openssl111/crypto/objects/obj_xref.c	2
openssl111/crypto/objects/obj_xref.h	2
openssl111/include/crypto/evp.h	1
openssl111/crypto/objects/obj_dat.c	22
openssl111/crypto/asn1/a_object.c	7
openssl111/include/openssl/err.h	5
openssl111/crypto/err/err_all.c	1
openssl111/crypto/evp/c_allc.c	1
openssl111/crypto/evp/e_des.c	6
openssl111/crypto/evp/e_des3.c	11
openssl111/crypto/evp/e_xcbc_d.c	1
openssl111/crypto/evp/e_rc4.c	2
openssl111/crypto/evp/e_rc4_hmac_md5.c	1
openssl111/crypto/evp/e_idea.c	4
openssl111/crypto/evp/e_seed.c	4
openssl111/crypto/evp/e_sm4.c	5
openssl111/crypto/evp/e_rc2.c	6
openssl111/crypto/evp/e_bf.c	4
openssl111/crypto/evp/e_cast.c	4
openssl111/crypto/evp/e_rc5.c	4
openssl111/crypto/evp/e_aes.c	38
openssl111/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl111/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl111/crypto/evp/e_aria.c	27
openssl111/crypto/evp/e_camellia.c	21
openssl111/crypto/evp/e_chacha20_poly1305.c	2
openssl111/crypto/evp/c_alld.c	1
openssl111/crypto/evp/m_md4.c	1
openssl111/crypto/evp/m_md5.c	1
openssl111/crypto/evp/m_md5_sha1.c	1
openssl111/crypto/evp/m_sha1.c	7
openssl111/crypto/evp/m_mdc2.c	1
openssl111/crypto/evp/m_ripemd.c	1
openssl111/crypto/evp/m_wp.c	1
openssl111/crypto/sm3/m_sm3.c	1
openssl111/crypto/blake2/m_blake2b.c	1
openssl111/crypto/blake2/m_blake2s.c	1
openssl111/crypto/evp/m_sha3.c	6
openssl111/crypto/conf/conf_sap.c	2
openssl111/crypto/conf/conf_mall.c	1
openssl111/crypto/asn1/asn_moid.c	3
openssl111/crypto/o_str.c	8
openssl111/crypto/conf/conf_lib.c	8
openssl111/crypto/conf/conf_api.c	3
openssl111/crypto/bn/bn_lib.c	17
openssl111/crypto/bn/bn_local.h	1
openssl111/crypto/bn/bn_word.c	4
openssl111/crypto/bn/asm/x86_64-gcc.c	2
openssl111/include/internal/constant_time.h	4
openssl111/crypto/bn/bn_shift.c	2
openssl111/crypto/asn1/asn1_lib.c	11
openssl111/crypto/objects/obj_lib.c	1
openssl111/crypto/asn1/asn_mstbl.c	3
openssl111/crypto/x509v3/v3_utl.c	6
openssl111/crypto/asn1/asn1_gen.c	3
openssl111/crypto/asn1/tasn_dec.c	13
openssl111/crypto/engine/eng_openssl.c	20
openssl111/crypto/engine/eng_rdrand.c	4
openssl111/crypto/engine/tb_rand.c	4
openssl111/crypto/engine/eng_dyn.c	12
openssl111/include/openssl/safestack.h	6
openssl111/crypto/dso/dso_dlfcn.c	1
openssl111/engines/e_padlock.c	1
openssl111/engines/e_afalg.c	28
openssl111/engines/e_afalg_err.c	3
openssl111/crypto/evp/cmeth_lib.c	8
openssl111/crypto/evp/evp_lib.c	28
openssl111/crypto/evp/evp_enc.c	14
openssl111/crypto/engine/eng_fat.c	5
openssl111/crypto/engine/tb_cipher.c	7
openssl111/crypto/engine/eng_table.c	8
openssl111/crypto/engine/tb_digest.c	5
openssl111/crypto/engine/tb_rsa.c	4
openssl111/crypto/engine/tb_dsa.c	4
openssl111/crypto/engine/tb_dh.c	4
openssl111/crypto/engine/tb_eckey.c	4
openssl111/crypto/async/async_wait.c	3
openssl111/crypto/async/arch/async_posix.h	1
openssl111/crypto/rsa/rsa_ossl.c	1
openssl111/crypto/dsa/dsa_ossl.c	1
openssl111/crypto/ec/ec_kmeth.c	1
openssl111/crypto/dh/dh_key.c	1
openssl111/crypto/sha/sha_local.h	1
openssl111/include/crypto/md32_common.h	2
openssl111/crypto/engine/eng_pkey.c	1
openssl111/crypto/bio/bss_file.c	2
openssl111/crypto/o_fopen.c	1
openssl111/crypto/pem/pem_pkey.c	1
openssl111/crypto/pem/pem_lib.c	14
openssl111/crypto/bio/bss_mem.c	1
openssl111/crypto/evp/encode.c	7
openssl111/include/crypto/asn1.h	3
openssl111/crypto/evp/evp_key.c	3
openssl111/crypto/ui/ui_lib.c	11
openssl111/crypto/ui/ui_openssl.c	1
openssl111/crypto/ui/ui_null.c	1
openssl111/include/openssl/ui.h	5
openssl111/crypto/err/err_prn.c	1
openssl111/crypto/bio/b_print.c	11
openssl111/crypto/evp/digest.c	7
openssl111/crypto/evp/p_lib.c	6
openssl111/include/openssl/x509.h	1
openssl111/crypto/x509/x_attrib.c	1
openssl111/crypto/asn1/tasn_fre.c	5
openssl111/include/openssl/asn1t.h	6
openssl111/crypto/asn1/tasn_utl.c	9
openssl111/crypto/asn1/a_int.c	8
openssl111/crypto/asn1/p8_pkey.c	3
openssl111/crypto/buffer/buffer.c	2
openssl111/crypto/asn1/tasn_typ.c	11
openssl111/crypto/asn1/tasn_new.c	8
openssl111/crypto/asn1/a_type.c	1
openssl111/crypto/asn1/a_bitstr.c	1
openssl111/crypto/evp/evp_pkey.c	1
openssl111/crypto/bn/bn_print.c	1
openssl111/crypto/asn1/x_sig.c	3
openssl111/crypto/pkcs12/p12_p8d.c	1
openssl111/crypto/pkcs12/p12_decr.c	2
openssl111/crypto/asn1/d2i_pr.c	1
openssl111/crypto/asn1/a_strnid.c	6
openssl111/include/openssl/asn1.h	4
openssl111/crypto/engine/eng_cnf.c	5
openssl111/crypto/engine/eng_ctrl.c	6
openssl111/crypto/getenv.c	1
openssl111/crypto/evp/evp_cnf.c	2
openssl111/crypto/conf/conf_ssl.c	3
openssl111/crypto/engine/eng_all.c	1
openssl111/crypto/conf/conf_def.c	1
openssl111/crypto/x509/x509_def.c	1
openssl111/crypto/bn/bn_err.c	1
openssl111/crypto/rsa/rsa_err.c	1
openssl111/crypto/dh/dh_err.c	1
openssl111/crypto/evp/evp_err.c	1
openssl111/crypto/buffer/buf_err.c	1
openssl111/crypto/objects/obj_err.c	1
openssl111/crypto/pem/pem_err.c	1
openssl111/crypto/dsa/dsa_err.c	1
openssl111/crypto/x509/x509_err.c	1
openssl111/crypto/asn1/asn1_err.c	1
openssl111/crypto/conf/conf_err.c	1
openssl111/crypto/cpt_err.c	1
openssl111/crypto/comp/comp_err.c	1
openssl111/crypto/ec/ec_err.c	1
openssl111/crypto/bio/bio_err.c	1
openssl111/crypto/pkcs7/pkcs7err.c	1
openssl111/crypto/x509v3/v3err.c	1
openssl111/crypto/pkcs12/pk12err.c	1
openssl111/crypto/rand/rand_err.c	1
openssl111/crypto/dso/dso_err.c	1
openssl111/crypto/ts/ts_err.c	1
openssl111/crypto/engine/eng_err.c	1
openssl111/crypto/ocsp/ocsp_err.c	1
openssl111/crypto/ui/ui_err.c	1
openssl111/crypto/cms/cms_err.c	1
openssl111/crypto/ct/ct_err.c	1
openssl111/crypto/async/async_err.c	1
openssl111/crypto/kdf/kdf_err.c	1
openssl111/crypto/store/store_err.c	1
openssl111/crypto/bio/b_dump.c	4

Fuzzer: cmp_30

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5948	65.6%
gold	[1:9]	1019	11.2%
yellow	[10:29]	219	2.41%
greenyellow	[30:49]	46	0.50%
lawngreen	50+	1828	20.1%
All colors	9060	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
40767	194444	22 : View List ['OSSL_CRMF_CERTID_get0_issuer', 'ossl_cmp_pkisi_get_status', 'ossl_cmp_print_log', 'ossl_check_const_OSSL_CRMF_CERTID_sk_type', 'ossl_cmp_revrepcontent_get_CertId', 'send_receive_check', 'ossl_cmp_revrepcontent_get_pkisi', 'OSSL_CRMF_CERTTEMPLATE_get0_serialNumber', 'ASN1_INTEGER_cmp', 'OSSL_CMP_CTX_snprint_PKIStatus', 'X509_NAME_cmp', 'save_statusInfo', 'ERR_set_debug', 'OSSL_CRMF_CERTTEMPLATE_get0_issuer', 'ERR_new', 'sk_OSSL_CMP_REVDETAILS_value', 'OSSL_CRMF_CERTID_get0_serialNumber', 'ossl_check_const_X509_CRL_sk_type', 'ERR_set_error', 'OPENSSL_sk_num', 'ossl_check_const_OSSL_CMP_PKISI_sk_type', 'ERR_add_error_data']	40767	205666	OSSL_CMP_exec_RR_ses	call site: 08739	/src/openssl30/crypto/cmp/cmp_client.c:779
34076	58775	11 : View List ['ASN1_INTEGER_set', 'ERR_set_debug', 'ERR_new', 'OSSL_CRMF_POPO_new', 'ASN1_NULL_new', 'OSSL_CRMF_POPOSIGNINGKEY_new', 'OSSL_CRMF_POPOPRIVKEY_new', 'ERR_set_error', 'create_popo_signature', 'OSSL_CRMF_POPOSIGNINGKEY_free', 'ASN1_INTEGER_new']	34076	69997	OSSL_CRMF_MSG_create_popo	call site: 05785	/src/openssl30/crypto/crmf/crmf_lib.c:406
28070	28120	10 : View List ['sk_X509_EXTENSION_num', 'OBJ_obj2nid', 'X509_EXTENSION_get_critical', 'X509_EXTENSION_get_object', 'crl_set_issuers', 'sk_X509_EXTENSION_value', 'X509_CRL_get_ext_d2i', 'EVP_sha1', 'X509_CRL_digest', 'setup_idp']	28070	28120	crl_cb	call site: 00000	/src/openssl111/crypto/x509/x_crl.c:164
24473	125189	15 : View List ['ossl_cmp_print_log', 'time', 'ossl_sk_ASN1_UTF8STRING2text', 'send_receive_check', 'sk_OSSL_CMP_POLLREP_num', 'CRYPTO_free', 'OSSL_CMP_MSG_get_bodytype', 'ERR_set_debug', 'ERR_new', 'ossl_cmp_pollrepcontent_get0_pollrep', 'ossl_sleep.954', 'ossl_cmp_pollReq_new', 'ERR_set_error', 'ERR_add_error_data', 'ASN1_INTEGER_get_int64']	24473	153244	poll_for_response	call site: 08571	/src/openssl30/crypto/cmp/cmp_client.c:260
22826	40600	6 : View List ['OSSL_CMP_CTX_set_option', 'ERR_new', 'ERR_set_error', 'ossl_cmp_hdr_has_implicitConfirm', 'ossl_cmp_certrep_new', 'ERR_set_debug']	22826	49800	process_cert_request	call site: 08861	/src/openssl30/crypto/cmp/cmp_server.c:223
19849	19849	4 : View List ['OSSL_CRMF_MSG_set0_validity', 'time', 'ASN1_TIME_free', 'ASN1_TIME_adj']	48728	87513	OSSL_CMP_CTX_setup_CRM	call site: 05630	/src/openssl30/crypto/cmp/cmp_msg.c:310
14109	38482	7 : View List ['X509_get0_subject_key_id', 'set_sig_algor', 'set_senderKID', 'ossl_cmp_msg_add_extraCerts', 'ossl_cmp_calc_protection', 'X509_check_private_key', 'ossl_cmp_general_name_is_NULL_DN']	14109	91804	ossl_cmp_msg_protect	call site: 05968	/src/openssl30/crypto/cmp/cmp_protect.c:284
13530	13530	1 : View List ['ossl_cmp_exchange_error']	13530	13530	OSSL_CMP_try_certreq	call site: 08709	/src/openssl30/crypto/cmp/cmp_client.c:706
12978	18589	2 : View List ['send_receive_check', 'OSSL_CMP_MSG_free']	12978	18589	initial_certreq	call site: 05349	/src/openssl30/crypto/cmp/cmp_client.c:679
12978	16430	2 : View List ['send_receive_check', 'OPENSSL_sk_new_null']	12978	27652	OSSL_CMP_exec_GENM_ses	call site: 08829	/src/openssl30/crypto/cmp/cmp_client.c:899
12407	12407	1 : View List ['check_msg_find_cert']	12407	12407	OSSL_CMP_validate_msg	call site: 07749	/src/openssl30/crypto/cmp/cmp_vfy.c:622
11909	17885	10 : View List ['ossl_assert_int.33564', 'evp_keymgmt_util_clear_operation_cache', 'evp_keymgmt_util_cache_keydata', 'CRYPTO_THREAD_read_lock', 'evp_keymgmt_util_find_operation_cache', 'evp_keymgmt_freedata', 'match_type', 'CRYPTO_THREAD_unlock', 'evp_keymgmt_util_export', 'CRYPTO_THREAD_write_lock']	11909	17885	evp_keymgmt_util_export_to_provider	call site: 02878	/src/openssl/crypto/evp/keymgmt_lib.c:117

Runtime coverage analysis

Covered functions

2606

Functions that are reachable but not covered

1362

Reachable functions

2853

Percentage of reachable functions covered

52.26%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl30/fuzz/driver.c	1
openssl30/fuzz/cmp.c	6
openssl30/crypto/bio/bss_mem.c	3
openssl30/crypto/bio/bio_lib.c	19
openssl30/crypto/mem.c	7
openssl30/crypto/err/err_blocks.c	2
openssl30/crypto/err/err.c	33
openssl30/crypto/init.c	39
openssl30/crypto/err/err_local.h	5
openssl30/crypto/threads_pthread.c	13
openssl30/crypto/cpuid.c	4
openssl30/crypto/ctype.c	5
openssl30/crypto/initthread.c	21
openssl30/crypto/stack/stack.c	20
openssl30/crypto/comp/c_zlib.c	1
openssl30/crypto/async/async.c	6
openssl30/crypto/rand/rand_lib.c	17
openssl30/providers/implementations/rands/seeding/rand_unix.c	4
openssl30/crypto/engine/eng_init.c	4
openssl30/crypto/cryptlib.c	2
openssl30/crypto/engine/eng_lib.c	21
openssl30/include/internal/refcount.h	2
openssl30/crypto/engine/tb_pkmeth.c	7
openssl30/crypto/evp/pmeth_lib.c	35
openssl30/crypto/engine/tb_asnmth.c	9
openssl30/crypto/asn1/ameth_lib.c	9
openssl30/crypto/engine/eng_list.c	10
openssl30/crypto/ex_data.c	14
openssl30/crypto/context.c	17
openssl30/include/internal/cryptlib.h	8
openssl30/include/openssl/crypto.h	2
openssl30/crypto/property/property_parse.c	25
openssl30/crypto/property/property_string.c	12
openssl30/crypto/lhash/lhash.c	12
openssl30/crypto/evp/evp_rand.c	16
openssl30/crypto/provider_core.c	43
openssl30/crypto/err/err_all.c	1
openssl30/include/openssl/err.h	4
openssl30/crypto/bn/bn_err.c	1
openssl30/crypto/rsa/rsa_err.c	1
openssl30/crypto/dh/dh_err.c	1
openssl30/crypto/evp/evp_err.c	1
openssl30/crypto/buffer/buf_err.c	1
openssl30/crypto/objects/obj_err.c	1
openssl30/crypto/pem/pem_err.c	1
openssl30/crypto/dsa/dsa_err.c	1
openssl30/crypto/x509/x509_err.c	1
openssl30/crypto/asn1/asn1_err.c	1
openssl30/crypto/conf/conf_err.c	1
openssl30/crypto/cpt_err.c	1
openssl30/crypto/comp/comp_err.c	1
openssl30/crypto/ec/ec_err.c	1
openssl30/crypto/bio/bio_err.c	1
openssl30/crypto/pkcs7/pkcs7err.c	1
openssl30/crypto/x509/v3err.c	1
openssl30/crypto/pkcs12/pk12err.c	1
openssl30/crypto/rand/rand_err.c	1
openssl30/crypto/dso/dso_err.c	1
openssl30/crypto/ts/ts_err.c	1
openssl30/crypto/engine/eng_err.c	1
openssl30/crypto/http/http_err.c	1
openssl30/crypto/ocsp/ocsp_err.c	1
openssl30/crypto/ui/ui_err.c	1
openssl30/crypto/cms/cms_err.c	1
openssl30/crypto/crmf/crmf_err.c	1
openssl30/crypto/cmp/cmp_err.c	1
openssl30/crypto/ct/ct_err.c	1
openssl30/crypto/ess/ess_err.c	1
openssl30/crypto/async/async_err.c	1
openssl30/crypto/store/store_err.c	1
openssl30/crypto/property/property_err.c	1
openssl30/providers/common/provider_err.c	1
openssl30/crypto/evp/c_allc.c	1
openssl30/crypto/evp/e_des.c	6
openssl30/crypto/evp/names.c	9
openssl30/crypto/objects/obj_dat.c	24
openssl30/crypto/evp/c_alld.c	1
openssl30/crypto/evp/legacy_md4.c	1
openssl30/crypto/objects/obj_local.h	18
openssl30/crypto/objects/o_names.c	12
openssl30/crypto/conf/conf_sap.c	2
openssl30/crypto/conf/conf_mod.c	33
openssl30/crypto/engine/eng_openssl.c	20
openssl30/crypto/evp/evp_lib.c	42
openssl30/crypto/dso/dso_lib.c	9
openssl30/crypto/provider_local.h	4
openssl30/crypto/provider_child.c	2
openssl30/crypto/evp/cmeth_lib.c	8
openssl30/crypto/evp/evp_enc.c	27
openssl30/crypto/rsa/rsa_ossl.c	1
openssl30/crypto/engine/tb_rsa.c	4
openssl30/crypto/dsa/dsa_ossl.c	1
openssl30/crypto/engine/tb_dsa.c	4
openssl30/crypto/ec/ec_kmeth.c	1
openssl30/crypto/engine/tb_eckey.c	4
openssl30/crypto/dh/dh_key.c	1
openssl30/crypto/engine/tb_dh.c	4
openssl30/crypto/rand/rand_meth.c	1
openssl30/crypto/engine/tb_rand.c	6
openssl30/crypto/engine/tb_cipher.c	7
openssl30/crypto/params.c	48
openssl30/crypto/evp/evp_utils.c	5
openssl30/crypto/engine/tb_digest.c	7
openssl30/crypto/evp/digest.c	20
openssl30/crypto/sha/sha_local.h	1
openssl30/include/crypto/md32_common.h	2
openssl30/crypto/engine/eng_pkey.c	1
openssl30/crypto/bio/bss_file.c	3
openssl30/crypto/o_fopen.c	1
openssl30/crypto/pem/pem_pkey.c	5
openssl30/crypto/bio/bf_readbuff.c	1
openssl30/crypto/pem/pem_lib.c	15
openssl30/crypto/evp/evp_key.c	3
openssl30/crypto/ui/ui_lib.c	27
openssl30/crypto/ui/ui_openssl.c	1
openssl30/crypto/ui/ui_null.c	1
openssl30/include/openssl/ui.h	2
openssl30/crypto/err/err_prn.c	5
openssl30/crypto/o_str.c	13
openssl30/crypto/bio/bio_print.c	11
openssl30/crypto/passphrase.c	10
openssl30/crypto/encode_decode/decoder_pkey.c	13
openssl30/crypto/encode_decode/decoder_meth.c	16
openssl30/crypto/encode_decode/decoder_lib.c	23
openssl30/crypto/evp/keymgmt_meth.c	23
openssl30/crypto/evp/evp_fetch.c	16
openssl30/crypto/core_namemap.c	19
openssl30/crypto/engine/eng_rdrand.c	4
openssl30/crypto/engine/eng_local.h	14
openssl30/crypto/engine/eng_dyn.c	12
openssl30/include/openssl/safestack.h	4
openssl30/crypto/dso/dso_dlfcn.c	1
openssl30/engines/e_padlock.c	22
openssl30/crypto/asn1/evp_asn1.c	2
openssl30/crypto/asn1/tasn_typ.c	23
openssl30/crypto/asn1/asn1_lib.c	17
openssl30/crypto/asn1/a_octet.c	3
openssl30/crypto/asn1/a_type.c	3
openssl30/crypto/asn1/tasn_fre.c	5
openssl30/crypto/asn1/a_object.c	7
openssl30/engines/e_afalg.c	27
openssl30/engines/e_afalg_err.c	3
openssl30/crypto/engine/eng_fat.c	5
openssl30/crypto/engine/eng_table.c	8
openssl30/crypto/async/async_wait.c	3
openssl30/crypto/async/arch/async_posix.h	1
openssl30/crypto/bsearch.c	1
openssl30/crypto/bn/bn_word.c	4
openssl30/crypto/bn/bn_lib.c	24
openssl30/crypto/bn/bn_local.h	1
openssl30/crypto/mem_sec.c	18
openssl30/crypto/bn/bn_shift.c	2
openssl30/crypto/bn/bn_conv.c	4
openssl30/include/internal/constant_time.h	7
openssl30/crypto/bn/asm/x86_64-gcc.c	2
openssl30/include/crypto/asn1.h	3
openssl30/crypto/property/property.c	25
openssl30/crypto/sparse_array.c	1
openssl30/crypto/core_fetch.c	3
openssl30/crypto/core_algorithm.c	4
openssl30/crypto/getenv.c	1
openssl30/include/openssl/core_dispatch.h	115
openssl30/crypto/provider.c	2
openssl30/crypto/property/property_query.c	3
openssl30/crypto/encode_decode/encoder_local.h	10
openssl30/crypto/evp/keymgmt_lib.c	16
openssl30/crypto/evp/p_lib.c	38
openssl30/include/crypto/evp.h	8
openssl30/include/openssl/x509.h	10
openssl30/crypto/x509/x_attrib.c	2
openssl30/include/openssl/asn1t.h	2
openssl30/crypto/asn1/tasn_utl.c	13
openssl30/crypto/asn1/a_int.c	20
openssl30/crypto/bio/ossl_core_bio.c	3
openssl30/crypto/ui/ui_util.c	8
openssl30/crypto/evp/encode.c	7
openssl30/crypto/evp/legacy_md5.c	1
openssl30/crypto/evp/m_sigver.c	11
openssl30/crypto/evp/signature.c	12
openssl30/crypto/evp/exchange.c	3
openssl30/crypto/evp/kem.c	3
openssl30/crypto/evp/asymcipher.c	10
openssl30/crypto/evp/ctrl_params_translate.c	13
openssl30/crypto/params_from_text.c	3
openssl30/crypto/asn1/p8_pkey.c	4
openssl30/crypto/asn1/tasn_dec.c	14
openssl30/crypto/buffer/buffer.c	5
openssl30/crypto/asn1/tasn_new.c	10
openssl30/crypto/asn1/a_bitstr.c	5
openssl30/crypto/evp/evp_pkey.c	1
openssl30/crypto/asn1/x_sig.c	3
openssl30/crypto/pkcs12/p12_p8d.c	2
openssl30/crypto/pkcs12/p12_decr.c	2
openssl30/crypto/evp/evp_pbe.c	7
openssl30/crypto/evp/evp_local.h	3
openssl30/crypto/asn1/d2i_pr.c	1
openssl30/crypto/x509/x_pubkey.c	13
openssl30/crypto/x509/x509_def.c	1
openssl30/crypto/conf/conf_lib.c	10
openssl30/crypto/conf/conf_def.c	1
openssl30/crypto/conf/conf_api.c	3
openssl30/include/openssl/conf.h	3
openssl30/crypto/conf/conf_mall.c	1
openssl30/crypto/asn1/asn_moid.c	3
openssl30/crypto/objects/obj_lib.c	2
openssl30/crypto/asn1/asn_mstbl.c	3
openssl30/crypto/x509/v3_utl.c	18
openssl30/crypto/asn1/asn1_gen.c	3
openssl30/crypto/asn1/a_strnid.c	6
openssl30/include/openssl/asn1.h	8
openssl30/crypto/engine/eng_cnf.c	5
openssl30/crypto/engine/eng_all.c	1
openssl30/crypto/engine/eng_ctrl.c	7
openssl30/crypto/evp/evp_cnf.c	2
openssl30/crypto/conf/conf_ssl.c	3
openssl30/crypto/provider_conf.c	10
openssl30/crypto/encode_decode/encoder_meth.c	18
openssl30/crypto/store/store_meth.c	3
openssl30/crypto/evp/legacy_md5_sha1.c	1
openssl30/crypto/evp/legacy_sha.c	13
openssl30/crypto/evp/legacy_mdc2.c	1
openssl30/crypto/evp/legacy_ripemd.c	1
openssl30/crypto/evp/legacy_wp.c	1
openssl30/crypto/sm3/legacy_sm3.c	1
openssl30/crypto/evp/legacy_blake2.c	2
openssl30/crypto/evp/e_des3.c	11
openssl30/crypto/evp/e_xcbc_d.c	1
openssl30/crypto/evp/e_rc4.c	2
openssl30/crypto/evp/e_rc4_hmac_md5.c	1
openssl30/crypto/evp/e_idea.c	4
openssl30/crypto/evp/e_seed.c	4
openssl30/crypto/evp/e_sm4.c	5
openssl30/crypto/evp/e_rc2.c	6
openssl30/crypto/evp/e_bf.c	4
openssl30/crypto/evp/e_cast.c	4
openssl30/crypto/evp/e_rc5.c	4
openssl30/crypto/evp/e_aes.c	38
openssl30/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl30/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl30/crypto/evp/e_aria.c	27
openssl30/crypto/evp/e_camellia.c	21
openssl30/crypto/evp/e_chacha20_poly1305.c	2
openssl30/crypto/store/store_init.c	1
openssl30/crypto/store/store_register.c	1
openssl30/crypto/store/store_local.h	1
openssl30/crypto/bio/bio_sock.c	1
openssl30/crypto/objects/obj_xref.c	8
openssl30/crypto/objects/obj_xref.h	4
openssl30/crypto/cmp/cmp_util.c	8
openssl30/crypto/trace.c	2
openssl30/crypto/cmp/cmp_msg.c	35
openssl30/crypto/cmp/cmp_asn.c	38
openssl30/crypto/asn1/a_d2i_fp.c	2
openssl30/crypto/bio/bss_null.c	1
openssl30/crypto/cmp/cmp_server.c	12
openssl30/crypto/cmp/cmp_ctx.c	27
openssl30/crypto/http/http_client.c	2
openssl30/crypto/x509/x_x509.c	11
openssl30/crypto/x509/x_name.c	10
openssl30/crypto/x509/x509_lu.c	18
openssl30/include/openssl/x509_vfy.h	9
openssl30/crypto/x509/x_crl.c	4
openssl30/crypto/x509/x509_vpm.c	14
openssl30/include/openssl/cmp.h	8
openssl30/include/openssl/x509v3.h	19
openssl30/crypto/x509/v3_genn.c	8
openssl30/crypto/x509/x_exten.c	5
openssl30/crypto/x509/v3_cpols.c	4
openssl30/crypto/x509/x_req.c	4
openssl30/crypto/asn1/a_i2d_fp.c	1
openssl30/crypto/asn1/tasn_enc.c	8
openssl30/crypto/asn1/asn1_local.h	3
openssl30/crypto/asn1/tasn_prn.c	4
openssl30/crypto/x509/x509_set.c	14
openssl30/crypto/asn1/a_dup.c	1
openssl30/crypto/cmp/cmp_client.c	13
openssl30/crypto/cmp/cmp_hdr.c	17
openssl30/crypto/x509/x509_cmp.c	19
openssl30/crypto/asn1/a_gentm.c	2
openssl30/crypto/o_time.c	6
openssl30/crypto/asn1/a_time.c	12
openssl30/crypto/crmf/crmf_asn.c	28
openssl30/crypto/cmp/cmp_local.h	12
openssl30/crypto/x509/x509_req.c	5
openssl30/crypto/x509/x509name.c	9
openssl30/crypto/x509/x509_v3.c	13
openssl30/crypto/crmf/crmf_lib.c	18
openssl30/crypto/x509/x509_att.c	4
openssl30/crypto/x509/v3_lib.c	6
openssl30/crypto/x509/v3_conf.c	2
openssl30/crypto/crmf/crmf_local.h	3
openssl30/crypto/asn1/a_sign.c	2
openssl30/crypto/asn1/x_algor.c	9
openssl30/include/openssl/crmf.h	4
openssl30/crypto/cmp/cmp_protect.c	6
openssl30/crypto/crmf/crmf_pbm.c	2
openssl30/crypto/x509/v3_purp.c	20
openssl30/crypto/x509/x_all.c	4
openssl30/crypto/asn1/a_digest.c	1
openssl30/crypto/x509/x509_ext.c	6
openssl30/crypto/x509/v3_bcons.c	2
openssl30/crypto/x509/v3_pcia.c	2
openssl30/crypto/x509/v3_crld.c	1
openssl30/crypto/evp/mac_lib.c	10
openssl30/crypto/evp/mac_meth.c	9
openssl30/crypto/x509/x509_vfy.c	67
openssl30/crypto/x509/pcy_tree.c	14
openssl30/crypto/x509/pcy_node.c	7
openssl30/crypto/x509/pcy_local.h	7
openssl30/crypto/x509/pcy_data.c	2
openssl30/crypto/asn1/a_verify.c	2
openssl30/crypto/rsa/rsa_ameth.c	3
openssl30/crypto/rsa/rsa_backend.c	2
openssl30/crypto/rsa/rsa_asn1.c	2
openssl30/crypto/asn1/asn_pack.c	1
openssl30/crypto/rsa/rsa_pss.c	3
openssl30/crypto/rsa/rsa_lib.c	4
openssl30/crypto/asn1/a_utctm.c	1
openssl30/crypto/x509/x509cset.c	4
openssl30/crypto/x509/pcy_cache.c	6
openssl30/crypto/x509/pcy_map.c	1
openssl30/crypto/x509/v3_pmaps.c	2
openssl30/crypto/x509/v3_pcons.c	2
openssl30/crypto/x509/pcy_lib.c	1
openssl30/include/internal/dane.h	2
openssl30/crypto/asn1/a_strex.c	9
openssl30/crypto/asn1/a_mbstr.c	7
openssl30/crypto/asn1/a_utf8.c	2
openssl30/include/internal/unicode.h	1
openssl30/crypto/x509/x509_trust.c	5
openssl30/crypto/x509/v3_ncons.c	15
openssl30/crypto/punycode.c	6
openssl30/crypto/x509/v3_asid.c	6
openssl30/crypto/x509/v3_addr.c	10
openssl30/crypto/cmp/cmp_vfy.c	17
openssl30/crypto/x509/x509_obj.c	1
openssl30/crypto/x509/t_x509.c	5
openssl30/crypto/bio/bio_dump.c	4
openssl30/crypto/asn1/asn1_parse.c	4
openssl30/crypto/bio/bf_prefix.c	1
openssl30/crypto/encode_decode/encoder_pkey.c	7
openssl30/crypto/encode_decode/encoder_lib.c	18
openssl30/crypto/x509/v3_prn.c	4
openssl30/crypto/asn1/a_print.c	1
openssl30/crypto/x509/x_x509a.c	5
openssl30/crypto/cmp/cmp_status.c	7
openssl30/./e_os.h	1

Fuzzer: asn1parse

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4679	86.0%
gold	[1:9]	431	7.92%
yellow	[10:29]	30	0.55%
greenyellow	[30:49]	7	0.12%
lawngreen	50+	289	5.31%
All colors	5436	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
9386	9386	2 : View List ['conf_diagnostics', 'CONF_modules_load']	12843	16308	CONF_modules_load_file_ex	call site: 00398	/src/openssl/crypto/conf/conf_mod.c:206
6016	6016	1 : View List ['ossl_asn1_template_free']	6016	6016	ossl_asn1_item_embed_free	call site: 02500	/src/openssl/crypto/asn1/tasn_fre.c:48
5924	11854	5 : View List ['EVP_RAND_CTX_free', 'CRYPTO_DOWN_REF.9536', 'CRYPTO_FREE_REF.9537', 'EVP_RAND_free', 'CRYPTO_free']	5924	11854	EVP_RAND_CTX_free	call site: 05144	/src/openssl/crypto/evp/evp_rand.c:378
5924	5924	1 : View List ['ossl_rand_crng_ctx_free']	5924	5954	context_deinit_objs	call site: 05188	/src/openssl/crypto/context.c:310
3457	3457	1 : View List ['ERR_clear_last_mark']	3457	3457	CONF_modules_load_file_ex	call site: 04649	/src/openssl/crypto/conf/conf_mod.c:225
3455	3489	4 : View List ['ERR_put_error', 'CRYPTO_realloc', 'CRYPTO_malloc', 'ossl_assert_int']	3455	3489	doapr_outch	call site: 00346	/src/openssl111/crypto/bio/b_print.c:839
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_lshift	call site: 00657	/src/openssl111/crypto/bn/bn_shift.c:85
11	11	1 : View List ['lh_ADDED_OBJ_retrieve']	11	19	ossl_obj_obj2nid	call site: 00689	/src/openssl/crypto/objects/obj_dat.c:374
6	3459	2 : View List ['BN_set_word', 'BN_set_negative']	6	3459	BN_sub_word	call site: 00641	/src/openssl111/crypto/bn/bn_word.c:145
6	12	2 : View List ['CRYPTO_malloc', 'sk_EX_CALLBACK_value']	20	35	ossl_crypto_new_ex_data_ex	call site: 00875	/src/openssl/crypto/ex_data.c:239
6	12	3 : View List ['property_free', 'ossl_check_OPENSSL_CSTRING_sk_type.13567', 'OPENSSL_sk_pop']	6	17	ossl_property_string	call site: 02298	/src/openssl/crypto/property/property_string.c:181
6	6	1 : View List ['sk_EX_CALLBACK_value']	6	11	ossl_crypto_free_ex_index_ex	call site: 00000	/src/openssl/crypto/ex_data.c:127

Runtime coverage analysis

Covered functions

428

Functions that are reachable but not covered

1104

Reachable functions

1506

Percentage of reachable functions covered

26.69%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl/fuzz/driver.c	1
openssl/fuzz/asn1parse.c	1
openssl/crypto/asn1/asn1_parse.c	4
openssl/crypto/bio/bio_lib.c	16
openssl/crypto/err/err_blocks.c	4
openssl/crypto/err/err.c	30
openssl/crypto/init.c	40
openssl/crypto/err/err_local.h	6
openssl/crypto/mem.c	6
openssl/crypto/threads_pthread.c	14
openssl/crypto/err/err_save.c	1
openssl/crypto/initthread.c	21
openssl/crypto/stack/stack.c	19
openssl/crypto/comp/c_zlib.c	1
openssl/crypto/comp/c_brotli.c	1
openssl/crypto/comp/c_zstd.c	1
openssl/crypto/async/async.c	6
openssl/crypto/async/arch/async_posix.c	2
openssl/crypto/rand/rand_lib.c	11
openssl/providers/implementations/rands/seeding/rand_unix.c	4
openssl/crypto/engine/eng_init.c	4
openssl/crypto/cryptlib.c	2
openssl/crypto/engine/eng_lib.c	21
openssl/include/internal/refcount.h	4
openssl/crypto/engine/tb_pkmeth.c	7
openssl/crypto/evp/pmeth_lib.c	31
openssl/crypto/engine/tb_asnmth.c	8
openssl/crypto/asn1/ameth_lib.c	9
openssl/crypto/engine/eng_list.c	10
openssl/crypto/ex_data.c	12
openssl/crypto/context.c	16
openssl/crypto/property/property.c	29
openssl/crypto/sparse_array.c	1
openssl/crypto/provider_conf.c	14
openssl/crypto/evp/c_allc.c	1
openssl/crypto/evp/e_des.c	6
openssl/crypto/evp/names.c	9
openssl/crypto/objects/obj_dat.c	29
openssl/crypto/evp/c_alld.c	1
openssl/crypto/evp/legacy_md4.c	1
openssl/crypto/objects/o_names.c	12
openssl/crypto/objects/obj_local.h	18
openssl/crypto/lhash/lhash.c	13
openssl/crypto/evp/legacy_md5.c	1
openssl/crypto/evp/legacy_md5_sha1.c	1
openssl/crypto/evp/legacy_sha.c	13
openssl/crypto/evp/legacy_mdc2.c	1
openssl/crypto/evp/legacy_ripemd.c	1
openssl/crypto/evp/legacy_wp.c	1
openssl/crypto/sm3/legacy_sm3.c	1
openssl/crypto/evp/legacy_blake2.c	2
openssl/crypto/conf/conf_sap.c	2
openssl/crypto/conf/conf_mod.c	33
openssl/crypto/err/err_mark.c	3
openssl/crypto/getenv.c	1
openssl/crypto/o_str.c	14
openssl/crypto/x509/x509_def.c	1
openssl/crypto/bio/bio_print.c	11
openssl/include/internal/common.h	1
openssl/crypto/ctype.c	3
openssl/crypto/conf/conf_lib.c	10
openssl/crypto/conf/conf_def.c	1
openssl/include/openssl/err.h	4
openssl/crypto/conf/conf_api.c	3
openssl/include/openssl/conf.h	3
openssl/crypto/conf/conf_mall.c	1
openssl/crypto/asn1/asn_moid.c	3
openssl/crypto/bsearch.c	1
openssl/crypto/asn1/a_object.c	7
openssl/crypto/bn/bn_lib.c	26
openssl/crypto/bn/bn_local.h	1
openssl/crypto/mem_sec.c	18
openssl/crypto/bn/bn_word.c	4
openssl/crypto/bn/asm/x86_64-gcc.c	2
openssl/crypto/bn/bn_shift.c	2
openssl/crypto/asn1/asn1_lib.c	13
openssl/crypto/objects/obj_lib.c	1
openssl/crypto/asn1/asn_mstbl.c	3
openssl/crypto/x509/v3_utl.c	6
openssl/crypto/asn1/asn1_gen.c	3
openssl/crypto/asn1/tasn_dec.c	14
openssl/crypto/asn1/a_strnid.c	6
openssl/include/openssl/asn1.h	3
openssl/crypto/engine/eng_openssl.c	20
openssl/include/internal/cryptlib.h	7
openssl/include/openssl/crypto.h	2
openssl/crypto/evp/evp_lib.c	37
openssl/crypto/provider_core.c	49
openssl/crypto/engine/eng_rdrand.c	4
openssl/crypto/engine/tb_rand.c	4
openssl/crypto/engine/eng_local.h	14
openssl/crypto/engine/eng_dyn.c	12
openssl/crypto/dso/dso_lib.c	9
openssl/include/openssl/safestack.h	4
openssl/crypto/dso/dso_dlfcn.c	1
openssl/engines/e_padlock.c	22
openssl/crypto/engine/tb_cipher.c	7
openssl/crypto/evp/cmeth_lib.c	8
openssl/crypto/evp/evp_enc.c	26
openssl/crypto/params.c	48
openssl/crypto/evp/evp_utils.c	5
openssl/crypto/asn1/evp_asn1.c	1
openssl/crypto/asn1/tasn_typ.c	16
openssl/crypto/asn1/a_octet.c	1
openssl/crypto/asn1/a_type.c	1
openssl/crypto/asn1/tasn_fre.c	5
openssl/engines/e_afalg.c	28
openssl/engines/e_afalg_err.c	3
openssl/crypto/provider_local.h	4
openssl/crypto/provider_child.c	4
openssl/providers/implementations/rands/crngt.c	2
openssl/crypto/evp/digest.c	18
openssl/crypto/evp/evp_fetch.c	16
openssl/crypto/core_namemap.c	22
openssl/crypto/engine/eng_fat.c	5
openssl/crypto/engine/eng_table.c	8
openssl/crypto/engine/tb_digest.c	7
openssl/crypto/engine/tb_rsa.c	4
openssl/crypto/engine/tb_dsa.c	4
openssl/crypto/engine/tb_dh.c	4
openssl/crypto/engine/tb_eckey.c	4
openssl/include/crypto/asn1.h	3
openssl/crypto/core_fetch.c	3
openssl/crypto/core_algorithm.c	4
openssl/include/openssl/core_dispatch.h	79
openssl/crypto/encode_decode/decoder_pkey.c	27
openssl/crypto/async/async_wait.c	3
openssl/crypto/async/arch/async_posix.h	1
openssl/crypto/rsa/rsa_ossl.c	1
openssl/crypto/dsa/dsa_ossl.c	1
openssl/crypto/ec/ec_kmeth.c	1
openssl/crypto/dh/dh_key.c	1
openssl/crypto/rand/rand_meth.c	1
openssl/crypto/sha/sha_local.h	1
openssl/include/crypto/md32_common.h	2
openssl/crypto/engine/eng_pkey.c	1
openssl/crypto/bio/bss_file.c	2
openssl/crypto/o_fopen.c	1
openssl/crypto/pem/pem_pkey.c	5
openssl/crypto/bio/bf_readbuff.c	1
openssl/crypto/pem/pem_lib.c	15
openssl/crypto/evp/evp_key.c	3
openssl/crypto/ui/ui_lib.c	27
openssl/crypto/ui/ui_openssl.c	1
openssl/crypto/ui/ui_null.c	1
openssl/include/openssl/ui.h	2
openssl/crypto/err/err_prn.c	1
openssl/crypto/passphrase.c	9
openssl/crypto/encode_decode/decoder_meth.c	21
openssl/crypto/encode_decode/decoder_lib.c	27
openssl/crypto/evp/keymgmt_meth.c	19
openssl/crypto/provider.c	2
openssl/crypto/property/property_query.c	3
openssl/crypto/property/property_string.c	17
openssl/crypto/property/property_parse.c	25
openssl/crypto/encode_decode/encoder_local.h	6
openssl/crypto/evp/keymgmt_lib.c	13
openssl/crypto/evp/p_lib.c	19
openssl/include/crypto/evp.h	8
openssl/include/openssl/x509.h	1
openssl/crypto/x509/x_attrib.c	2
openssl/include/openssl/asn1t.h	2
openssl/crypto/asn1/tasn_utl.c	9
openssl/crypto/asn1/a_int.c	8
openssl/crypto/bio/bss_mem.c	3
openssl/crypto/bio/ossl_core_bio.c	3
openssl/crypto/ui/ui_util.c	8
openssl/crypto/evp/encode.c	7
openssl/crypto/evp/m_sigver.c	7
openssl/crypto/evp/signature.c	9
openssl/crypto/evp/exchange.c	2
openssl/crypto/evp/kem.c	2
openssl/crypto/evp/asymcipher.c	2
openssl/crypto/evp/ctrl_params_translate.c	10
openssl/crypto/params_from_text.c	3
openssl/crypto/bn/bn_conv.c	4
openssl/crypto/asn1/p8_pkey.c	4
openssl/crypto/buffer/buffer.c	2
openssl/crypto/asn1/tasn_new.c	9
openssl/crypto/asn1/a_bitstr.c	1
openssl/crypto/evp/evp_pkey.c	1
openssl/crypto/asn1/x_sig.c	3
openssl/crypto/pkcs12/p12_p8d.c	2
openssl/crypto/pkcs12/p12_decr.c	2
openssl/crypto/evp/evp_pbe.c	6
openssl/crypto/evp/evp_local.h	4
openssl/crypto/asn1/d2i_pr.c	1
openssl/crypto/x509/x_pubkey.c	7
openssl/crypto/engine/eng_cnf.c	5
openssl/crypto/engine/eng_all.c	1
openssl/crypto/engine/eng_ctrl.c	7
openssl/crypto/evp/evp_cnf.c	2
openssl/crypto/conf/conf_ssl.c	3
openssl/crypto/encode_decode/encoder_meth.c	3
openssl/crypto/store/store_meth.c	3
openssl/crypto/evp/e_des3.c	11
openssl/crypto/evp/e_xcbc_d.c	1
openssl/crypto/evp/e_rc4.c	2
openssl/crypto/evp/e_rc4_hmac_md5.c	1
openssl/crypto/evp/e_idea.c	4
openssl/crypto/evp/e_seed.c	4
openssl/crypto/evp/e_sm4.c	5
openssl/crypto/evp/e_rc2.c	6
openssl/crypto/evp/e_bf.c	4
openssl/crypto/evp/e_cast.c	4
openssl/crypto/evp/e_rc5.c	4
openssl/crypto/evp/e_aes.c	38
openssl/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl/crypto/evp/e_aria.c	27
openssl/crypto/evp/e_camellia.c	21
openssl/crypto/evp/e_chacha20_poly1305.c	2
openssl/crypto/err/err_all.c	1
openssl/crypto/bn/bn_err.c	1
openssl/crypto/rsa/rsa_err.c	1
openssl/crypto/dh/dh_err.c	1
openssl/crypto/evp/evp_err.c	1
openssl/crypto/buffer/buf_err.c	1
openssl/crypto/objects/obj_err.c	1
openssl/crypto/pem/pem_err.c	1
openssl/crypto/dsa/dsa_err.c	1
openssl/crypto/x509/x509_err.c	1
openssl/crypto/asn1/asn1_err.c	1
openssl/crypto/conf/conf_err.c	1
openssl/crypto/cpt_err.c	1
openssl/crypto/comp/comp_err.c	1
openssl/crypto/ec/ec_err.c	1
openssl/crypto/bio/bio_err.c	1
openssl/crypto/pkcs7/pkcs7err.c	1
openssl/crypto/x509/v3err.c	1
openssl/crypto/pkcs12/pk12err.c	1
openssl/crypto/rand/rand_err.c	1
openssl/crypto/dso/dso_err.c	1
openssl/crypto/ts/ts_err.c	1
openssl/crypto/engine/eng_err.c	1
openssl/crypto/http/http_err.c	1
openssl/crypto/ocsp/ocsp_err.c	1
openssl/crypto/ui/ui_err.c	1
openssl/crypto/cms/cms_err.c	1
openssl/crypto/crmf/crmf_err.c	1
openssl/crypto/cmp/cmp_err.c	1
openssl/crypto/ct/ct_err.c	1
openssl/crypto/ess/ess_err.c	1
openssl/crypto/async/async_err.c	1
openssl/crypto/store/store_err.c	1
openssl/crypto/property/property_err.c	1
openssl/providers/common/provider_err.c	1
openssl/crypto/property/defn_cache.c	5
openssl/crypto/bio/bss_core.c	2
openssl/providers/implementations/rands/drbg.c	2
openssl/crypto/self_test_core.c	2
openssl/crypto/thread/internal.c	2
openssl/crypto/thread/arch/thread_posix.c	4
openssl/crypto/evp/evp_rand.c	3
openssl/crypto/store/store_init.c	1
openssl/crypto/store/store_register.c	1
openssl/crypto/store/store_local.h	1
openssl/crypto/bio/bio_sock.c	1
openssl/crypto/objects/obj_xref.c	2
openssl/crypto/objects/obj_xref.h	2
openssl/crypto/cmp/cmp_util.c	1
openssl/crypto/trace.c	2
openssl/crypto/cpuid.c	4
openssl/crypto/bio/bf_prefix.c	1
openssl/crypto/bio/bio_dump.c	4

Fuzzer: asn1

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3832	48.9%
gold	[1:9]	1154	14.7%
yellow	[10:29]	142	1.81%
greenyellow	[30:49]	49	0.62%
lawngreen	50+	2645	33.8%
All colors	7822	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
20741	30171	13 : View List ['DSO_free', 'DSO_merge', 'DSO_convert_filename', 'DSO_new', 'ossl_safe_getenv', 'CRYPTO_THREAD_read_lock', 'DSO_bind_func', 'get_provider_store', 'CRYPTO_THREAD_unlock', 'DSO_load', 'CRYPTO_strdup', 'CRYPTO_free', 'DSO_ctrl']	24200	86971	provider_init	call site: 01588	/src/openssl/crypto/provider_core.c:886
11848	11848	2 : View List ['sk_INFOPAIR_new_null', 'ossl_provider_info_add_parameter']	11848	21247	ossl_provider_new	call site: 04304	/src/openssl/crypto/provider_core.c:558
10374	13837	5 : View List ['ENGINE_get_digest', 'ENGINE_finish', 'EVP_PKEY_CTX_ctrl', 'ENGINE_init', 'CRYPTO_zalloc']	10374	61260	evp_md_init_internal	call site: 03573	/src/openssl/crypto/evp/digest.c:226
9914	9914	2 : View List ['ec_GF2m_simple_oct2point', 'ec_GFp_simple_oct2point']	9914	9914	EC_POINT_oct2point	call site: 06496	/src/openssl111/crypto/ec/ec_oct.c:113
9386	9386	2 : View List ['conf_diagnostics', 'CONF_modules_load']	9386	16308	CONF_modules_load_file_ex	call site: 00398	/src/openssl/crypto/conf/conf_mod.c:206
8805	8805	2 : View List ['ec_GF2m_simple_set_compressed_coordinates', 'ec_GFp_simple_set_compressed_coordinates']	8805	8805	EC_POINT_set_compressed_coordinates	call site: 06509	/src/openssl111/crypto/ec/ec_oct.c:32
7508	7508	2 : View List ['EVP_DigestVerifyInit', 'EVP_DigestSignInit']	7508	25282	evp_md_init_internal	call site: 02987	/src/openssl/crypto/evp/digest.c:166
7452	7452	1 : View List ['key_to_epki_der_priv_bio']	7452	7452	key_to_pki_der_priv_bio	call site: 00000	/src/openssl/providers/implementations/encode_decode/encode_key2any.c:253
7060	34913	26 : View List ['bn_get_top', 'ecp_nistz256_gather_w7', 'is_zero', 'is_one', 'ecp_nistz256_windowed_mul', 'ecp_nistz256_set_from_affine', 'bn_set_words', 'EC_POINT_new', 'BN_CTX_get', 'BN_nnmod', 'CRYPTO_free', 'EC_POINT_free', 'ecp_nistz256_is_affine_G', 'bn_get_words', 'ecp_nistz256_point_add', 'ecp_nistz256_neg', 'EC_GROUP_get0_generator', 'BN_is_negative', 'CRYPTO_malloc', '_booth_recode_w7', 'copy_conditional.16411', 'ecp_nistz256_point_add_affine', 'EC_POINT_cmp', 'BN_num_bits', 'BN_CTX_end', 'BN_CTX_start']	20880	48733	ecp_nistz256_points_mul	call site: 00000	/src/openssl111/crypto/ec/ecp_nistz256.c:971
6400	9965	2 : View List ['ossl_x509_algor_mgf1_decode', 'RSA_PSS_PARAMS_free']	6400	9965	ossl_rsa_pss_decode	call site: 00000	/src/openssl/crypto/rsa/rsa_backend.c:453
6020	6020	1 : View List ['ossl_DER_w_precompiled']	6020	6020	DER_w_MaskGenAlgorithm	call site: 00000	/src/openssl/providers/common/der/der_rsa_key.c:269
5960	5960	1 : View List ['ossl_dh_key2buf']	5960	18059	dh_get_params	call site: 00000	/src/openssl/providers/implementations/keymgmt/dh_kmgmt.c:328

Runtime coverage analysis

Covered functions

3081

Functions that are reachable but not covered

766

Reachable functions

2465

Percentage of reachable functions covered

68.92%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl/fuzz/driver.c	1
openssl/fuzz/asn1.c	1
openssl/crypto/asn1/tasn_dec.c	14
openssl/crypto/err/err_blocks.c	4
openssl/crypto/err/err.c	30
openssl/crypto/init.c	41
openssl/crypto/err/err_local.h	6
openssl/crypto/mem.c	6
openssl/crypto/threads_pthread.c	14
openssl/crypto/err/err_save.c	1
openssl/crypto/initthread.c	21
openssl/crypto/stack/stack.c	19
openssl/crypto/comp/c_zlib.c	2
openssl/crypto/comp/c_brotli.c	1
openssl/crypto/comp/c_zstd.c	1
openssl/crypto/async/async.c	6
openssl/crypto/async/arch/async_posix.c	2
openssl/crypto/rand/rand_lib.c	20
openssl/providers/implementations/rands/seeding/rand_unix.c	4
openssl/crypto/engine/eng_init.c	4
openssl/crypto/cryptlib.c	2
openssl/crypto/engine/eng_lib.c	21
openssl/include/internal/refcount.h	4
openssl/crypto/engine/tb_pkmeth.c	7
openssl/crypto/evp/pmeth_lib.c	31
openssl/crypto/engine/tb_asnmth.c	8
openssl/crypto/asn1/ameth_lib.c	9
openssl/crypto/engine/eng_list.c	10
openssl/crypto/ex_data.c	12
openssl/crypto/context.c	16
openssl/crypto/property/property.c	29
openssl/crypto/sparse_array.c	1
openssl/crypto/provider_conf.c	14
openssl/crypto/evp/c_allc.c	1
openssl/crypto/evp/e_des.c	6
openssl/crypto/evp/names.c	9
openssl/crypto/objects/obj_dat.c	30
openssl/crypto/evp/c_alld.c	1
openssl/crypto/evp/legacy_md4.c	1
openssl/crypto/objects/o_names.c	12
openssl/crypto/objects/obj_local.h	18
openssl/crypto/lhash/lhash.c	13
openssl/crypto/evp/legacy_md5.c	1
openssl/crypto/evp/legacy_md5_sha1.c	1
openssl/crypto/evp/legacy_sha.c	13
openssl/crypto/evp/legacy_mdc2.c	1
openssl/crypto/evp/legacy_ripemd.c	1
openssl/crypto/evp/legacy_wp.c	1
openssl/crypto/sm3/legacy_sm3.c	1
openssl/crypto/evp/legacy_blake2.c	2
openssl/crypto/conf/conf_sap.c	2
openssl/crypto/conf/conf_mod.c	33
openssl/crypto/err/err_mark.c	3
openssl/crypto/getenv.c	1
openssl/crypto/o_str.c	14
openssl/crypto/x509/x509_def.c	1
openssl/crypto/bio/bio_print.c	11
openssl/include/internal/common.h	1
openssl/crypto/ctype.c	4
openssl/crypto/conf/conf_lib.c	10
openssl/crypto/conf/conf_def.c	1
openssl/include/openssl/err.h	4
openssl/crypto/conf/conf_api.c	3
openssl/include/openssl/conf.h	3
openssl/crypto/conf/conf_mall.c	1
openssl/crypto/asn1/asn_moid.c	3
openssl/crypto/bsearch.c	1
openssl/crypto/asn1/a_object.c	7
openssl/crypto/bn/bn_lib.c	46
openssl/crypto/bn/bn_local.h	1
openssl/crypto/mem_sec.c	18
openssl/crypto/bn/bn_word.c	4
openssl/crypto/bn/asm/x86_64-gcc.c	10
openssl/crypto/bn/bn_shift.c	6
openssl/crypto/asn1/asn1_lib.c	14
openssl/crypto/objects/obj_lib.c	1
openssl/crypto/asn1/asn_mstbl.c	3
openssl/crypto/x509/v3_utl.c	10
openssl/crypto/asn1/asn1_gen.c	3
openssl/crypto/asn1/a_strnid.c	6
openssl/include/openssl/asn1.h	6
openssl/crypto/engine/eng_openssl.c	20
openssl/include/internal/cryptlib.h	7
openssl/include/openssl/crypto.h	2
openssl/crypto/evp/evp_lib.c	38
openssl/crypto/provider_core.c	49
openssl/crypto/engine/eng_rdrand.c	4
openssl/crypto/engine/tb_rand.c	6
openssl/crypto/engine/eng_local.h	14
openssl/crypto/engine/eng_dyn.c	12
openssl/crypto/dso/dso_lib.c	9
openssl/include/openssl/safestack.h	4
openssl/crypto/dso/dso_dlfcn.c	1
openssl/engines/e_padlock.c	22
openssl/crypto/engine/tb_cipher.c	7
openssl/crypto/evp/cmeth_lib.c	8
openssl/crypto/evp/evp_enc.c	26
openssl/crypto/params.c	49
openssl/crypto/evp/evp_utils.c	5
openssl/crypto/asn1/evp_asn1.c	1
openssl/crypto/asn1/tasn_typ.c	19
openssl/crypto/asn1/a_octet.c	1
openssl/crypto/asn1/a_type.c	1
openssl/crypto/asn1/tasn_fre.c	5
openssl/engines/e_afalg.c	28
openssl/engines/e_afalg_err.c	3
openssl/crypto/provider_local.h	4
openssl/crypto/provider_child.c	4
openssl/providers/implementations/rands/crngt.c	2
openssl/crypto/evp/digest.c	18
openssl/crypto/evp/evp_fetch.c	16
openssl/crypto/core_namemap.c	22
openssl/crypto/engine/eng_fat.c	5
openssl/crypto/engine/eng_table.c	8
openssl/crypto/engine/tb_digest.c	7
openssl/crypto/engine/tb_rsa.c	4
openssl/crypto/engine/tb_dsa.c	4
openssl/crypto/engine/tb_dh.c	6
openssl/crypto/engine/tb_eckey.c	6
openssl/include/crypto/asn1.h	3
openssl/crypto/core_fetch.c	3
openssl/crypto/core_algorithm.c	4
openssl/include/openssl/core_dispatch.h	91
openssl/crypto/encode_decode/decoder_pkey.c	27
openssl/crypto/async/async_wait.c	3
openssl/crypto/async/arch/async_posix.h	1
openssl/crypto/rsa/rsa_ossl.c	1
openssl/crypto/dsa/dsa_ossl.c	1
openssl/crypto/ec/ec_kmeth.c	3
openssl/crypto/dh/dh_key.c	1
openssl/crypto/rand/rand_meth.c	1
openssl/crypto/sha/sha_local.h	1
openssl/include/crypto/md32_common.h	2
openssl/crypto/engine/eng_pkey.c	1
openssl/crypto/bio/bss_file.c	2
openssl/crypto/o_fopen.c	1
openssl/crypto/bio/bio_lib.c	17
openssl/crypto/pem/pem_pkey.c	5
openssl/crypto/bio/bf_readbuff.c	1
openssl/crypto/pem/pem_lib.c	15
openssl/crypto/evp/evp_key.c	3
openssl/crypto/ui/ui_lib.c	27
openssl/crypto/ui/ui_openssl.c	1
openssl/crypto/ui/ui_null.c	1
openssl/include/openssl/ui.h	2
openssl/crypto/err/err_prn.c	1
openssl/crypto/passphrase.c	10
openssl/crypto/encode_decode/decoder_meth.c	21
openssl/crypto/encode_decode/decoder_lib.c	28
openssl/crypto/evp/keymgmt_meth.c	19
openssl/crypto/provider.c	2
openssl/crypto/property/property_query.c	3
openssl/crypto/property/property_string.c	17
openssl/crypto/property/property_parse.c	25
openssl/crypto/encode_decode/encoder_local.h	11
openssl/crypto/evp/keymgmt_lib.c	13
openssl/crypto/evp/p_lib.c	24
openssl/include/crypto/evp.h	8
openssl/include/openssl/x509.h	4
openssl/crypto/x509/x_attrib.c	2
openssl/include/openssl/asn1t.h	2
openssl/crypto/asn1/tasn_utl.c	13
openssl/crypto/asn1/a_int.c	12
openssl/crypto/bio/bss_mem.c	3
openssl/crypto/bio/ossl_core_bio.c	3
openssl/crypto/ui/ui_util.c	8
openssl/crypto/evp/encode.c	7
openssl/crypto/evp/m_sigver.c	7
openssl/crypto/evp/signature.c	9
openssl/crypto/evp/exchange.c	2
openssl/crypto/evp/kem.c	2
openssl/crypto/evp/asymcipher.c	2
openssl/crypto/evp/ctrl_params_translate.c	10
openssl/crypto/params_from_text.c	3
openssl/crypto/bn/bn_conv.c	5
openssl/crypto/asn1/p8_pkey.c	6
openssl/crypto/evp/evp_pkey.c	2
openssl/crypto/asn1/x_sig.c	3
openssl/crypto/pkcs12/p12_p8d.c	2
openssl/crypto/pkcs12/p12_decr.c	2
openssl/crypto/evp/evp_pbe.c	6
openssl/crypto/evp/evp_local.h	4
openssl/crypto/asn1/d2i_pr.c	5
openssl/crypto/x509/x_pubkey.c	8
openssl/crypto/engine/eng_cnf.c	5
openssl/crypto/engine/eng_all.c	1
openssl/crypto/engine/eng_ctrl.c	7
openssl/crypto/evp/evp_cnf.c	2
openssl/crypto/conf/conf_ssl.c	3
openssl/crypto/encode_decode/encoder_meth.c	18
openssl/crypto/store/store_meth.c	3
openssl/crypto/evp/e_des3.c	11
openssl/crypto/evp/e_xcbc_d.c	1
openssl/crypto/evp/e_rc4.c	2
openssl/crypto/evp/e_rc4_hmac_md5.c	1
openssl/crypto/evp/e_idea.c	4
openssl/crypto/evp/e_seed.c	4
openssl/crypto/evp/e_sm4.c	5
openssl/crypto/evp/e_rc2.c	6
openssl/crypto/evp/e_bf.c	4
openssl/crypto/evp/e_cast.c	4
openssl/crypto/evp/e_rc5.c	4
openssl/crypto/evp/e_aes.c	38
openssl/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl/crypto/evp/e_aria.c	27
openssl/crypto/evp/e_camellia.c	21
openssl/crypto/evp/e_chacha20_poly1305.c	2
openssl/crypto/err/err_all.c	1
openssl/crypto/bn/bn_err.c	1
openssl/crypto/rsa/rsa_err.c	1
openssl/crypto/dh/dh_err.c	1
openssl/crypto/evp/evp_err.c	1
openssl/crypto/buffer/buf_err.c	1
openssl/crypto/objects/obj_err.c	1
openssl/crypto/pem/pem_err.c	1
openssl/crypto/dsa/dsa_err.c	1
openssl/crypto/x509/x509_err.c	1
openssl/crypto/asn1/asn1_err.c	1
openssl/crypto/conf/conf_err.c	1
openssl/crypto/cpt_err.c	1
openssl/crypto/comp/comp_err.c	1
openssl/crypto/ec/ec_err.c	1
openssl/crypto/bio/bio_err.c	1
openssl/crypto/pkcs7/pkcs7err.c	1
openssl/crypto/x509/v3err.c	1
openssl/crypto/pkcs12/pk12err.c	1
openssl/crypto/rand/rand_err.c	1
openssl/crypto/dso/dso_err.c	1
openssl/crypto/ts/ts_err.c	1
openssl/crypto/engine/eng_err.c	1
openssl/crypto/http/http_err.c	1
openssl/crypto/ocsp/ocsp_err.c	1
openssl/crypto/ui/ui_err.c	1
openssl/crypto/cms/cms_err.c	1
openssl/crypto/crmf/crmf_err.c	1
openssl/crypto/cmp/cmp_err.c	1
openssl/crypto/ct/ct_err.c	1
openssl/crypto/ess/ess_err.c	1
openssl/crypto/async/async_err.c	1
openssl/crypto/store/store_err.c	1
openssl/crypto/property/property_err.c	1
openssl/providers/common/provider_err.c	1
openssl/crypto/property/defn_cache.c	5
openssl/crypto/bio/bss_core.c	2
openssl/providers/implementations/rands/drbg.c	2
openssl/crypto/self_test_core.c	2
openssl/crypto/thread/internal.c	2
openssl/crypto/thread/arch/thread_posix.c	4
openssl/crypto/evp/evp_rand.c	20
openssl/crypto/store/store_init.c	1
openssl/crypto/store/store_register.c	1
openssl/crypto/store/store_local.h	1
openssl/crypto/bio/bio_sock.c	1
openssl/crypto/objects/obj_xref.c	2
openssl/crypto/objects/obj_xref.h	2
openssl/crypto/cmp/cmp_util.c	1
openssl/crypto/trace.c	2
openssl/crypto/cpuid.c	4
openssl/crypto/buffer/buffer.c	5
openssl/crypto/asn1/tasn_new.c	9
openssl/crypto/asn1/a_bitstr.c	3
openssl/crypto/bio/bss_null.c	1
openssl/crypto/asn1/tasn_prn.c	9
openssl/crypto/asn1/asn1_local.h	3
openssl/crypto/asn1/asn1_parse.c	4
openssl/crypto/asn1/a_utctm.c	1
openssl/crypto/asn1/a_time.c	6
openssl/crypto/o_time.c	4
openssl/crypto/asn1/a_gentm.c	1
openssl/crypto/bio/bio_dump.c	4
openssl/crypto/bio/bf_prefix.c	1
openssl/crypto/asn1/a_strex.c	6
openssl/crypto/asn1/tasn_enc.c	8
openssl/crypto/asn1/a_utf8.c	2
openssl/include/internal/unicode.h	1
openssl/crypto/ts/ts_asn1.c	12
openssl/crypto/ts/ts_req_print.c	1
openssl/crypto/ts/ts_req_utils.c	2
openssl/crypto/ts/ts_lib.c	5
openssl/crypto/x509/x509_v3.c	5
openssl/crypto/x509/v3_prn.c	3
openssl/crypto/x509/v3_lib.c	4
openssl/include/openssl/x509v3.h	2
openssl/crypto/asn1/a_print.c	1
openssl/crypto/ts/ts_rsp_print.c	5
openssl/crypto/x509/v3_san.c	1
openssl/crypto/x509/x509_obj.c	1
openssl/crypto/ess/ess_asn1.c	10
openssl/crypto/dh/dh_asn1.c	5
openssl/crypto/dh/dh_lib.c	5
openssl/crypto/ffc/ffc_params.c	6
openssl/crypto/dh/dh_group_params.c	1
openssl/crypto/ffc/ffc_dh.c	4
openssl/crypto/dsa/dsa_sign.c	3
openssl/crypto/asn1_dsa.c	3
openssl/include/internal/packet.h	14
openssl/crypto/dsa/dsa_asn1.c	6
openssl/crypto/dsa/dsa_lib.c	1
openssl/crypto/rsa/rsa_asn1.c	4
openssl/crypto/rsa/rsa_lib.c	1
openssl/crypto/rsa/rsa_local.h	1
openssl/crypto/rsa/rsa_mp.c	2
openssl/crypto/bn/bn_blind.c	1
openssl/crypto/ec/ec_asn1.c	14
openssl/crypto/ec/ec_curve.c	6
openssl/crypto/ec/ec_lib.c	36
openssl/crypto/bn/bn_ctx.c	15
openssl/crypto/ec/ec_cvt.c	2
openssl/crypto/ec/ecp_mont.c	1
openssl/crypto/ec/ecp_nistz256.c	2
openssl/crypto/ec/ecp_nistp224.c	2
openssl/crypto/ec/ecp_nistp256.c	2
openssl/crypto/ec/ecp_nistp384.c	2
openssl/crypto/ec/ecp_nistp521.c	2
openssl/crypto/ec/ec_mult.c	2
openssl/crypto/bn/bn_mont.c	11
openssl/crypto/ec/ec2_smpl.c	1
openssl/crypto/ec/ec_local.h	1
openssl/crypto/bn/bn_add.c	4
openssl/crypto/bn/bn_div.c	3
openssl/crypto/bn/bn_gcd.c	3
openssl/crypto/bn/bn_mod.c	7
openssl/crypto/bn/bn_mul.c	6
openssl/crypto/ec/ec_oct.c	4
openssl/crypto/ec/ecp_oct.c	3
openssl/crypto/bn/bn_sqr.c	4
openssl/crypto/bn/bn_sqrt.c	1
openssl/crypto/bn/bn_exp.c	8
openssl/crypto/bn/rsaz_exp.c	2
openssl/crypto/bn/rsaz_exp.h	2
openssl/include/internal/constant_time.h	6
openssl/crypto/bn/bn_recp.c	6
openssl/crypto/bn/bn_rand.c	2
openssl/crypto/bn/bn_kron.c	1
openssl/crypto/ec/ec2_oct.c	3
openssl/crypto/bn/bn_gf2m.c	7
openssl/crypto/ec/eck_prn.c	2
openssl/crypto/evp/ec_support.c	1
openssl/crypto/asn1/t_pkey.c	2
openssl/crypto/bn/bn_intern.c	1
openssl/crypto/ec/ec_key.c	11
openssl/crypto/ec/ec_ameth.c	3
openssl/crypto/encode_decode/encoder_pkey.c	7
openssl/crypto/encode_decode/encoder_lib.c	19
openssl/crypto/asn1/i2d_evp.c	2
openssl/ssl/ssl_asn1.c	6
openssl/ssl/ssl_sess.c	3
openssl/ssl/ssl_init.c	8
openssl/ssl/ssl_ciph.c	10
openssl/include/openssl/ssl.h	3
openssl/crypto/comp/comp_lib.c	2
openssl/ssl/s3_lib.c	3
openssl/ssl/ssl_err.c	1
openssl/include/internal/time.h	9
openssl/crypto/time.c	1
openssl/ssl/ssl_lib.c	8
openssl/crypto/x509/x_x509.c	2
openssl/crypto/x509/t_x509.c	1
openssl/ssl/ssl_txt.c	1
openssl/ssl/tls_depr.c	1
openssl/crypto/x509/x509_txt.c	1

Fuzzer: client_30

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3304	53.6%
gold	[1:9]	993	16.1%
yellow	[10:29]	121	1.96%
greenyellow	[30:49]	52	0.84%
lawngreen	50+	1687	27.3%
All colors	6157	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
17315	17315	1 : View List ['EVP_get_cipherbyname']	17315	17315	ssl_cipher_get_evp	call site: 00000	/src/openssl111/ssl/ssl_ciph.c:556
11909	17885	10 : View List ['ossl_assert_int.33564', 'evp_keymgmt_util_clear_operation_cache', 'evp_keymgmt_util_cache_keydata', 'CRYPTO_THREAD_read_lock', 'evp_keymgmt_util_find_operation_cache', 'evp_keymgmt_freedata', 'match_type', 'CRYPTO_THREAD_unlock', 'evp_keymgmt_util_export', 'CRYPTO_THREAD_write_lock']	11909	17885	evp_keymgmt_util_export_to_provider	call site: 02886	/src/openssl/crypto/evp/keymgmt_lib.c:117
10061	10067	4 : View List ['EC_GROUP_check_named_curve', 'EC_GROUP_check', 'EC_KEY_get0_group', 'EC_KEY_get_flags']	22428	35023	ec_validate	call site: 00000	/src/openssl/providers/implementations/keymgmt/ec_kmgmt.c:952
9914	9914	2 : View List ['ec_GF2m_simple_oct2point', 'ec_GFp_simple_oct2point']	9914	9914	EC_POINT_oct2point	call site: 00000	/src/openssl111/crypto/ec/ec_oct.c:113
9386	9386	2 : View List ['conf_diagnostics', 'CONF_modules_load']	9386	16308	CONF_modules_load_file_ex	call site: 03837	/src/openssl/crypto/conf/conf_mod.c:206
8805	8805	2 : View List ['ec_GF2m_simple_set_compressed_coordinates', 'ec_GFp_simple_set_compressed_coordinates']	8805	8805	EC_POINT_set_compressed_coordinates	call site: 00000	/src/openssl111/crypto/ec/ec_oct.c:32
6423	6423	1 : View List ['ossl_ec_key_pairwise_check']	6423	6529	ec_validate	call site: 00000	/src/openssl/providers/implementations/keymgmt/ec_kmgmt.c:972
6387	6387	1 : View List ['ossl_dh_check_pairwise']	6387	6387	dh_validate	call site: 00000	/src/openssl/providers/implementations/keymgmt/dh_kmgmt.c:438
6007	6007	1 : View List ['ossl_chacha20_einit']	6007	6007	chacha20_poly1305_initkey	call site: 00000	/src/openssl/providers/implementations/ciphers/cipher_chacha20_poly1305_hw.c:69
6007	6007	1 : View List ['ossl_chacha20_einit']	6007	6007	chacha20_poly1305_initiv	call site: 00000	/src/openssl/providers/implementations/ciphers/cipher_chacha20_poly1305_hw.c:92
5975	5975	1 : View List ['dh_validate_private']	12362	12362	dh_validate	call site: 00000	/src/openssl/providers/implementations/keymgmt/dh_kmgmt.c:435
5952	23726	4 : View List ['ERR_set_error', 'ERR_set_debug', 'ERR_new', 'OSSL_PARAM_set_BN']	5952	23726	ossl_param_build_set_bn_pad	call site: 00000	/src/openssl/crypto/param_build_set.c:75

Runtime coverage analysis

Covered functions

3729

Functions that are reachable but not covered

846

Reachable functions

2251

Percentage of reachable functions covered

62.42%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl30/fuzz/driver.c	1
openssl30/fuzz/client.c	1
openssl30/ssl/methods.c	1
openssl30/ssl/ssl_lib.c	38
openssl30/crypto/err/err_blocks.c	2
openssl30/crypto/err/err.c	31
openssl30/crypto/init.c	40
openssl30/crypto/err/err_local.h	5
openssl30/crypto/mem.c	7
openssl30/crypto/threads_pthread.c	13
openssl30/crypto/cpuid.c	4
openssl30/crypto/ctype.c	3
openssl30/crypto/initthread.c	21
openssl30/crypto/stack/stack.c	21
openssl30/crypto/comp/c_zlib.c	2
openssl30/crypto/async/async.c	17
openssl30/crypto/rand/rand_lib.c	19
openssl30/providers/implementations/rands/seeding/rand_unix.c	4
openssl30/crypto/engine/eng_init.c	4
openssl30/crypto/cryptlib.c	2
openssl30/crypto/engine/eng_lib.c	21
openssl30/include/internal/refcount.h	2
openssl30/crypto/engine/tb_pkmeth.c	7
openssl30/crypto/evp/pmeth_lib.c	31
openssl30/crypto/engine/tb_asnmth.c	9
openssl30/crypto/asn1/ameth_lib.c	9
openssl30/crypto/engine/eng_list.c	10
openssl30/crypto/ex_data.c	14
openssl30/crypto/context.c	19
openssl30/include/internal/cryptlib.h	8
openssl30/include/openssl/crypto.h	2
openssl30/crypto/property/property_parse.c	25
openssl30/crypto/property/property_string.c	12
openssl30/crypto/lhash/lhash.c	12
openssl30/crypto/evp/evp_rand.c	16
openssl30/crypto/provider_core.c	44
openssl30/crypto/err/err_all.c	1
openssl30/include/openssl/err.h	4
openssl30/crypto/bn/bn_err.c	1
openssl30/crypto/rsa/rsa_err.c	1
openssl30/crypto/dh/dh_err.c	1
openssl30/crypto/evp/evp_err.c	1
openssl30/crypto/buffer/buf_err.c	1
openssl30/crypto/objects/obj_err.c	1
openssl30/crypto/pem/pem_err.c	1
openssl30/crypto/dsa/dsa_err.c	1
openssl30/crypto/x509/x509_err.c	1
openssl30/crypto/asn1/asn1_err.c	1
openssl30/crypto/conf/conf_err.c	1
openssl30/crypto/cpt_err.c	1
openssl30/crypto/comp/comp_err.c	1
openssl30/crypto/ec/ec_err.c	1
openssl30/crypto/bio/bio_err.c	1
openssl30/crypto/pkcs7/pkcs7err.c	1
openssl30/crypto/x509/v3err.c	1
openssl30/crypto/pkcs12/pk12err.c	1
openssl30/crypto/rand/rand_err.c	1
openssl30/crypto/dso/dso_err.c	1
openssl30/crypto/ts/ts_err.c	1
openssl30/crypto/engine/eng_err.c	1
openssl30/crypto/http/http_err.c	1
openssl30/crypto/ocsp/ocsp_err.c	1
openssl30/crypto/ui/ui_err.c	1
openssl30/crypto/cms/cms_err.c	1
openssl30/crypto/crmf/crmf_err.c	1
openssl30/crypto/cmp/cmp_err.c	1
openssl30/crypto/ct/ct_err.c	1
openssl30/crypto/ess/ess_err.c	1
openssl30/crypto/async/async_err.c	1
openssl30/crypto/store/store_err.c	1
openssl30/crypto/property/property_err.c	1
openssl30/providers/common/provider_err.c	1
openssl30/crypto/evp/c_allc.c	1
openssl30/crypto/evp/e_des.c	6
openssl30/crypto/evp/names.c	9
openssl30/crypto/objects/obj_dat.c	23
openssl30/crypto/evp/c_alld.c	1
openssl30/crypto/evp/legacy_md4.c	1
openssl30/crypto/objects/obj_local.h	18
openssl30/crypto/objects/o_names.c	12
openssl30/crypto/conf/conf_sap.c	2
openssl30/crypto/conf/conf_mod.c	33
openssl30/crypto/engine/eng_openssl.c	20
openssl30/crypto/evp/evp_lib.c	38
openssl30/crypto/dso/dso_lib.c	9
openssl30/crypto/provider_local.h	4
openssl30/crypto/provider_child.c	2
openssl30/crypto/evp/cmeth_lib.c	8
openssl30/crypto/evp/evp_enc.c	24
openssl30/crypto/rsa/rsa_ossl.c	1
openssl30/crypto/engine/tb_rsa.c	4
openssl30/crypto/dsa/dsa_ossl.c	1
openssl30/crypto/engine/tb_dsa.c	4
openssl30/crypto/ec/ec_kmeth.c	1
openssl30/crypto/engine/tb_eckey.c	4
openssl30/crypto/dh/dh_key.c	1
openssl30/crypto/engine/tb_dh.c	4
openssl30/crypto/rand/rand_meth.c	1
openssl30/crypto/engine/tb_rand.c	6
openssl30/crypto/engine/tb_cipher.c	7
openssl30/crypto/params.c	48
openssl30/crypto/evp/evp_utils.c	5
openssl30/crypto/engine/tb_digest.c	7
openssl30/crypto/evp/digest.c	17
openssl30/crypto/sha/sha_local.h	1
openssl30/include/crypto/md32_common.h	2
openssl30/crypto/engine/eng_pkey.c	1
openssl30/crypto/bio/bss_file.c	2
openssl30/crypto/o_fopen.c	1
openssl30/crypto/bio/bio_lib.c	18
openssl30/crypto/pem/pem_pkey.c	5
openssl30/crypto/bio/bf_readbuff.c	1
openssl30/crypto/pem/pem_lib.c	15
openssl30/crypto/evp/evp_key.c	3
openssl30/crypto/ui/ui_lib.c	27
openssl30/crypto/ui/ui_openssl.c	1
openssl30/crypto/ui/ui_null.c	1
openssl30/include/openssl/ui.h	2
openssl30/crypto/err/err_prn.c	1
openssl30/crypto/o_str.c	12
openssl30/crypto/bio/bio_print.c	11
openssl30/crypto/passphrase.c	9
openssl30/crypto/encode_decode/decoder_pkey.c	13
openssl30/crypto/encode_decode/decoder_meth.c	16
openssl30/crypto/encode_decode/decoder_lib.c	24
openssl30/crypto/evp/keymgmt_meth.c	21
openssl30/crypto/evp/evp_fetch.c	16
openssl30/crypto/core_namemap.c	19
openssl30/crypto/engine/eng_rdrand.c	4
openssl30/crypto/engine/eng_local.h	14
openssl30/crypto/engine/eng_dyn.c	12
openssl30/include/openssl/safestack.h	4
openssl30/crypto/dso/dso_dlfcn.c	1
openssl30/engines/e_padlock.c	22
openssl30/crypto/asn1/evp_asn1.c	1
openssl30/crypto/asn1/tasn_typ.c	11
openssl30/crypto/asn1/asn1_lib.c	12
openssl30/crypto/asn1/a_octet.c	1
openssl30/crypto/asn1/a_type.c	1
openssl30/crypto/asn1/tasn_fre.c	5
openssl30/crypto/asn1/a_object.c	6
openssl30/engines/e_afalg.c	27
openssl30/engines/e_afalg_err.c	3
openssl30/crypto/engine/eng_fat.c	5
openssl30/crypto/engine/eng_table.c	8
openssl30/crypto/async/async_wait.c	6
openssl30/crypto/async/arch/async_posix.h	1
openssl30/crypto/bsearch.c	1
openssl30/crypto/bn/bn_word.c	4
openssl30/crypto/bn/bn_lib.c	23
openssl30/crypto/bn/bn_local.h	1
openssl30/crypto/mem_sec.c	18
openssl30/crypto/bn/bn_shift.c	2
openssl30/crypto/bn/bn_conv.c	4
openssl30/include/internal/constant_time.h	4
openssl30/crypto/bn/asm/x86_64-gcc.c	2
openssl30/include/crypto/asn1.h	3
openssl30/crypto/property/property.c	25
openssl30/crypto/sparse_array.c	1
openssl30/crypto/core_fetch.c	3
openssl30/crypto/core_algorithm.c	4
openssl30/crypto/getenv.c	1
openssl30/include/openssl/core_dispatch.h	104
openssl30/crypto/provider.c	4
openssl30/crypto/property/property_query.c	3
openssl30/crypto/encode_decode/encoder_local.h	5
openssl30/crypto/evp/keymgmt_lib.c	14
openssl30/crypto/evp/p_lib.c	21
openssl30/include/crypto/evp.h	8
openssl30/include/openssl/x509.h	5
openssl30/crypto/x509/x_attrib.c	2
openssl30/include/openssl/asn1t.h	2
openssl30/crypto/asn1/tasn_utl.c	13
openssl30/crypto/asn1/a_int.c	10
openssl30/crypto/bio/bss_mem.c	3
openssl30/crypto/bio/ossl_core_bio.c	3
openssl30/crypto/ui/ui_util.c	8
openssl30/crypto/evp/encode.c	7
openssl30/crypto/evp/legacy_md5.c	1
openssl30/crypto/evp/m_sigver.c	7
openssl30/crypto/evp/signature.c	9
openssl30/crypto/evp/exchange.c	5
openssl30/crypto/evp/kem.c	2
openssl30/crypto/evp/asymcipher.c	2
openssl30/crypto/evp/ctrl_params_translate.c	10
openssl30/crypto/params_from_text.c	3
openssl30/crypto/asn1/p8_pkey.c	4
openssl30/crypto/asn1/tasn_dec.c	14
openssl30/crypto/buffer/buffer.c	4
openssl30/crypto/asn1/tasn_new.c	9
openssl30/crypto/asn1/a_bitstr.c	2
openssl30/crypto/evp/evp_pkey.c	1
openssl30/crypto/asn1/x_sig.c	3
openssl30/crypto/pkcs12/p12_p8d.c	2
openssl30/crypto/pkcs12/p12_decr.c	2
openssl30/crypto/evp/evp_pbe.c	6
openssl30/crypto/evp/evp_local.h	3
openssl30/crypto/asn1/d2i_pr.c	4
openssl30/crypto/x509/x_pubkey.c	7
openssl30/crypto/x509/x509_def.c	1
openssl30/crypto/conf/conf_lib.c	10
openssl30/crypto/conf/conf_def.c	1
openssl30/crypto/conf/conf_api.c	3
openssl30/include/openssl/conf.h	3
openssl30/crypto/conf/conf_mall.c	1
openssl30/crypto/asn1/asn_moid.c	3
openssl30/crypto/objects/obj_lib.c	1
openssl30/crypto/asn1/asn_mstbl.c	3
openssl30/crypto/x509/v3_utl.c	6
openssl30/crypto/asn1/asn1_gen.c	3
openssl30/crypto/asn1/a_strnid.c	6
openssl30/include/openssl/asn1.h	7
openssl30/crypto/engine/eng_cnf.c	5
openssl30/crypto/engine/eng_all.c	1
openssl30/crypto/engine/eng_ctrl.c	7
openssl30/crypto/evp/evp_cnf.c	2
openssl30/crypto/conf/conf_ssl.c	6
openssl30/crypto/provider_conf.c	10
openssl30/crypto/encode_decode/encoder_meth.c	3
openssl30/crypto/store/store_meth.c	3
openssl30/crypto/evp/legacy_md5_sha1.c	1
openssl30/crypto/evp/legacy_sha.c	13
openssl30/crypto/evp/legacy_mdc2.c	1
openssl30/crypto/evp/legacy_ripemd.c	1
openssl30/crypto/evp/legacy_wp.c	1
openssl30/crypto/sm3/legacy_sm3.c	1
openssl30/crypto/evp/legacy_blake2.c	2
openssl30/crypto/evp/e_des3.c	11
openssl30/crypto/evp/e_xcbc_d.c	1
openssl30/crypto/evp/e_rc4.c	2
openssl30/crypto/evp/e_rc4_hmac_md5.c	1
openssl30/crypto/evp/e_idea.c	4
openssl30/crypto/evp/e_seed.c	4
openssl30/crypto/evp/e_sm4.c	5
openssl30/crypto/evp/e_rc2.c	6
openssl30/crypto/evp/e_bf.c	4
openssl30/crypto/evp/e_cast.c	4
openssl30/crypto/evp/e_rc5.c	4
openssl30/crypto/evp/e_aes.c	38
openssl30/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl30/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl30/crypto/evp/e_aria.c	27
openssl30/crypto/evp/e_camellia.c	21
openssl30/crypto/evp/e_chacha20_poly1305.c	2
openssl30/crypto/store/store_init.c	1
openssl30/crypto/store/store_register.c	1
openssl30/crypto/store/store_local.h	1
openssl30/crypto/bio/bio_sock.c	1
openssl30/crypto/objects/obj_xref.c	2
openssl30/crypto/objects/obj_xref.h	2
openssl30/crypto/cmp/cmp_util.c	1
openssl30/crypto/trace.c	2
openssl30/ssl/ssl_init.c	8
openssl30/ssl/ssl_ciph.c	21
openssl30/include/openssl/ssl.h	5
openssl30/crypto/comp/comp_lib.c	3
openssl30/ssl/s3_lib.c	2
openssl30/ssl/ssl_err.c	1
openssl30/ssl/ssl_cert.c	13
openssl30/ssl/ssl_local.h	6
openssl30/crypto/x509/x509_lu.c	8
openssl30/include/openssl/x509_vfy.h	4
openssl30/crypto/x509/x509_cmp.c	6
openssl30/crypto/x509/x_name.c	3
openssl30/crypto/asn1/tasn_enc.c	8
openssl30/crypto/asn1/asn1_local.h	3
openssl30/crypto/x509/x509_vpm.c	10
openssl30/crypto/ct/ct_log.c	3
openssl30/include/openssl/ct.h	2
openssl30/ssl/tls_depr.c	3
openssl30/ssl/t1_lib.c	4
openssl30/ssl/tls_srp.c	2
openssl30/ssl/ssl_mcnf.c	2
openssl30/ssl/ssl_conf.c	13
openssl30/ssl/ssl_rsa.c	5
openssl30/crypto/x509/x_all.c	1
openssl30/crypto/asn1/a_d2i_fp.c	1
openssl30/ssl/ssl_sess.c	10
openssl30/crypto/x509/x_x509.c	2
openssl30/crypto/x509/x_crl.c	2
openssl30/ssl/statem/extensions_cust.c	4
openssl30/ssl/record/rec_layer_s3.c	6
openssl30/ssl/record/ssl3_record.c	2
openssl30/crypto/x509/x509_set.c	1
openssl30/ssl/statem/statem.c	4
openssl30/ssl/record/ssl3_buffer.c	3
openssl30/ssl/record/rec_layer_d1.c	1
openssl30/ssl/pqueue.c	2
openssl30/ssl/statem/statem_lib.c	1
openssl30/include/internal/dane.h	1
openssl30/crypto/x509/x_exten.c	2
openssl30/include/openssl/ocsp.h	1
openssl30/crypto/ocsp/ocsp_asn.c	2
openssl30/crypto/ct/ct_sct.c	2
openssl30/crypto/async/async_local.h	4
openssl30/crypto/async/arch/async_posix.c	3

Fuzzer: client

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3946	57.1%
gold	[1:9]	1127	16.3%
yellow	[10:29]	124	1.79%
greenyellow	[30:49]	53	0.76%
lawngreen	50+	1655	23.9%
All colors	6905	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
47407	47409	8 : View List ['sk_BIGNUM_const_push', 'RSA_get0_q', 'RSA_get0_iqmp', 'RSA_get_multi_prime_extra_count', 'sk_RSA_PRIME_INFO_value.14409', 'RSA_get0_p', 'RSA_get0_dmq1', 'RSA_get0_dmp1']	47407	47409	ossl_rsa_get0_all_params	call site: 00000	/src/openssl/crypto/rsa/rsa_lib.c:856
20741	30171	13 : View List ['DSO_free', 'DSO_merge', 'DSO_convert_filename', 'DSO_new', 'ossl_safe_getenv', 'CRYPTO_THREAD_read_lock', 'DSO_bind_func', 'get_provider_store', 'CRYPTO_THREAD_unlock', 'DSO_load', 'CRYPTO_strdup', 'CRYPTO_free', 'DSO_ctrl']	24200	86971	provider_init	call site: 01588	/src/openssl/crypto/provider_core.c:886
17315	17315	1 : View List ['EVP_get_cipherbyname']	17315	17315	ssl_cipher_get_evp	call site: 00000	/src/openssl111/ssl/ssl_ciph.c:556
13830	13830	3 : View List ['ENGINE_free', 'ENGINE_by_id', 'ENGINE_init']	13830	13830	load_common	call site: 00000	/src/openssl/providers/common/provider_util.c:70
12645	95733	22 : View List ['EC_GROUP_set_seed', 'BN_CTX_new_ex', 'EC_POINT_new', 'ec_group_explicit_to_named', 'OPENSSL_strcasecmp', 'EC_GROUP_get_degree', 'BN_CTX_free', 'EC_GROUP_set_generator', 'BN_CTX_get', 'EC_POINT_free', 'EC_GROUP_new_curve_GF2m', 'EC_POINT_oct2point', 'OSSL_PARAM_get_BN', 'BN_is_zero', 'BN_is_negative', 'EC_GROUP_set_point_conversion_form', 'BN_CTX_start', 'BN_num_bits', 'EC_GROUP_set_asn1_flag', 'BN_CTX_end', 'EC_GROUP_new_curve_GFp', 'ossl_ec_encoding_param2id']	12645	451611	EC_GROUP_new_from_params	call site: 00000	/src/openssl/crypto/ec/ec_lib.c:1557
11909	17885	10 : View List ['ossl_assert_int.33564', 'evp_keymgmt_util_clear_operation_cache', 'evp_keymgmt_util_cache_keydata', 'CRYPTO_THREAD_read_lock', 'evp_keymgmt_util_find_operation_cache', 'evp_keymgmt_freedata', 'match_type', 'CRYPTO_THREAD_unlock', 'evp_keymgmt_util_export', 'CRYPTO_THREAD_write_lock']	11909	17885	evp_keymgmt_util_export_to_provider	call site: 03171	/src/openssl/crypto/evp/keymgmt_lib.c:117
11885	11885	1 : View List ['tls_post_process_server_rpk']	11885	11885	tls_post_process_server_certificate	call site: 00000	/src/openssl/ssl/statem/statem_clnt.c:2067
11848	11848	2 : View List ['sk_INFOPAIR_new_null', 'ossl_provider_info_add_parameter']	11848	21247	ossl_provider_new	call site: 04470	/src/openssl/crypto/provider_core.c:558
11681	11681	1 : View List ['X509_STORE_CTX_init_rpk']	11685	80754	ssl_verify_internal	call site: 00000	/src/openssl/ssl/ssl_cert.c:446
10061	10067	4 : View List ['EC_GROUP_check_named_curve', 'EC_GROUP_check', 'EC_KEY_get0_group', 'EC_KEY_get_flags']	22428	35023	ec_validate	call site: 00000	/src/openssl/providers/implementations/keymgmt/ec_kmgmt.c:952
9914	9914	2 : View List ['ec_GF2m_simple_oct2point', 'ec_GFp_simple_oct2point']	9914	9914	EC_POINT_oct2point	call site: 00000	/src/openssl111/crypto/ec/ec_oct.c:113
9386	9386	2 : View List ['conf_diagnostics', 'CONF_modules_load']	9386	16308	CONF_modules_load_file_ex	call site: 00398	/src/openssl/crypto/conf/conf_mod.c:206

Runtime coverage analysis

Covered functions

3899

Functions that are reachable but not covered

1031

Reachable functions

2551

Percentage of reachable functions covered

59.58%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl/fuzz/driver.c	1
openssl/fuzz/client.c	1
openssl/ssl/methods.c	1
openssl/ssl/ssl_lib.c	40
openssl/crypto/err/err_blocks.c	4
openssl/crypto/err/err.c	30
openssl/crypto/init.c	41
openssl/crypto/err/err_local.h	6
openssl/crypto/mem.c	6
openssl/crypto/threads_pthread.c	14
openssl/crypto/err/err_save.c	4
openssl/crypto/initthread.c	21
openssl/crypto/stack/stack.c	22
openssl/crypto/comp/c_zlib.c	2
openssl/crypto/comp/c_brotli.c	1
openssl/crypto/comp/c_zstd.c	1
openssl/crypto/async/async.c	17
openssl/crypto/async/arch/async_posix.c	5
openssl/crypto/rand/rand_lib.c	20
openssl/providers/implementations/rands/seeding/rand_unix.c	4
openssl/crypto/engine/eng_init.c	4
openssl/crypto/cryptlib.c	2
openssl/crypto/engine/eng_lib.c	21
openssl/include/internal/refcount.h	5
openssl/crypto/engine/tb_pkmeth.c	7
openssl/crypto/evp/pmeth_lib.c	31
openssl/crypto/engine/tb_asnmth.c	8
openssl/crypto/asn1/ameth_lib.c	9
openssl/crypto/engine/eng_list.c	10
openssl/crypto/ex_data.c	12
openssl/crypto/context.c	18
openssl/crypto/property/property.c	29
openssl/crypto/sparse_array.c	1
openssl/crypto/provider_conf.c	14
openssl/crypto/evp/c_allc.c	1
openssl/crypto/evp/e_des.c	6
openssl/crypto/evp/names.c	9
openssl/crypto/objects/obj_dat.c	30
openssl/crypto/evp/c_alld.c	1
openssl/crypto/evp/legacy_md4.c	1
openssl/crypto/objects/o_names.c	12
openssl/crypto/objects/obj_local.h	18
openssl/crypto/lhash/lhash.c	13
openssl/crypto/evp/legacy_md5.c	1
openssl/crypto/evp/legacy_md5_sha1.c	1
openssl/crypto/evp/legacy_sha.c	13
openssl/crypto/evp/legacy_mdc2.c	1
openssl/crypto/evp/legacy_ripemd.c	1
openssl/crypto/evp/legacy_wp.c	1
openssl/crypto/sm3/legacy_sm3.c	1
openssl/crypto/evp/legacy_blake2.c	2
openssl/crypto/conf/conf_sap.c	2
openssl/crypto/conf/conf_mod.c	33
openssl/crypto/err/err_mark.c	4
openssl/crypto/getenv.c	1
openssl/crypto/o_str.c	14
openssl/crypto/x509/x509_def.c	1
openssl/crypto/bio/bio_print.c	11
openssl/include/internal/common.h	1
openssl/crypto/ctype.c	3
openssl/crypto/conf/conf_lib.c	10
openssl/crypto/conf/conf_def.c	1
openssl/include/openssl/err.h	4
openssl/crypto/conf/conf_api.c	3
openssl/include/openssl/conf.h	3
openssl/crypto/conf/conf_mall.c	1
openssl/crypto/asn1/asn_moid.c	3
openssl/crypto/bsearch.c	1
openssl/crypto/asn1/a_object.c	6
openssl/crypto/bn/bn_lib.c	26
openssl/crypto/bn/bn_local.h	1
openssl/crypto/mem_sec.c	18
openssl/crypto/bn/bn_word.c	4
openssl/crypto/bn/asm/x86_64-gcc.c	2
openssl/crypto/bn/bn_shift.c	2
openssl/crypto/asn1/asn1_lib.c	14
openssl/crypto/objects/obj_lib.c	1
openssl/crypto/asn1/asn_mstbl.c	3
openssl/crypto/x509/v3_utl.c	6
openssl/crypto/asn1/asn1_gen.c	3
openssl/crypto/asn1/tasn_dec.c	14
openssl/crypto/asn1/a_strnid.c	6
openssl/include/openssl/asn1.h	6
openssl/crypto/engine/eng_openssl.c	20
openssl/include/internal/cryptlib.h	7
openssl/include/openssl/crypto.h	2
openssl/crypto/evp/evp_lib.c	38
openssl/crypto/provider_core.c	49
openssl/crypto/engine/eng_rdrand.c	4
openssl/crypto/engine/tb_rand.c	6
openssl/crypto/engine/eng_local.h	14
openssl/crypto/engine/eng_dyn.c	12
openssl/crypto/dso/dso_lib.c	9
openssl/include/openssl/safestack.h	4
openssl/crypto/dso/dso_dlfcn.c	1
openssl/engines/e_padlock.c	22
openssl/crypto/engine/tb_cipher.c	7
openssl/crypto/evp/cmeth_lib.c	8
openssl/crypto/evp/evp_enc.c	26
openssl/crypto/params.c	51
openssl/crypto/evp/evp_utils.c	5
openssl/crypto/asn1/evp_asn1.c	1
openssl/crypto/asn1/tasn_typ.c	11
openssl/crypto/asn1/a_octet.c	1
openssl/crypto/asn1/a_type.c	1
openssl/crypto/asn1/tasn_fre.c	5
openssl/engines/e_afalg.c	28
openssl/engines/e_afalg_err.c	3
openssl/crypto/provider_local.h	4
openssl/crypto/provider_child.c	4
openssl/providers/implementations/rands/crngt.c	2
openssl/crypto/evp/digest.c	18
openssl/crypto/evp/evp_fetch.c	16
openssl/crypto/core_namemap.c	22
openssl/crypto/engine/eng_fat.c	5
openssl/crypto/engine/eng_table.c	8
openssl/crypto/engine/tb_digest.c	7
openssl/crypto/engine/tb_rsa.c	4
openssl/crypto/engine/tb_dsa.c	4
openssl/crypto/engine/tb_dh.c	4
openssl/crypto/engine/tb_eckey.c	4
openssl/include/crypto/asn1.h	3
openssl/crypto/core_fetch.c	3
openssl/crypto/core_algorithm.c	4
openssl/include/openssl/core_dispatch.h	103
openssl/crypto/encode_decode/decoder_pkey.c	27
openssl/crypto/async/async_wait.c	5
openssl/crypto/async/arch/async_posix.h	1
openssl/crypto/rsa/rsa_ossl.c	1
openssl/crypto/dsa/dsa_ossl.c	1
openssl/crypto/ec/ec_kmeth.c	1
openssl/crypto/dh/dh_key.c	1
openssl/crypto/rand/rand_meth.c	1
openssl/crypto/sha/sha_local.h	1
openssl/include/crypto/md32_common.h	2
openssl/crypto/engine/eng_pkey.c	1
openssl/crypto/bio/bss_file.c	2
openssl/crypto/o_fopen.c	1
openssl/crypto/bio/bio_lib.c	22
openssl/crypto/pem/pem_pkey.c	5
openssl/crypto/bio/bf_readbuff.c	1
openssl/crypto/pem/pem_lib.c	15
openssl/crypto/evp/evp_key.c	3
openssl/crypto/ui/ui_lib.c	27
openssl/crypto/ui/ui_openssl.c	1
openssl/crypto/ui/ui_null.c	1
openssl/include/openssl/ui.h	2
openssl/crypto/err/err_prn.c	1
openssl/crypto/passphrase.c	9
openssl/crypto/encode_decode/decoder_meth.c	21
openssl/crypto/encode_decode/decoder_lib.c	28
openssl/crypto/evp/keymgmt_meth.c	20
openssl/crypto/provider.c	4
openssl/crypto/property/property_query.c	3
openssl/crypto/property/property_string.c	17
openssl/crypto/property/property_parse.c	25
openssl/crypto/encode_decode/encoder_local.h	6
openssl/crypto/evp/keymgmt_lib.c	14
openssl/crypto/evp/p_lib.c	22
openssl/include/crypto/evp.h	8
openssl/include/openssl/x509.h	3
openssl/crypto/x509/x_attrib.c	2
openssl/include/openssl/asn1t.h	2
openssl/crypto/asn1/tasn_utl.c	13
openssl/crypto/asn1/a_int.c	10
openssl/crypto/bio/bss_mem.c	3
openssl/crypto/bio/ossl_core_bio.c	3
openssl/crypto/ui/ui_util.c	8
openssl/crypto/evp/encode.c	7
openssl/crypto/evp/m_sigver.c	7
openssl/crypto/evp/signature.c	9
openssl/crypto/evp/exchange.c	5
openssl/crypto/evp/kem.c	2
openssl/crypto/evp/asymcipher.c	2
openssl/crypto/evp/ctrl_params_translate.c	10
openssl/crypto/params_from_text.c	3
openssl/crypto/bn/bn_conv.c	4
openssl/crypto/asn1/p8_pkey.c	4
openssl/crypto/buffer/buffer.c	4
openssl/crypto/asn1/tasn_new.c	9
openssl/crypto/asn1/a_bitstr.c	2
openssl/crypto/evp/evp_pkey.c	1
openssl/crypto/asn1/x_sig.c	3
openssl/crypto/pkcs12/p12_p8d.c	2
openssl/crypto/pkcs12/p12_decr.c	2
openssl/crypto/evp/evp_pbe.c	6
openssl/crypto/evp/evp_local.h	4
openssl/crypto/asn1/d2i_pr.c	4
openssl/crypto/x509/x_pubkey.c	7
openssl/crypto/engine/eng_cnf.c	5
openssl/crypto/engine/eng_all.c	1
openssl/crypto/engine/eng_ctrl.c	7
openssl/crypto/evp/evp_cnf.c	2
openssl/crypto/conf/conf_ssl.c	6
openssl/crypto/encode_decode/encoder_meth.c	3
openssl/crypto/store/store_meth.c	3
openssl/crypto/evp/e_des3.c	11
openssl/crypto/evp/e_xcbc_d.c	1
openssl/crypto/evp/e_rc4.c	2
openssl/crypto/evp/e_rc4_hmac_md5.c	1
openssl/crypto/evp/e_idea.c	4
openssl/crypto/evp/e_seed.c	4
openssl/crypto/evp/e_sm4.c	5
openssl/crypto/evp/e_rc2.c	6
openssl/crypto/evp/e_bf.c	4
openssl/crypto/evp/e_cast.c	4
openssl/crypto/evp/e_rc5.c	4
openssl/crypto/evp/e_aes.c	38
openssl/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl/crypto/evp/e_aria.c	27
openssl/crypto/evp/e_camellia.c	21
openssl/crypto/evp/e_chacha20_poly1305.c	2
openssl/crypto/err/err_all.c	1
openssl/crypto/bn/bn_err.c	1
openssl/crypto/rsa/rsa_err.c	1
openssl/crypto/dh/dh_err.c	1
openssl/crypto/evp/evp_err.c	1
openssl/crypto/buffer/buf_err.c	1
openssl/crypto/objects/obj_err.c	1
openssl/crypto/pem/pem_err.c	1
openssl/crypto/dsa/dsa_err.c	1
openssl/crypto/x509/x509_err.c	1
openssl/crypto/asn1/asn1_err.c	1
openssl/crypto/conf/conf_err.c	1
openssl/crypto/cpt_err.c	1
openssl/crypto/comp/comp_err.c	1
openssl/crypto/ec/ec_err.c	1
openssl/crypto/bio/bio_err.c	1
openssl/crypto/pkcs7/pkcs7err.c	1
openssl/crypto/x509/v3err.c	1
openssl/crypto/pkcs12/pk12err.c	1
openssl/crypto/rand/rand_err.c	1
openssl/crypto/dso/dso_err.c	1
openssl/crypto/ts/ts_err.c	1
openssl/crypto/engine/eng_err.c	1
openssl/crypto/http/http_err.c	1
openssl/crypto/ocsp/ocsp_err.c	1
openssl/crypto/ui/ui_err.c	1
openssl/crypto/cms/cms_err.c	1
openssl/crypto/crmf/crmf_err.c	1
openssl/crypto/cmp/cmp_err.c	1
openssl/crypto/ct/ct_err.c	1
openssl/crypto/ess/ess_err.c	1
openssl/crypto/async/async_err.c	1
openssl/crypto/store/store_err.c	1
openssl/crypto/property/property_err.c	1
openssl/providers/common/provider_err.c	1
openssl/crypto/property/defn_cache.c	5
openssl/crypto/bio/bss_core.c	2
openssl/providers/implementations/rands/drbg.c	2
openssl/crypto/self_test_core.c	2
openssl/crypto/thread/internal.c	2
openssl/crypto/thread/arch/thread_posix.c	9
openssl/crypto/evp/evp_rand.c	20
openssl/crypto/store/store_init.c	1
openssl/crypto/store/store_register.c	1
openssl/crypto/store/store_local.h	1
openssl/crypto/bio/bio_sock.c	1
openssl/crypto/objects/obj_xref.c	11
openssl/crypto/objects/obj_xref.h	7
openssl/crypto/cmp/cmp_util.c	1
openssl/crypto/trace.c	2
openssl/crypto/cpuid.c	4
openssl/ssl/ssl_init.c	8
openssl/ssl/ssl_ciph.c	22
openssl/include/openssl/ssl.h	5
openssl/crypto/comp/comp_lib.c	2
openssl/ssl/s3_lib.c	2
openssl/ssl/ssl_err.c	1
openssl/ssl/ssl_cert.c	12
openssl/ssl/quic/../ssl_local.h	6
openssl/crypto/x509/x509_lu.c	7
openssl/include/openssl/x509_vfy.h	4
openssl/crypto/x509/x509_cmp.c	6
openssl/crypto/x509/x_name.c	3
openssl/crypto/asn1/tasn_enc.c	8
openssl/crypto/asn1/asn1_local.h	3
openssl/crypto/x509/x509_vpm.c	3
openssl/crypto/ct/ct_log.c	3
openssl/include/openssl/ct.h	1
openssl/ssl/tls_depr.c	3
openssl/ssl/t1_lib.c	7
openssl/ssl/tls_srp.c	2
openssl/ssl/ssl_mcnf.c	2
openssl/ssl/ssl_conf.c	13
openssl/ssl/ssl_rsa.c	5
openssl/crypto/x509/x_all.c	1
openssl/crypto/asn1/a_d2i_fp.c	1
openssl/ssl/ssl_sess.c	9
openssl/include/internal/time.h	11
openssl/crypto/x509/x_x509.c	2
openssl/crypto/x509/t_x509.c	1
openssl/crypto/x509/x_crl.c	2
openssl/ssl/statem/extensions_cust.c	4
openssl/ssl/statem/statem.c	6
openssl/ssl/statem/statem_lib.c	1
openssl/ssl/quic/quic_impl.c	32
openssl/ssl/quic/quic_channel.c	25
openssl/ssl/quic/quic_reactor.c	12
openssl/ssl/quic/quic_record_tx.c	3
openssl/ssl/quic/quic_demux.c	2
openssl/ssl/record/rec_layer_s3.c	6
openssl/ssl/s3_msg.c	1
openssl/ssl/tls13_enc.c	2
openssl/ssl/t1_enc.c	1
openssl/crypto/bio/bss_dgram_pair.c	1
openssl/ssl/pqueue.c	1
openssl/crypto/bio/bio_addr.c	2
openssl/ssl/quic/quic_txp.c	3
openssl/ssl/quic/quic_record_util.c	11
openssl/crypto/evp/kdf_meth.c	7
openssl/crypto/evp/kdf_lib.c	3
openssl/ssl/quic/quic_record_rx.c	2
openssl/ssl/quic/quic_record_shared.c	7
openssl/ssl/quic/quic_wire_pkt.c	2
openssl/include/internal/quic_demux.h	3
openssl/ssl/quic/quic_tls.c	4
openssl/ssl/quic/quic_rstream.c	1
openssl/ssl/quic/quic_sstream.c	1
openssl/crypto/bio/bss_null.c	1
openssl/crypto/async/async_local.h	4
openssl/ssl/quic/quic_wire.c	2
openssl/crypto/time.c	1
openssl/ssl/quic/quic_ackm.c	1
openssl/ssl/quic/quic_statm.c	1
openssl/ssl/quic/quic_thread_assist.c	2
openssl/crypto/thread/arch.c	1

Fuzzer: conf_30

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4532	89.8%
gold	[1:9]	311	6.16%
yellow	[10:29]	26	0.51%
greenyellow	[30:49]	5	0.09%
lawngreen	50+	169	3.35%
All colors	5043	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
3455	3455	1 : View List ['ERR_put_error']	3455	3455	mem_write	call site: 00000	/src/openssl111/crypto/bio/bss_mem.c:227
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BUF_MEM_new	call site: 00000	/src/openssl111/crypto/buffer/buffer.c:36
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BUF_MEM_grow	call site: 00000	/src/openssl111/crypto/buffer/buffer.c:98
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BUF_MEM_grow_clean	call site: 03540	/src/openssl111/crypto/buffer/buffer.c:136
3452	3452	1 : View List ['sk_ENGINE_CLEANUP_ITEM_new_null']	3452	3452	int_cleanup_check	call site: 00979	/src/openssl111/crypto/engine/eng_lib.c:118
104	104	1 : View List ['sec_alloc_realloc']	3559	3559	BUF_MEM_grow	call site: 00000	/src/openssl111/crypto/buffer/buffer.c:94
104	104	1 : View List ['sec_alloc_realloc']	3559	3559	BUF_MEM_grow_clean	call site: 03536	/src/openssl111/crypto/buffer/buffer.c:132
80	80	1 : View List ['CRYPTO_secure_clear_free']	80	84	BUF_MEM_free	call site: 00000	/src/openssl111/crypto/buffer/buffer.c:48
14	14	1 : View List ['bio_call_callback']	14	14	bio_write_intern	call site: 05034	/src/openssl111/crypto/bio/bio_lib.c:348
4	4	2 : View List ['free', '__errno_location']	4	4	OPENSSL_DIR_read	call site: 00000	/src/openssl111/crypto/LPdir_unix.c:113
0	17774	3 : View List ['ERR_set_error', 'ERR_new', 'ERR_set_debug']	0	17774	NCONF_new_ex	call site: 00004	/src/openssl/crypto/conf/conf_lib.c:190
0	17774	3 : View List ['ERR_set_error', 'ERR_new', 'ERR_set_debug']	0	17774	do_init_module_list_lock	call site: 03884	/src/openssl/crypto/conf/conf_mod.c:102

Runtime coverage analysis

Covered functions

333

Functions that are reachable but not covered

1044

Reachable functions

1304

Percentage of reachable functions covered

19.94%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl30/fuzz/driver.c	1
openssl30/fuzz/conf.c	1
openssl30/crypto/conf/conf_lib.c	12
openssl30/crypto/conf/conf_def.c	1
openssl30/crypto/err/err_blocks.c	2
openssl30/crypto/err/err.c	31
openssl30/crypto/init.c	39
openssl30/crypto/err/err_local.h	5
openssl30/crypto/mem.c	7
openssl30/crypto/threads_pthread.c	13
openssl30/crypto/cpuid.c	4
openssl30/crypto/ctype.c	3
openssl30/crypto/initthread.c	21
openssl30/crypto/stack/stack.c	16
openssl30/crypto/comp/c_zlib.c	1
openssl30/crypto/async/async.c	6
openssl30/crypto/rand/rand_lib.c	10
openssl30/providers/implementations/rands/seeding/rand_unix.c	4
openssl30/crypto/engine/eng_init.c	4
openssl30/crypto/cryptlib.c	2
openssl30/crypto/engine/eng_lib.c	21
openssl30/include/internal/refcount.h	2
openssl30/crypto/engine/tb_pkmeth.c	7
openssl30/crypto/evp/pmeth_lib.c	31
openssl30/crypto/engine/tb_asnmth.c	9
openssl30/crypto/asn1/ameth_lib.c	9
openssl30/crypto/engine/eng_list.c	10
openssl30/crypto/ex_data.c	14
openssl30/crypto/context.c	17
openssl30/include/internal/cryptlib.h	8
openssl30/include/openssl/crypto.h	2
openssl30/crypto/property/property_parse.c	25
openssl30/crypto/property/property_string.c	12
openssl30/crypto/lhash/lhash.c	12
openssl30/crypto/evp/evp_rand.c	3
openssl30/crypto/provider_core.c	43
openssl30/crypto/err/err_all.c	1
openssl30/include/openssl/err.h	4
openssl30/crypto/bn/bn_err.c	1
openssl30/crypto/rsa/rsa_err.c	1
openssl30/crypto/dh/dh_err.c	1
openssl30/crypto/evp/evp_err.c	1
openssl30/crypto/buffer/buf_err.c	1
openssl30/crypto/objects/obj_err.c	1
openssl30/crypto/pem/pem_err.c	1
openssl30/crypto/dsa/dsa_err.c	1
openssl30/crypto/x509/x509_err.c	1
openssl30/crypto/asn1/asn1_err.c	1
openssl30/crypto/conf/conf_err.c	1
openssl30/crypto/cpt_err.c	1
openssl30/crypto/comp/comp_err.c	1
openssl30/crypto/ec/ec_err.c	1
openssl30/crypto/bio/bio_err.c	1
openssl30/crypto/pkcs7/pkcs7err.c	1
openssl30/crypto/x509/v3err.c	1
openssl30/crypto/pkcs12/pk12err.c	1
openssl30/crypto/rand/rand_err.c	1
openssl30/crypto/dso/dso_err.c	1
openssl30/crypto/ts/ts_err.c	1
openssl30/crypto/engine/eng_err.c	1
openssl30/crypto/http/http_err.c	1
openssl30/crypto/ocsp/ocsp_err.c	1
openssl30/crypto/ui/ui_err.c	1
openssl30/crypto/cms/cms_err.c	1
openssl30/crypto/crmf/crmf_err.c	1
openssl30/crypto/cmp/cmp_err.c	1
openssl30/crypto/ct/ct_err.c	1
openssl30/crypto/ess/ess_err.c	1
openssl30/crypto/async/async_err.c	1
openssl30/crypto/store/store_err.c	1
openssl30/crypto/property/property_err.c	1
openssl30/providers/common/provider_err.c	1
openssl30/crypto/evp/c_allc.c	1
openssl30/crypto/evp/e_des.c	6
openssl30/crypto/evp/names.c	9
openssl30/crypto/objects/obj_dat.c	23
openssl30/crypto/evp/c_alld.c	1
openssl30/crypto/evp/legacy_md4.c	1
openssl30/crypto/objects/obj_local.h	18
openssl30/crypto/objects/o_names.c	12
openssl30/crypto/conf/conf_sap.c	2
openssl30/crypto/conf/conf_mod.c	33
openssl30/crypto/engine/eng_openssl.c	20
openssl30/crypto/evp/evp_lib.c	37
openssl30/crypto/dso/dso_lib.c	9
openssl30/crypto/provider_local.h	4
openssl30/crypto/provider_child.c	2
openssl30/crypto/evp/cmeth_lib.c	8
openssl30/crypto/evp/evp_enc.c	24
openssl30/crypto/rsa/rsa_ossl.c	1
openssl30/crypto/engine/tb_rsa.c	4
openssl30/crypto/dsa/dsa_ossl.c	1
openssl30/crypto/engine/tb_dsa.c	4
openssl30/crypto/ec/ec_kmeth.c	1
openssl30/crypto/engine/tb_eckey.c	4
openssl30/crypto/dh/dh_key.c	1
openssl30/crypto/engine/tb_dh.c	4
openssl30/crypto/rand/rand_meth.c	1
openssl30/crypto/engine/tb_rand.c	4
openssl30/crypto/engine/tb_cipher.c	7
openssl30/crypto/params.c	47
openssl30/crypto/evp/evp_utils.c	5
openssl30/crypto/engine/tb_digest.c	7
openssl30/crypto/evp/digest.c	17
openssl30/crypto/sha/sha_local.h	1
openssl30/include/crypto/md32_common.h	2
openssl30/crypto/engine/eng_pkey.c	1
openssl30/crypto/bio/bss_file.c	2
openssl30/crypto/o_fopen.c	1
openssl30/crypto/bio/bio_lib.c	16
openssl30/crypto/pem/pem_pkey.c	5
openssl30/crypto/bio/bf_readbuff.c	1
openssl30/crypto/pem/pem_lib.c	15
openssl30/crypto/evp/evp_key.c	3
openssl30/crypto/ui/ui_lib.c	27
openssl30/crypto/ui/ui_openssl.c	1
openssl30/crypto/ui/ui_null.c	1
openssl30/include/openssl/ui.h	2
openssl30/crypto/err/err_prn.c	1
openssl30/crypto/o_str.c	12
openssl30/crypto/bio/bio_print.c	9
openssl30/crypto/passphrase.c	9
openssl30/crypto/encode_decode/decoder_pkey.c	13
openssl30/crypto/encode_decode/decoder_meth.c	16
openssl30/crypto/encode_decode/decoder_lib.c	23
openssl30/crypto/evp/keymgmt_meth.c	21
openssl30/crypto/evp/evp_fetch.c	16
openssl30/crypto/core_namemap.c	19
openssl30/crypto/engine/eng_rdrand.c	4
openssl30/crypto/engine/eng_local.h	14
openssl30/crypto/engine/eng_dyn.c	12
openssl30/include/openssl/safestack.h	4
openssl30/crypto/dso/dso_dlfcn.c	1
openssl30/engines/e_padlock.c	22
openssl30/crypto/asn1/evp_asn1.c	1
openssl30/crypto/asn1/tasn_typ.c	9
openssl30/crypto/asn1/asn1_lib.c	11
openssl30/crypto/asn1/a_octet.c	1
openssl30/crypto/asn1/a_type.c	1
openssl30/crypto/asn1/tasn_fre.c	5
openssl30/crypto/asn1/a_object.c	6
openssl30/engines/e_afalg.c	27
openssl30/engines/e_afalg_err.c	3
openssl30/crypto/engine/eng_fat.c	5
openssl30/crypto/engine/eng_table.c	8
openssl30/crypto/async/async_wait.c	3
openssl30/crypto/async/arch/async_posix.h	1
openssl30/crypto/bsearch.c	1
openssl30/crypto/bn/bn_word.c	4
openssl30/crypto/bn/bn_lib.c	23
openssl30/crypto/bn/bn_local.h	1
openssl30/crypto/mem_sec.c	18
openssl30/crypto/bn/bn_shift.c	2
openssl30/crypto/bn/bn_conv.c	4
openssl30/include/internal/constant_time.h	4
openssl30/crypto/bn/asm/x86_64-gcc.c	2
openssl30/include/crypto/asn1.h	3
openssl30/crypto/property/property.c	25
openssl30/crypto/sparse_array.c	1
openssl30/crypto/core_fetch.c	3
openssl30/crypto/core_algorithm.c	4
openssl30/crypto/getenv.c	1
openssl30/include/openssl/core_dispatch.h	81
openssl30/crypto/provider.c	2
openssl30/crypto/property/property_query.c	3
openssl30/crypto/encode_decode/encoder_local.h	5
openssl30/crypto/evp/keymgmt_lib.c	14
openssl30/crypto/evp/p_lib.c	19
openssl30/include/crypto/evp.h	8
openssl30/include/openssl/x509.h	1
openssl30/crypto/x509/x_attrib.c	2
openssl30/include/openssl/asn1t.h	2
openssl30/crypto/asn1/tasn_utl.c	9
openssl30/crypto/asn1/a_int.c	8
openssl30/crypto/bio/bss_mem.c	3
openssl30/crypto/bio/ossl_core_bio.c	3
openssl30/crypto/ui/ui_util.c	8
openssl30/crypto/evp/encode.c	7
openssl30/crypto/evp/legacy_md5.c	1
openssl30/crypto/evp/m_sigver.c	7
openssl30/crypto/evp/signature.c	9
openssl30/crypto/evp/exchange.c	2
openssl30/crypto/evp/kem.c	2
openssl30/crypto/evp/asymcipher.c	2
openssl30/crypto/evp/ctrl_params_translate.c	10
openssl30/crypto/params_from_text.c	3
openssl30/crypto/asn1/p8_pkey.c	4
openssl30/crypto/asn1/tasn_dec.c	14
openssl30/crypto/buffer/buffer.c	2
openssl30/crypto/asn1/tasn_new.c	9
openssl30/crypto/asn1/a_bitstr.c	1
openssl30/crypto/evp/evp_pkey.c	1
openssl30/crypto/asn1/x_sig.c	3
openssl30/crypto/pkcs12/p12_p8d.c	2
openssl30/crypto/pkcs12/p12_decr.c	2
openssl30/crypto/evp/evp_pbe.c	6
openssl30/crypto/evp/evp_local.h	3
openssl30/crypto/asn1/d2i_pr.c	1
openssl30/crypto/x509/x_pubkey.c	7
openssl30/crypto/x509/x509_def.c	1
openssl30/crypto/conf/conf_api.c	3
openssl30/include/openssl/conf.h	3
openssl30/crypto/conf/conf_mall.c	1
openssl30/crypto/asn1/asn_moid.c	3
openssl30/crypto/objects/obj_lib.c	1
openssl30/crypto/asn1/asn_mstbl.c	3
openssl30/crypto/x509/v3_utl.c	6
openssl30/crypto/asn1/asn1_gen.c	3
openssl30/crypto/asn1/a_strnid.c	6
openssl30/include/openssl/asn1.h	3
openssl30/crypto/engine/eng_cnf.c	5
openssl30/crypto/engine/eng_all.c	1
openssl30/crypto/engine/eng_ctrl.c	7
openssl30/crypto/evp/evp_cnf.c	2
openssl30/crypto/conf/conf_ssl.c	3
openssl30/crypto/provider_conf.c	10
openssl30/crypto/encode_decode/encoder_meth.c	3
openssl30/crypto/store/store_meth.c	3
openssl30/crypto/evp/legacy_md5_sha1.c	1
openssl30/crypto/evp/legacy_sha.c	13
openssl30/crypto/evp/legacy_mdc2.c	1
openssl30/crypto/evp/legacy_ripemd.c	1
openssl30/crypto/evp/legacy_wp.c	1
openssl30/crypto/sm3/legacy_sm3.c	1
openssl30/crypto/evp/legacy_blake2.c	2
openssl30/crypto/evp/e_des3.c	11
openssl30/crypto/evp/e_xcbc_d.c	1
openssl30/crypto/evp/e_rc4.c	2
openssl30/crypto/evp/e_rc4_hmac_md5.c	1
openssl30/crypto/evp/e_idea.c	4
openssl30/crypto/evp/e_seed.c	4
openssl30/crypto/evp/e_sm4.c	5
openssl30/crypto/evp/e_rc2.c	6
openssl30/crypto/evp/e_bf.c	4
openssl30/crypto/evp/e_cast.c	4
openssl30/crypto/evp/e_rc5.c	4
openssl30/crypto/evp/e_aes.c	38
openssl30/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl30/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl30/crypto/evp/e_aria.c	27
openssl30/crypto/evp/e_camellia.c	21
openssl30/crypto/evp/e_chacha20_poly1305.c	2
openssl30/crypto/store/store_init.c	1
openssl30/crypto/store/store_register.c	1
openssl30/crypto/store/store_local.h	1
openssl30/crypto/bio/bio_sock.c	1
openssl30/crypto/objects/obj_xref.c	2
openssl30/crypto/objects/obj_xref.h	2
openssl30/crypto/cmp/cmp_util.c	1
openssl30/crypto/trace.c	2

Fuzzer: x509_111

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2300	71.5%
gold	[1:9]	166	5.16%
yellow	[10:29]	44	1.36%
greenyellow	[30:49]	12	0.37%
lawngreen	50+	693	21.5%
All colors	3215	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
7290	7290	2 : View List ['RAND_DRBG_get0_private', 'RAND_DRBG_bytes']	7290	7290	RAND_priv_bytes	call site: 00000	/src/openssl111/crypto/rand/rand_lib.c:930
4325	11535	9 : View List ['ED25519_public_from_private', 'CRYPTO_secure_malloc', 'X25519_public_from_private', 'RAND_priv_bytes', 'ERR_put_error', 'CRYPTO_secure_free', 'X448_public_from_private', 'ED448_public_from_private', 'CRYPTO_free']	4325	15103	ecx_key_op	call site: 00000	/src/openssl111/crypto/ec/ecx_meth.c:77
3816	3816	1 : View List ['BN_mod_exp_recp']	3816	3816	BN_mod_exp	call site: 00000	/src/openssl111/crypto/bn/bn_exp.c:143
3729	3729	1 : View List ['bn_mod_inverse_no_branch']	3729	3729	int_bn_mod_inverse	call site: 00000	/src/openssl111/crypto/bn/bn_gcd.c:213
3665	3665	1 : View List ['rsa_multip_calc_product']	3665	3665	rsa_cb	call site: 00000	/src/openssl111/crypto/rsa/rsa_asn1.c:35
3508	3508	1 : View List ['unsup_alg']	3508	3508	EVP_PKEY_print_public	call site: 03051	/src/openssl111/crypto/evp/p_lib.c:645
3499	3499	1 : View List ['EVP_PKEY_asn1_find_str']	6955	17319	pkey_set_type	call site: 02204	/src/openssl111/crypto/evp/p_lib.c:201
3472	6926	3 : View List ['ENGINE_finish', 'ENGINE_get_default_RAND', 'ENGINE_get_RAND']	3472	6931	RAND_get_rand_method	call site: 00000	/src/openssl111/crypto/rand/rand_lib.c:856
3462	3462	1 : View List ['EVP_PKEY_CTX_ctrl']	3462	3462	EVP_DigestInit_ex	call site: 02048	/src/openssl111/crypto/evp/digest.c:149
3460	3460	1 : View List ['EC_KEY_priv2buf']	3460	21245	do_EC_KEY_print	call site: 00000	/src/openssl111/crypto/ec/ec_ameth.c:383
3458	6923	4 : View List ['engine_unlocked_finish', 'CRYPTO_THREAD_unlock', 'ERR_put_error', 'CRYPTO_THREAD_write_lock']	3458	6923	ENGINE_finish	call site: 00167	/src/openssl111/crypto/engine/eng_init.c:99
3456	6910	2 : View List ['ENGINE_finish', 'ENGINE_get_digest']	6918	17312	EVP_DigestInit_ex	call site: 02031	/src/openssl111/crypto/evp/digest.c:107

Runtime coverage analysis

Covered functions

956

Functions that are reachable but not covered

697

Reachable functions

1137

Percentage of reachable functions covered

38.7%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl111/fuzz/driver.c	1
openssl111/fuzz/x509.c	1
openssl111/crypto/x509/x_x509.c	4
openssl111/crypto/asn1/tasn_dec.c	13
openssl111/crypto/err/err.c	31
openssl111/crypto/init.c	45
openssl111/crypto/mem.c	7
openssl111/crypto/threads_pthread.c	13
openssl111/crypto/async/async.c	10
openssl111/crypto/async/async_local.h	2
openssl111/crypto/stack/stack.c	12
openssl111/crypto/async/arch/async_posix.c	2
openssl111/crypto/rand/drbg_lib.c	4
openssl111/crypto/rand/rand_lib.c	5
openssl111/crypto/mem_sec.c	18
openssl111/crypto/cryptlib.c	6
openssl111/crypto/ex_data.c	10
openssl111/crypto/comp/c_zlib.c	1
openssl111/crypto/rand/rand_unix.c	4
openssl111/crypto/engine/eng_init.c	4
openssl111/crypto/engine/eng_lib.c	23
openssl111/include/internal/refcount.h	2
openssl111/crypto/engine/tb_pkmeth.c	4
openssl111/crypto/evp/pmeth_lib.c	4
openssl111/crypto/engine/tb_asnmth.c	9
openssl111/crypto/asn1/ameth_lib.c	8
openssl111/crypto/engine/eng_list.c	10
openssl111/include/internal/cryptlib.h	7
openssl111/include/openssl/crypto.h	6
openssl111/crypto/conf/conf_mod.c	15
openssl111/include/openssl/conf.h	18
openssl111/crypto/dso/dso_lib.c	8
openssl111/crypto/engine/eng_local.h	14
openssl111/crypto/store/store_init.c	1
openssl111/crypto/store/store_register.c	1
openssl111/crypto/store/store_local.h	2
openssl111/crypto/lhash/lhash.c	11
openssl111/crypto/bio/bio_lib.c	13
openssl111/crypto/bio/b_sock.c	1
openssl111/crypto/evp/names.c	5
openssl111/crypto/objects/o_names.c	10
openssl111/crypto/objects/obj_local.h	18
openssl111/crypto/mem_dbg.c	1
openssl111/crypto/ctype.c	3
openssl111/crypto/evp/evp_pbe.c	6
openssl111/crypto/evp/evp_local.h	3
openssl111/crypto/objects/obj_xref.c	5
openssl111/crypto/objects/obj_xref.h	4
openssl111/include/crypto/evp.h	1
openssl111/crypto/objects/obj_dat.c	22
openssl111/crypto/asn1/a_object.c	7
openssl111/include/openssl/err.h	5
openssl111/crypto/err/err_all.c	1
openssl111/crypto/evp/c_allc.c	1
openssl111/crypto/evp/e_des.c	6
openssl111/crypto/evp/e_des3.c	11
openssl111/crypto/evp/e_xcbc_d.c	1
openssl111/crypto/evp/e_rc4.c	2
openssl111/crypto/evp/e_rc4_hmac_md5.c	1
openssl111/crypto/evp/e_idea.c	4
openssl111/crypto/evp/e_seed.c	4
openssl111/crypto/evp/e_sm4.c	5
openssl111/crypto/evp/e_rc2.c	6
openssl111/crypto/evp/e_bf.c	4
openssl111/crypto/evp/e_cast.c	4
openssl111/crypto/evp/e_rc5.c	4
openssl111/crypto/evp/e_aes.c	38
openssl111/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl111/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl111/crypto/evp/e_aria.c	27
openssl111/crypto/evp/e_camellia.c	21
openssl111/crypto/evp/e_chacha20_poly1305.c	2
openssl111/crypto/evp/c_alld.c	1
openssl111/crypto/evp/m_md4.c	1
openssl111/crypto/evp/m_md5.c	1
openssl111/crypto/evp/m_md5_sha1.c	1
openssl111/crypto/evp/m_sha1.c	7
openssl111/crypto/evp/m_mdc2.c	1
openssl111/crypto/evp/m_ripemd.c	1
openssl111/crypto/evp/m_wp.c	1
openssl111/crypto/sm3/m_sm3.c	1
openssl111/crypto/blake2/m_blake2b.c	1
openssl111/crypto/blake2/m_blake2s.c	1
openssl111/crypto/evp/m_sha3.c	6
openssl111/crypto/conf/conf_sap.c	2
openssl111/crypto/conf/conf_mall.c	1
openssl111/crypto/asn1/asn_moid.c	3
openssl111/crypto/o_str.c	8
openssl111/crypto/conf/conf_lib.c	8
openssl111/crypto/conf/conf_api.c	3
openssl111/crypto/bn/bn_lib.c	17
openssl111/crypto/bn/bn_local.h	1
openssl111/crypto/bn/bn_word.c	4
openssl111/crypto/bn/asm/x86_64-gcc.c	2
openssl111/include/internal/constant_time.h	4
openssl111/crypto/bn/bn_shift.c	2
openssl111/crypto/asn1/asn1_lib.c	12
openssl111/crypto/objects/obj_lib.c	1
openssl111/crypto/asn1/asn_mstbl.c	3
openssl111/crypto/x509v3/v3_utl.c	6
openssl111/crypto/asn1/asn1_gen.c	3
openssl111/crypto/engine/eng_openssl.c	20
openssl111/crypto/engine/eng_rdrand.c	4
openssl111/crypto/engine/tb_rand.c	4
openssl111/crypto/engine/eng_dyn.c	12
openssl111/include/openssl/safestack.h	6
openssl111/crypto/dso/dso_dlfcn.c	1
openssl111/engines/e_padlock.c	1
openssl111/engines/e_afalg.c	28
openssl111/engines/e_afalg_err.c	3
openssl111/crypto/evp/cmeth_lib.c	8
openssl111/crypto/evp/evp_lib.c	28
openssl111/crypto/evp/evp_enc.c	14
openssl111/crypto/engine/eng_fat.c	5
openssl111/crypto/engine/tb_cipher.c	7
openssl111/crypto/engine/eng_table.c	8
openssl111/crypto/engine/tb_digest.c	5
openssl111/crypto/engine/tb_rsa.c	4
openssl111/crypto/engine/tb_dsa.c	4
openssl111/crypto/engine/tb_dh.c	4
openssl111/crypto/engine/tb_eckey.c	4
openssl111/crypto/async/async_wait.c	3
openssl111/crypto/async/arch/async_posix.h	1
openssl111/crypto/rsa/rsa_ossl.c	1
openssl111/crypto/dsa/dsa_ossl.c	1
openssl111/crypto/ec/ec_kmeth.c	1
openssl111/crypto/dh/dh_key.c	1
openssl111/crypto/sha/sha_local.h	1
openssl111/include/crypto/md32_common.h	2
openssl111/crypto/engine/eng_pkey.c	1
openssl111/crypto/bio/bss_file.c	2
openssl111/crypto/o_fopen.c	1
openssl111/crypto/pem/pem_pkey.c	1
openssl111/crypto/pem/pem_lib.c	14
openssl111/crypto/bio/bss_mem.c	1
openssl111/crypto/evp/encode.c	7
openssl111/include/crypto/asn1.h	3
openssl111/crypto/evp/evp_key.c	3
openssl111/crypto/ui/ui_lib.c	11
openssl111/crypto/ui/ui_openssl.c	1
openssl111/crypto/ui/ui_null.c	1
openssl111/include/openssl/ui.h	5
openssl111/crypto/err/err_prn.c	2
openssl111/crypto/bio/b_print.c	11
openssl111/crypto/evp/digest.c	7
openssl111/crypto/evp/p_lib.c	8
openssl111/include/openssl/x509.h	5
openssl111/crypto/x509/x_attrib.c	1
openssl111/crypto/asn1/tasn_fre.c	5
openssl111/include/openssl/asn1t.h	7
openssl111/crypto/asn1/tasn_utl.c	10
openssl111/crypto/asn1/a_int.c	10
openssl111/crypto/asn1/p8_pkey.c	3
openssl111/crypto/evp/evp_pkey.c	1
openssl111/crypto/bn/bn_print.c	1
openssl111/crypto/asn1/x_sig.c	3
openssl111/crypto/pkcs12/p12_p8d.c	1
openssl111/crypto/pkcs12/p12_decr.c	2
openssl111/crypto/asn1/d2i_pr.c	1
openssl111/crypto/asn1/a_strnid.c	6
openssl111/include/openssl/asn1.h	6
openssl111/crypto/engine/eng_cnf.c	5
openssl111/crypto/engine/eng_ctrl.c	6
openssl111/crypto/getenv.c	1
openssl111/crypto/evp/evp_cnf.c	2
openssl111/crypto/conf/conf_ssl.c	3
openssl111/crypto/engine/eng_all.c	1
openssl111/crypto/conf/conf_def.c	1
openssl111/crypto/x509/x509_def.c	1
openssl111/crypto/bn/bn_err.c	1
openssl111/crypto/rsa/rsa_err.c	1
openssl111/crypto/dh/dh_err.c	1
openssl111/crypto/evp/evp_err.c	1
openssl111/crypto/buffer/buf_err.c	1
openssl111/crypto/objects/obj_err.c	1
openssl111/crypto/pem/pem_err.c	1
openssl111/crypto/dsa/dsa_err.c	1
openssl111/crypto/x509/x509_err.c	1
openssl111/crypto/asn1/asn1_err.c	1
openssl111/crypto/conf/conf_err.c	1
openssl111/crypto/cpt_err.c	1
openssl111/crypto/comp/comp_err.c	1
openssl111/crypto/ec/ec_err.c	1
openssl111/crypto/bio/bio_err.c	1
openssl111/crypto/pkcs7/pkcs7err.c	1
openssl111/crypto/x509v3/v3err.c	1
openssl111/crypto/pkcs12/pk12err.c	1
openssl111/crypto/rand/rand_err.c	1
openssl111/crypto/dso/dso_err.c	1
openssl111/crypto/ts/ts_err.c	1
openssl111/crypto/engine/eng_err.c	1
openssl111/crypto/ocsp/ocsp_err.c	1
openssl111/crypto/ui/ui_err.c	1
openssl111/crypto/cms/cms_err.c	1
openssl111/crypto/ct/ct_err.c	1
openssl111/crypto/async/async_err.c	1
openssl111/crypto/kdf/kdf_err.c	1
openssl111/crypto/store/store_err.c	1
openssl111/crypto/buffer/buffer.c	5
openssl111/crypto/asn1/tasn_typ.c	12
openssl111/crypto/asn1/tasn_new.c	8
openssl111/crypto/asn1/a_type.c	1
openssl111/crypto/asn1/a_bitstr.c	2
openssl111/crypto/bio/bss_null.c	1
openssl111/crypto/x509/t_x509.c	5
openssl111/crypto/x509/x509_set.c	7
openssl111/crypto/x509/x509_cmp.c	5
openssl111/crypto/bio/b_dump.c	4
openssl111/crypto/asn1/a_strex.c	8
openssl111/crypto/x509/x_name.c	1
openssl111/crypto/x509/x509_obj.c	1
openssl111/crypto/x509/x509name.c	5
openssl111/crypto/asn1/asn1_par.c	4
openssl111/crypto/asn1/tasn_enc.c	8
openssl111/crypto/asn1/a_utf8.c	2
openssl111/crypto/asn1/a_time.c	4
openssl111/crypto/o_time.c	4
openssl111/crypto/x509/x_pubkey.c	3
openssl111/crypto/x509v3/v3_prn.c	4
openssl111/crypto/x509/x509_v3.c	3
openssl111/crypto/x509v3/v3_lib.c	4
openssl111/include/openssl/x509v3.h	2
openssl111/crypto/asn1/a_print.c	1
openssl111/crypto/x509/x_x509a.c	5

Fuzzer: ct_111

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2595	85.7%
gold	[1:9]	145	4.79%
yellow	[10:29]	36	1.18%
greenyellow	[30:49]	3	0.09%
lawngreen	50+	247	8.16%
All colors	3026	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
10856	14311	3 : View List ['ERR_put_error', 'ERR_add_error_data', 'asn1_template_ex_d2i']	10856	14311	asn1_item_embed_d2i	call site: 00007	/src/openssl111/crypto/asn1/tasn_dec.c:166
3683	3683	1 : View List ['asn1_template_ex_i2d']	3683	3683	ASN1_item_ex_i2d	call site: 02960	/src/openssl111/crypto/asn1/tasn_enc.c:100
3675	3675	2 : View List ['ASN1_TYPE_set', 'ASN1_TYPE_new']	17694	45354	asn1_ex_c2i	call site: 02703	/src/openssl111/crypto/asn1/tasn_dec.c:807
3566	3566	1 : View List ['asn1_template_free']	3566	3566	asn1_item_embed_free	call site: 02081	/src/openssl111/crypto/asn1/tasn_fre.c:48
3486	3486	1 : View List ['asn1_find_end']	3486	10680	asn1_d2i_ex_primitive	call site: 02673	/src/openssl111/crypto/asn1/tasn_dec.c:719
3455	3455	1 : View List ['ASN1_STRING_new']	3455	6928	asn1_time_from_tm	call site: 02893	/src/openssl111/crypto/asn1/a_time.c:283
3454	3454	1 : View List ['ENGINE_register_all_complete']	3454	3459	OPENSSL_init_crypto	call site: 00015	/src/openssl111/crypto/init.c:737
3452	3452	1 : View List ['drbg_delete_thread_state']	3452	3456	ossl_init_thread_stop	call site: 00043	/src/openssl111/crypto/init.c:440
104	104	1 : View List ['sec_alloc_realloc']	104	3559	BUF_MEM_grow_clean	call site: 02691	/src/openssl111/crypto/buffer/buffer.c:132
47	56	6 : View List ['lh_OBJ_NAME_doall', 'lh_OBJ_NAME_free', 'CRYPTO_THREAD_lock_free', 'lh_OBJ_NAME_get_down_load', 'sk_NAME_FUNCS_pop_free', 'lh_OBJ_NAME_set_down_load']	47	56	OBJ_NAME_cleanup	call site: 00289	/src/openssl111/crypto/objects/o_names.c:393
46	46	1 : View List ['async_delete_thread_state']	3498	3523	ossl_init_thread_stop	call site: 00020	/src/openssl111/crypto/init.c:424
45	45	3 : View List ['lh_ADDED_OBJ_set_down_load', 'lh_ADDED_OBJ_doall', 'lh_ADDED_OBJ_free']	45	45	obj_cleanup_int	call site: 00341	/src/openssl111/crypto/objects/obj_dat.c:155

Runtime coverage analysis

Covered functions

238

Functions that are reachable but not covered

789

Reachable functions

1022

Percentage of reachable functions covered

22.8%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl111/fuzz/driver.c	1
openssl111/fuzz/ct.c	1
openssl111/crypto/ct/ct_oct.c	8
openssl111/crypto/asn1/tasn_typ.c	11
openssl111/crypto/asn1/tasn_dec.c	13
openssl111/crypto/err/err.c	31
openssl111/crypto/init.c	45
openssl111/crypto/mem.c	7
openssl111/crypto/threads_pthread.c	13
openssl111/crypto/async/async.c	10
openssl111/crypto/async/async_local.h	2
openssl111/crypto/stack/stack.c	10
openssl111/crypto/async/arch/async_posix.c	2
openssl111/crypto/rand/drbg_lib.c	4
openssl111/crypto/rand/rand_lib.c	5
openssl111/crypto/mem_sec.c	18
openssl111/crypto/cryptlib.c	6
openssl111/crypto/ex_data.c	10
openssl111/crypto/comp/c_zlib.c	1
openssl111/crypto/rand/rand_unix.c	4
openssl111/crypto/engine/eng_init.c	4
openssl111/crypto/engine/eng_lib.c	23
openssl111/include/internal/refcount.h	2
openssl111/crypto/engine/tb_pkmeth.c	4
openssl111/crypto/evp/pmeth_lib.c	4
openssl111/crypto/engine/tb_asnmth.c	9
openssl111/crypto/asn1/ameth_lib.c	8
openssl111/crypto/engine/eng_list.c	10
openssl111/include/internal/cryptlib.h	7
openssl111/include/openssl/crypto.h	6
openssl111/crypto/conf/conf_mod.c	15
openssl111/include/openssl/conf.h	18
openssl111/crypto/dso/dso_lib.c	8
openssl111/crypto/engine/eng_local.h	14
openssl111/crypto/store/store_init.c	1
openssl111/crypto/store/store_register.c	1
openssl111/crypto/store/store_local.h	2
openssl111/crypto/lhash/lhash.c	11
openssl111/crypto/bio/bio_lib.c	12
openssl111/crypto/bio/b_sock.c	1
openssl111/crypto/evp/names.c	5
openssl111/crypto/objects/o_names.c	10
openssl111/crypto/objects/obj_local.h	18
openssl111/crypto/mem_dbg.c	1
openssl111/crypto/ctype.c	3
openssl111/crypto/evp/evp_pbe.c	6
openssl111/crypto/evp/evp_local.h	3
openssl111/crypto/objects/obj_xref.c	2
openssl111/crypto/objects/obj_xref.h	2
openssl111/include/crypto/evp.h	1
openssl111/crypto/objects/obj_dat.c	22
openssl111/crypto/asn1/a_object.c	6
openssl111/include/openssl/err.h	5
openssl111/crypto/err/err_all.c	1
openssl111/crypto/evp/c_allc.c	1
openssl111/crypto/evp/e_des.c	6
openssl111/crypto/evp/e_des3.c	11
openssl111/crypto/evp/e_xcbc_d.c	1
openssl111/crypto/evp/e_rc4.c	2
openssl111/crypto/evp/e_rc4_hmac_md5.c	1
openssl111/crypto/evp/e_idea.c	4
openssl111/crypto/evp/e_seed.c	4
openssl111/crypto/evp/e_sm4.c	5
openssl111/crypto/evp/e_rc2.c	6
openssl111/crypto/evp/e_bf.c	4
openssl111/crypto/evp/e_cast.c	4
openssl111/crypto/evp/e_rc5.c	4
openssl111/crypto/evp/e_aes.c	38
openssl111/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl111/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl111/crypto/evp/e_aria.c	27
openssl111/crypto/evp/e_camellia.c	21
openssl111/crypto/evp/e_chacha20_poly1305.c	2
openssl111/crypto/evp/c_alld.c	1
openssl111/crypto/evp/m_md4.c	1
openssl111/crypto/evp/m_md5.c	1
openssl111/crypto/evp/m_md5_sha1.c	1
openssl111/crypto/evp/m_sha1.c	7
openssl111/crypto/evp/m_mdc2.c	1
openssl111/crypto/evp/m_ripemd.c	1
openssl111/crypto/evp/m_wp.c	1
openssl111/crypto/sm3/m_sm3.c	1
openssl111/crypto/blake2/m_blake2b.c	1
openssl111/crypto/blake2/m_blake2s.c	1
openssl111/crypto/evp/m_sha3.c	6
openssl111/crypto/conf/conf_sap.c	2
openssl111/crypto/conf/conf_mall.c	1
openssl111/crypto/asn1/asn_moid.c	3
openssl111/crypto/o_str.c	8
openssl111/crypto/conf/conf_lib.c	8
openssl111/crypto/conf/conf_api.c	3
openssl111/crypto/bn/bn_lib.c	17
openssl111/crypto/bn/bn_local.h	1
openssl111/crypto/bn/bn_word.c	4
openssl111/crypto/bn/asm/x86_64-gcc.c	2
openssl111/include/internal/constant_time.h	4
openssl111/crypto/bn/bn_shift.c	2
openssl111/crypto/asn1/asn1_lib.c	14
openssl111/crypto/objects/obj_lib.c	1
openssl111/crypto/asn1/asn_mstbl.c	3
openssl111/crypto/x509v3/v3_utl.c	6
openssl111/crypto/asn1/asn1_gen.c	3
openssl111/crypto/engine/eng_openssl.c	20
openssl111/crypto/engine/eng_rdrand.c	4
openssl111/crypto/engine/tb_rand.c	4
openssl111/crypto/engine/eng_dyn.c	12
openssl111/include/openssl/safestack.h	6
openssl111/crypto/dso/dso_dlfcn.c	1
openssl111/engines/e_padlock.c	1
openssl111/engines/e_afalg.c	28
openssl111/engines/e_afalg_err.c	3
openssl111/crypto/evp/cmeth_lib.c	8
openssl111/crypto/evp/evp_lib.c	28
openssl111/crypto/evp/evp_enc.c	14
openssl111/crypto/engine/eng_fat.c	5
openssl111/crypto/engine/tb_cipher.c	7
openssl111/crypto/engine/eng_table.c	8
openssl111/crypto/engine/tb_digest.c	5
openssl111/crypto/engine/tb_rsa.c	4
openssl111/crypto/engine/tb_dsa.c	4
openssl111/crypto/engine/tb_dh.c	4
openssl111/crypto/engine/tb_eckey.c	4
openssl111/crypto/async/async_wait.c	3
openssl111/crypto/async/arch/async_posix.h	1
openssl111/crypto/rsa/rsa_ossl.c	1
openssl111/crypto/dsa/dsa_ossl.c	1
openssl111/crypto/ec/ec_kmeth.c	1
openssl111/crypto/dh/dh_key.c	1
openssl111/crypto/sha/sha_local.h	1
openssl111/include/crypto/md32_common.h	2
openssl111/crypto/engine/eng_pkey.c	1
openssl111/crypto/bio/bss_file.c	2
openssl111/crypto/o_fopen.c	1
openssl111/crypto/pem/pem_pkey.c	1
openssl111/crypto/pem/pem_lib.c	14
openssl111/crypto/bio/bss_mem.c	1
openssl111/crypto/evp/encode.c	7
openssl111/include/crypto/asn1.h	3
openssl111/crypto/evp/evp_key.c	3
openssl111/crypto/ui/ui_lib.c	11
openssl111/crypto/ui/ui_openssl.c	1
openssl111/crypto/ui/ui_null.c	1
openssl111/include/openssl/ui.h	5
openssl111/crypto/err/err_prn.c	1
openssl111/crypto/bio/b_print.c	11
openssl111/crypto/evp/digest.c	7
openssl111/crypto/evp/p_lib.c	6
openssl111/include/openssl/x509.h	1
openssl111/crypto/x509/x_attrib.c	1
openssl111/crypto/asn1/tasn_fre.c	5
openssl111/include/openssl/asn1t.h	7
openssl111/crypto/asn1/tasn_utl.c	10
openssl111/crypto/asn1/a_int.c	10
openssl111/crypto/asn1/p8_pkey.c	3
openssl111/crypto/evp/evp_pkey.c	1
openssl111/crypto/bn/bn_print.c	1
openssl111/crypto/asn1/x_sig.c	3
openssl111/crypto/pkcs12/p12_p8d.c	1
openssl111/crypto/pkcs12/p12_decr.c	2
openssl111/crypto/asn1/d2i_pr.c	1
openssl111/crypto/asn1/a_strnid.c	6
openssl111/include/openssl/asn1.h	4
openssl111/crypto/engine/eng_cnf.c	5
openssl111/crypto/engine/eng_ctrl.c	6
openssl111/crypto/getenv.c	1
openssl111/crypto/evp/evp_cnf.c	2
openssl111/crypto/conf/conf_ssl.c	3
openssl111/crypto/engine/eng_all.c	1
openssl111/crypto/conf/conf_def.c	1
openssl111/crypto/x509/x509_def.c	1
openssl111/crypto/bn/bn_err.c	1
openssl111/crypto/rsa/rsa_err.c	1
openssl111/crypto/dh/dh_err.c	1
openssl111/crypto/evp/evp_err.c	1
openssl111/crypto/buffer/buf_err.c	1
openssl111/crypto/objects/obj_err.c	1
openssl111/crypto/pem/pem_err.c	1
openssl111/crypto/dsa/dsa_err.c	1
openssl111/crypto/x509/x509_err.c	1
openssl111/crypto/asn1/asn1_err.c	1
openssl111/crypto/conf/conf_err.c	1
openssl111/crypto/cpt_err.c	1
openssl111/crypto/comp/comp_err.c	1
openssl111/crypto/ec/ec_err.c	1
openssl111/crypto/bio/bio_err.c	1
openssl111/crypto/pkcs7/pkcs7err.c	1
openssl111/crypto/x509v3/v3err.c	1
openssl111/crypto/pkcs12/pk12err.c	1
openssl111/crypto/rand/rand_err.c	1
openssl111/crypto/dso/dso_err.c	1
openssl111/crypto/ts/ts_err.c	1
openssl111/crypto/engine/eng_err.c	1
openssl111/crypto/ocsp/ocsp_err.c	1
openssl111/crypto/ui/ui_err.c	1
openssl111/crypto/cms/cms_err.c	1
openssl111/crypto/ct/ct_err.c	1
openssl111/crypto/async/async_err.c	1
openssl111/crypto/kdf/kdf_err.c	1
openssl111/crypto/store/store_err.c	1
openssl111/crypto/buffer/buffer.c	2
openssl111/crypto/asn1/tasn_new.c	8
openssl111/crypto/asn1/a_type.c	1
openssl111/crypto/asn1/a_bitstr.c	2
openssl111/include/openssl/ct.h	8
openssl111/crypto/ct/ct_sct.c	7
openssl111/crypto/bio/bss_null.c	1
openssl111/crypto/ct/ct_prn.c	4
openssl111/crypto/ct/ct_log.c	2
openssl111/crypto/bio/b_dump.c	1
openssl111/crypto/asn1/a_gentm.c	5
openssl111/crypto/o_time.c	5
openssl111/crypto/asn1/a_time.c	6
openssl111/crypto/asn1/tasn_enc.c	8

Fuzzer: conf

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4774	89.1%
gold	[1:9]	399	7.44%
yellow	[10:29]	7	0.13%
greenyellow	[30:49]	1	0.01%
lawngreen	50+	177	3.30%
All colors	5358	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
5924	11854	5 : View List ['EVP_RAND_CTX_free', 'CRYPTO_DOWN_REF.9536', 'CRYPTO_FREE_REF.9537', 'EVP_RAND_free', 'CRYPTO_free']	5924	11854	EVP_RAND_CTX_free	call site: 05143	/src/openssl/crypto/evp/evp_rand.c:378
5924	5924	1 : View List ['ossl_rand_crng_ctx_free']	5924	5954	context_deinit_objs	call site: 05187	/src/openssl/crypto/context.c:310
3455	3489	4 : View List ['ERR_put_error', 'CRYPTO_realloc', 'CRYPTO_malloc', 'ossl_assert_int']	3455	3489	doapr_outch	call site: 00346	/src/openssl111/crypto/bio/b_print.c:839
3455	3455	1 : View List ['ERR_put_error']	3455	3455	mem_write	call site: 00000	/src/openssl111/crypto/bio/bss_mem.c:227
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BUF_MEM_new	call site: 00000	/src/openssl111/crypto/buffer/buffer.c:36
80	94	3 : View List ['CRYPTO_clear_free', 'CRYPTO_free', 'CRYPTO_secure_clear_free']	80	94	BUF_MEM_free	call site: 00000	/src/openssl111/crypto/buffer/buffer.c:45
6	12	2 : View List ['CRYPTO_malloc', 'sk_EX_CALLBACK_value']	20	35	ossl_crypto_new_ex_data_ex	call site: 00873	/src/openssl/crypto/ex_data.c:239
4	4	2 : View List ['free', '__errno_location']	4	4	OPENSSL_DIR_read	call site: 00000	/src/openssl111/crypto/LPdir_unix.c:113
0	17774	3 : View List ['ERR_set_error', 'ERR_new', 'ERR_set_debug']	0	17774	NCONF_new_ex	call site: 00004	/src/openssl/crypto/conf/conf_lib.c:190
0	17774	3 : View List ['ERR_set_error', 'ERR_new', 'ERR_set_debug']	0	17774	do_init_module_list_lock	call site: 00460	/src/openssl/crypto/conf/conf_mod.c:102
0	5926	1 : View List ['ossl_method_store_free']	0	5926	ossl_method_store_new	call site: 00176	/src/openssl/crypto/property/property.c:247
0	5926	1 : View List ['ossl_provider_store_free']	0	5926	ossl_provider_store_new	call site: 05088	/src/openssl/crypto/provider_core.c:311

Runtime coverage analysis

Covered functions

385

Functions that are reachable but not covered

1106

Reachable functions

1425

Percentage of reachable functions covered

22.39%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl/fuzz/driver.c	1
openssl/fuzz/conf.c	1
openssl/crypto/conf/conf_lib.c	12
openssl/crypto/conf/conf_def.c	1
openssl/crypto/err/err_blocks.c	4
openssl/crypto/err/err.c	30
openssl/crypto/init.c	40
openssl/crypto/err/err_local.h	6
openssl/crypto/mem.c	6
openssl/crypto/threads_pthread.c	14
openssl/crypto/err/err_save.c	1
openssl/crypto/initthread.c	21
openssl/crypto/stack/stack.c	19
openssl/crypto/comp/c_zlib.c	1
openssl/crypto/comp/c_brotli.c	1
openssl/crypto/comp/c_zstd.c	1
openssl/crypto/async/async.c	6
openssl/crypto/async/arch/async_posix.c	2
openssl/crypto/rand/rand_lib.c	11
openssl/providers/implementations/rands/seeding/rand_unix.c	4
openssl/crypto/engine/eng_init.c	4
openssl/crypto/cryptlib.c	2
openssl/crypto/engine/eng_lib.c	21
openssl/include/internal/refcount.h	4
openssl/crypto/engine/tb_pkmeth.c	7
openssl/crypto/evp/pmeth_lib.c	31
openssl/crypto/engine/tb_asnmth.c	8
openssl/crypto/asn1/ameth_lib.c	9
openssl/crypto/engine/eng_list.c	10
openssl/crypto/ex_data.c	12
openssl/crypto/context.c	16
openssl/crypto/property/property.c	29
openssl/crypto/sparse_array.c	1
openssl/crypto/provider_conf.c	14
openssl/crypto/evp/c_allc.c	1
openssl/crypto/evp/e_des.c	6
openssl/crypto/evp/names.c	9
openssl/crypto/objects/obj_dat.c	29
openssl/crypto/evp/c_alld.c	1
openssl/crypto/evp/legacy_md4.c	1
openssl/crypto/objects/o_names.c	12
openssl/crypto/objects/obj_local.h	18
openssl/crypto/lhash/lhash.c	13
openssl/crypto/evp/legacy_md5.c	1
openssl/crypto/evp/legacy_md5_sha1.c	1
openssl/crypto/evp/legacy_sha.c	13
openssl/crypto/evp/legacy_mdc2.c	1
openssl/crypto/evp/legacy_ripemd.c	1
openssl/crypto/evp/legacy_wp.c	1
openssl/crypto/sm3/legacy_sm3.c	1
openssl/crypto/evp/legacy_blake2.c	2
openssl/crypto/conf/conf_sap.c	2
openssl/crypto/conf/conf_mod.c	33
openssl/crypto/err/err_mark.c	3
openssl/crypto/getenv.c	1
openssl/crypto/o_str.c	14
openssl/crypto/x509/x509_def.c	1
openssl/crypto/bio/bio_print.c	9
openssl/include/internal/common.h	1
openssl/crypto/ctype.c	3
openssl/include/openssl/err.h	4
openssl/crypto/conf/conf_api.c	3
openssl/include/openssl/conf.h	3
openssl/crypto/conf/conf_mall.c	1
openssl/crypto/asn1/asn_moid.c	3
openssl/crypto/bsearch.c	1
openssl/crypto/asn1/a_object.c	6
openssl/crypto/bn/bn_lib.c	26
openssl/crypto/bn/bn_local.h	1
openssl/crypto/mem_sec.c	18
openssl/crypto/bn/bn_word.c	4
openssl/crypto/bn/asm/x86_64-gcc.c	2
openssl/crypto/bn/bn_shift.c	2
openssl/crypto/asn1/asn1_lib.c	13
openssl/crypto/objects/obj_lib.c	1
openssl/crypto/asn1/asn_mstbl.c	3
openssl/crypto/x509/v3_utl.c	6
openssl/crypto/asn1/asn1_gen.c	3
openssl/crypto/asn1/tasn_dec.c	14
openssl/crypto/asn1/a_strnid.c	6
openssl/include/openssl/asn1.h	3
openssl/crypto/engine/eng_openssl.c	20
openssl/include/internal/cryptlib.h	7
openssl/include/openssl/crypto.h	2
openssl/crypto/evp/evp_lib.c	37
openssl/crypto/provider_core.c	49
openssl/crypto/engine/eng_rdrand.c	4
openssl/crypto/engine/tb_rand.c	4
openssl/crypto/engine/eng_local.h	14
openssl/crypto/engine/eng_dyn.c	12
openssl/crypto/dso/dso_lib.c	9
openssl/include/openssl/safestack.h	4
openssl/crypto/dso/dso_dlfcn.c	1
openssl/engines/e_padlock.c	22
openssl/crypto/engine/tb_cipher.c	7
openssl/crypto/evp/cmeth_lib.c	8
openssl/crypto/evp/evp_enc.c	26
openssl/crypto/params.c	48
openssl/crypto/evp/evp_utils.c	5
openssl/crypto/asn1/evp_asn1.c	1
openssl/crypto/asn1/tasn_typ.c	9
openssl/crypto/asn1/a_octet.c	1
openssl/crypto/asn1/a_type.c	1
openssl/crypto/asn1/tasn_fre.c	5
openssl/engines/e_afalg.c	28
openssl/engines/e_afalg_err.c	3
openssl/crypto/provider_local.h	4
openssl/crypto/provider_child.c	4
openssl/providers/implementations/rands/crngt.c	2
openssl/crypto/evp/digest.c	18
openssl/crypto/evp/evp_fetch.c	16
openssl/crypto/core_namemap.c	22
openssl/crypto/engine/eng_fat.c	5
openssl/crypto/engine/eng_table.c	8
openssl/crypto/engine/tb_digest.c	7
openssl/crypto/engine/tb_rsa.c	4
openssl/crypto/engine/tb_dsa.c	4
openssl/crypto/engine/tb_dh.c	4
openssl/crypto/engine/tb_eckey.c	4
openssl/include/crypto/asn1.h	3
openssl/crypto/core_fetch.c	3
openssl/crypto/core_algorithm.c	4
openssl/include/openssl/core_dispatch.h	79
openssl/crypto/encode_decode/decoder_pkey.c	27
openssl/crypto/async/async_wait.c	3
openssl/crypto/async/arch/async_posix.h	1
openssl/crypto/rsa/rsa_ossl.c	1
openssl/crypto/dsa/dsa_ossl.c	1
openssl/crypto/ec/ec_kmeth.c	1
openssl/crypto/dh/dh_key.c	1
openssl/crypto/rand/rand_meth.c	1
openssl/crypto/sha/sha_local.h	1
openssl/include/crypto/md32_common.h	2
openssl/crypto/engine/eng_pkey.c	1
openssl/crypto/bio/bss_file.c	2
openssl/crypto/o_fopen.c	1
openssl/crypto/bio/bio_lib.c	16
openssl/crypto/pem/pem_pkey.c	5
openssl/crypto/bio/bf_readbuff.c	1
openssl/crypto/pem/pem_lib.c	15
openssl/crypto/evp/evp_key.c	3
openssl/crypto/ui/ui_lib.c	27
openssl/crypto/ui/ui_openssl.c	1
openssl/crypto/ui/ui_null.c	1
openssl/include/openssl/ui.h	2
openssl/crypto/err/err_prn.c	1
openssl/crypto/passphrase.c	9
openssl/crypto/encode_decode/decoder_meth.c	21
openssl/crypto/encode_decode/decoder_lib.c	27
openssl/crypto/evp/keymgmt_meth.c	19
openssl/crypto/provider.c	2
openssl/crypto/property/property_query.c	3
openssl/crypto/property/property_string.c	17
openssl/crypto/property/property_parse.c	25
openssl/crypto/encode_decode/encoder_local.h	6
openssl/crypto/evp/keymgmt_lib.c	13
openssl/crypto/evp/p_lib.c	19
openssl/include/crypto/evp.h	8
openssl/include/openssl/x509.h	1
openssl/crypto/x509/x_attrib.c	2
openssl/include/openssl/asn1t.h	2
openssl/crypto/asn1/tasn_utl.c	9
openssl/crypto/asn1/a_int.c	8
openssl/crypto/bio/bss_mem.c	3
openssl/crypto/bio/ossl_core_bio.c	3
openssl/crypto/ui/ui_util.c	8
openssl/crypto/evp/encode.c	7
openssl/crypto/evp/m_sigver.c	7
openssl/crypto/evp/signature.c	9
openssl/crypto/evp/exchange.c	2
openssl/crypto/evp/kem.c	2
openssl/crypto/evp/asymcipher.c	2
openssl/crypto/evp/ctrl_params_translate.c	10
openssl/crypto/params_from_text.c	3
openssl/crypto/bn/bn_conv.c	4
openssl/crypto/asn1/p8_pkey.c	4
openssl/crypto/buffer/buffer.c	2
openssl/crypto/asn1/tasn_new.c	9
openssl/crypto/asn1/a_bitstr.c	1
openssl/crypto/evp/evp_pkey.c	1
openssl/crypto/asn1/x_sig.c	3
openssl/crypto/pkcs12/p12_p8d.c	2
openssl/crypto/pkcs12/p12_decr.c	2
openssl/crypto/evp/evp_pbe.c	6
openssl/crypto/evp/evp_local.h	4
openssl/crypto/asn1/d2i_pr.c	1
openssl/crypto/x509/x_pubkey.c	7
openssl/crypto/engine/eng_cnf.c	5
openssl/crypto/engine/eng_all.c	1
openssl/crypto/engine/eng_ctrl.c	7
openssl/crypto/evp/evp_cnf.c	2
openssl/crypto/conf/conf_ssl.c	3
openssl/crypto/encode_decode/encoder_meth.c	3
openssl/crypto/store/store_meth.c	3
openssl/crypto/evp/e_des3.c	11
openssl/crypto/evp/e_xcbc_d.c	1
openssl/crypto/evp/e_rc4.c	2
openssl/crypto/evp/e_rc4_hmac_md5.c	1
openssl/crypto/evp/e_idea.c	4
openssl/crypto/evp/e_seed.c	4
openssl/crypto/evp/e_sm4.c	5
openssl/crypto/evp/e_rc2.c	6
openssl/crypto/evp/e_bf.c	4
openssl/crypto/evp/e_cast.c	4
openssl/crypto/evp/e_rc5.c	4
openssl/crypto/evp/e_aes.c	38
openssl/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl/crypto/evp/e_aria.c	27
openssl/crypto/evp/e_camellia.c	21
openssl/crypto/evp/e_chacha20_poly1305.c	2
openssl/crypto/err/err_all.c	1
openssl/crypto/bn/bn_err.c	1
openssl/crypto/rsa/rsa_err.c	1
openssl/crypto/dh/dh_err.c	1
openssl/crypto/evp/evp_err.c	1
openssl/crypto/buffer/buf_err.c	1
openssl/crypto/objects/obj_err.c	1
openssl/crypto/pem/pem_err.c	1
openssl/crypto/dsa/dsa_err.c	1
openssl/crypto/x509/x509_err.c	1
openssl/crypto/asn1/asn1_err.c	1
openssl/crypto/conf/conf_err.c	1
openssl/crypto/cpt_err.c	1
openssl/crypto/comp/comp_err.c	1
openssl/crypto/ec/ec_err.c	1
openssl/crypto/bio/bio_err.c	1
openssl/crypto/pkcs7/pkcs7err.c	1
openssl/crypto/x509/v3err.c	1
openssl/crypto/pkcs12/pk12err.c	1
openssl/crypto/rand/rand_err.c	1
openssl/crypto/dso/dso_err.c	1
openssl/crypto/ts/ts_err.c	1
openssl/crypto/engine/eng_err.c	1
openssl/crypto/http/http_err.c	1
openssl/crypto/ocsp/ocsp_err.c	1
openssl/crypto/ui/ui_err.c	1
openssl/crypto/cms/cms_err.c	1
openssl/crypto/crmf/crmf_err.c	1
openssl/crypto/cmp/cmp_err.c	1
openssl/crypto/ct/ct_err.c	1
openssl/crypto/ess/ess_err.c	1
openssl/crypto/async/async_err.c	1
openssl/crypto/store/store_err.c	1
openssl/crypto/property/property_err.c	1
openssl/providers/common/provider_err.c	1
openssl/crypto/property/defn_cache.c	5
openssl/crypto/bio/bss_core.c	2
openssl/providers/implementations/rands/drbg.c	2
openssl/crypto/self_test_core.c	2
openssl/crypto/thread/internal.c	2
openssl/crypto/thread/arch/thread_posix.c	4
openssl/crypto/evp/evp_rand.c	3
openssl/crypto/store/store_init.c	1
openssl/crypto/store/store_register.c	1
openssl/crypto/store/store_local.h	1
openssl/crypto/bio/bio_sock.c	1
openssl/crypto/objects/obj_xref.c	2
openssl/crypto/objects/obj_xref.h	2
openssl/crypto/cmp/cmp_util.c	1
openssl/crypto/trace.c	2
openssl/crypto/cpuid.c	4

Fuzzer: cms

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3338	60.7%
gold	[1:9]	952	17.3%
yellow	[10:29]	89	1.62%
greenyellow	[30:49]	20	0.36%
lawngreen	50+	1092	19.8%
All colors	5491	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
47407	47409	8 : View List ['sk_BIGNUM_const_push', 'RSA_get0_q', 'RSA_get0_iqmp', 'RSA_get_multi_prime_extra_count', 'sk_RSA_PRIME_INFO_value.14409', 'RSA_get0_p', 'RSA_get0_dmq1', 'RSA_get0_dmp1']	47407	47409	ossl_rsa_get0_all_params	call site: 00000	/src/openssl/crypto/rsa/rsa_lib.c:856
20741	30171	13 : View List ['DSO_free', 'DSO_merge', 'DSO_convert_filename', 'DSO_new', 'ossl_safe_getenv', 'CRYPTO_THREAD_read_lock', 'DSO_bind_func', 'get_provider_store', 'CRYPTO_THREAD_unlock', 'DSO_load', 'CRYPTO_strdup', 'CRYPTO_free', 'DSO_ctrl']	24200	86971	provider_init	call site: 01608	/src/openssl/crypto/provider_core.c:886
13653	55394	7 : View List ['ERR_set_error', 'RAND_priv_bytes_ex', 'ERR_new', 'ossl_ecx_public_from_private', 'ossl_ecx_key_allocate_privkey', 'ossl_ecx_key_free', 'ERR_set_debug']	13653	55394	ossl_ecx_key_op	call site: 00000	/src/openssl/crypto/ec/ecx_backend.c:190
11858	11858	2 : View List ['EVP_CIPHER_get0_name', 'OSSL_PARAM_set_utf8_string']	11858	17876	drbg_ctr_get_ctx_params	call site: 00000	/src/openssl/providers/implementations/rands/drbg_ctr.c:677
10391	10400	8 : View List ['EVP_CIPHER_CTX_ctrl', 'EVP_CIPHER_get_flags', 'OPENSSL_die', 'EVP_CIPHER_CTX_get0_cipher', 'ENGINE_get_cipher', 'ENGINE_init', 'EVP_CIPHER_get_mode', 'CRYPTO_zalloc']	10391	138293	evp_cipher_init_internal	call site: 03644	/src/openssl/crypto/evp/evp_enc.c:143
9914	9914	2 : View List ['ec_GF2m_simple_oct2point', 'ec_GFp_simple_oct2point']	9914	9914	EC_POINT_oct2point	call site: 00000	/src/openssl111/crypto/ec/ec_oct.c:113
9386	9386	2 : View List ['conf_diagnostics', 'CONF_modules_load']	9386	16308	CONF_modules_load_file_ex	call site: 00418	/src/openssl/crypto/conf/conf_mod.c:206
8805	8805	2 : View List ['ec_GF2m_simple_set_compressed_coordinates', 'ec_GFp_simple_set_compressed_coordinates']	8805	8805	EC_POINT_set_compressed_coordinates	call site: 00000	/src/openssl111/crypto/ec/ec_oct.c:32
7508	7508	2 : View List ['EVP_DigestVerifyInit', 'EVP_DigestSignInit']	7508	25282	evp_md_init_internal	call site: 02997	/src/openssl/crypto/evp/digest.c:166
6400	9965	2 : View List ['ossl_x509_algor_mgf1_decode', 'RSA_PSS_PARAMS_free']	6400	9965	ossl_rsa_pss_decode	call site: 00000	/src/openssl/crypto/rsa/rsa_backend.c:453
6157	6161	2 : View List ['ossl_cipher_tlsunpadblock', 'CRYPTO_free']	6157	112805	ossl_cipher_generic_block_update	call site: 00000	/src/openssl/providers/implementations/ciphers/ciphercommon.c:252
5960	5960	1 : View List ['ossl_dh_key2buf']	5960	18059	dh_get_params	call site: 00000	/src/openssl/providers/implementations/keymgmt/dh_kmgmt.c:328

Runtime coverage analysis

Covered functions

2278

Functions that are reachable but not covered

603

Reachable functions

1531

Percentage of reachable functions covered

60.61%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl/fuzz/driver.c	1
openssl/fuzz/cms.c	1
openssl/crypto/bio/bss_mem.c	3
openssl/crypto/bio/bio_lib.c	16
openssl/crypto/mem.c	6
openssl/crypto/err/err_blocks.c	4
openssl/crypto/err/err.c	30
openssl/crypto/init.c	40
openssl/crypto/err/err_local.h	6
openssl/crypto/threads_pthread.c	14
openssl/crypto/cpuid.c	4
openssl/crypto/ctype.c	3
openssl/crypto/initthread.c	21
openssl/crypto/stack/stack.c	19
openssl/crypto/err/err_save.c	1
openssl/crypto/comp/c_zlib.c	1
openssl/crypto/comp/c_brotli.c	1
openssl/crypto/comp/c_zstd.c	1
openssl/crypto/async/async.c	6
openssl/crypto/async/arch/async_posix.c	2
openssl/crypto/rand/rand_lib.c	11
openssl/providers/implementations/rands/seeding/rand_unix.c	4
openssl/crypto/engine/eng_init.c	4
openssl/crypto/cryptlib.c	2
openssl/crypto/engine/eng_lib.c	21
openssl/include/internal/refcount.h	4
openssl/crypto/engine/tb_pkmeth.c	7
openssl/crypto/evp/pmeth_lib.c	31
openssl/crypto/engine/tb_asnmth.c	8
openssl/crypto/asn1/ameth_lib.c	9
openssl/crypto/engine/eng_list.c	10
openssl/crypto/ex_data.c	12
openssl/crypto/context.c	16
openssl/crypto/property/property.c	29
openssl/crypto/sparse_array.c	1
openssl/crypto/provider_conf.c	14
openssl/crypto/evp/c_allc.c	1
openssl/crypto/evp/e_des.c	6
openssl/crypto/evp/names.c	9
openssl/crypto/objects/obj_dat.c	29
openssl/crypto/evp/c_alld.c	1
openssl/crypto/evp/legacy_md4.c	1
openssl/crypto/objects/o_names.c	12
openssl/crypto/objects/obj_local.h	18
openssl/crypto/lhash/lhash.c	13
openssl/crypto/evp/legacy_md5.c	1
openssl/crypto/evp/legacy_md5_sha1.c	1
openssl/crypto/evp/legacy_sha.c	13
openssl/crypto/evp/legacy_mdc2.c	1
openssl/crypto/evp/legacy_ripemd.c	1
openssl/crypto/evp/legacy_wp.c	1
openssl/crypto/sm3/legacy_sm3.c	1
openssl/crypto/evp/legacy_blake2.c	2
openssl/crypto/conf/conf_sap.c	2
openssl/crypto/conf/conf_mod.c	33
openssl/crypto/err/err_mark.c	3
openssl/crypto/getenv.c	1
openssl/crypto/o_str.c	14
openssl/crypto/x509/x509_def.c	1
openssl/crypto/bio/bio_print.c	9
openssl/include/internal/common.h	1
openssl/crypto/conf/conf_lib.c	10
openssl/crypto/conf/conf_def.c	1
openssl/include/openssl/err.h	4
openssl/crypto/conf/conf_api.c	3
openssl/include/openssl/conf.h	3
openssl/crypto/conf/conf_mall.c	1
openssl/crypto/asn1/asn_moid.c	3
openssl/crypto/bsearch.c	1
openssl/crypto/asn1/a_object.c	6
openssl/crypto/bn/bn_lib.c	26
openssl/crypto/bn/bn_local.h	1
openssl/crypto/mem_sec.c	18
openssl/crypto/bn/bn_word.c	4
openssl/crypto/bn/asm/x86_64-gcc.c	2
openssl/crypto/bn/bn_shift.c	2
openssl/crypto/asn1/asn1_lib.c	14
openssl/crypto/objects/obj_lib.c	1
openssl/crypto/asn1/asn_mstbl.c	3
openssl/crypto/x509/v3_utl.c	6
openssl/crypto/asn1/asn1_gen.c	3
openssl/crypto/asn1/tasn_dec.c	14
openssl/crypto/asn1/a_strnid.c	6
openssl/include/openssl/asn1.h	3
openssl/crypto/engine/eng_openssl.c	20
openssl/include/internal/cryptlib.h	7
openssl/include/openssl/crypto.h	2
openssl/crypto/evp/evp_lib.c	37
openssl/crypto/provider_core.c	49
openssl/crypto/engine/eng_rdrand.c	4
openssl/crypto/engine/tb_rand.c	4
openssl/crypto/engine/eng_local.h	14
openssl/crypto/engine/eng_dyn.c	12
openssl/crypto/dso/dso_lib.c	9
openssl/include/openssl/safestack.h	4
openssl/crypto/dso/dso_dlfcn.c	1
openssl/engines/e_padlock.c	22
openssl/crypto/engine/tb_cipher.c	7
openssl/crypto/evp/cmeth_lib.c	8
openssl/crypto/evp/evp_enc.c	26
openssl/crypto/params.c	48
openssl/crypto/evp/evp_utils.c	5
openssl/crypto/asn1/evp_asn1.c	1
openssl/crypto/asn1/tasn_typ.c	9
openssl/crypto/asn1/a_octet.c	1
openssl/crypto/asn1/a_type.c	1
openssl/crypto/asn1/tasn_fre.c	5
openssl/engines/e_afalg.c	28
openssl/engines/e_afalg_err.c	3
openssl/crypto/provider_local.h	4
openssl/crypto/provider_child.c	4
openssl/providers/implementations/rands/crngt.c	2
openssl/crypto/evp/digest.c	18
openssl/crypto/evp/evp_fetch.c	16
openssl/crypto/core_namemap.c	22
openssl/crypto/engine/eng_fat.c	5
openssl/crypto/engine/eng_table.c	8
openssl/crypto/engine/tb_digest.c	7
openssl/crypto/engine/tb_rsa.c	4
openssl/crypto/engine/tb_dsa.c	4
openssl/crypto/engine/tb_dh.c	4
openssl/crypto/engine/tb_eckey.c	4
openssl/include/crypto/asn1.h	3
openssl/crypto/core_fetch.c	3
openssl/crypto/core_algorithm.c	4
openssl/include/openssl/core_dispatch.h	79
openssl/crypto/encode_decode/decoder_pkey.c	27
openssl/crypto/async/async_wait.c	3
openssl/crypto/async/arch/async_posix.h	1
openssl/crypto/rsa/rsa_ossl.c	1
openssl/crypto/dsa/dsa_ossl.c	1
openssl/crypto/ec/ec_kmeth.c	1
openssl/crypto/dh/dh_key.c	1
openssl/crypto/rand/rand_meth.c	1
openssl/crypto/sha/sha_local.h	1
openssl/include/crypto/md32_common.h	2
openssl/crypto/engine/eng_pkey.c	1
openssl/crypto/bio/bss_file.c	2
openssl/crypto/o_fopen.c	1
openssl/crypto/pem/pem_pkey.c	5
openssl/crypto/bio/bf_readbuff.c	1
openssl/crypto/pem/pem_lib.c	15
openssl/crypto/evp/evp_key.c	3
openssl/crypto/ui/ui_lib.c	27
openssl/crypto/ui/ui_openssl.c	1
openssl/crypto/ui/ui_null.c	1
openssl/include/openssl/ui.h	2
openssl/crypto/err/err_prn.c	1
openssl/crypto/passphrase.c	9
openssl/crypto/encode_decode/decoder_meth.c	21
openssl/crypto/encode_decode/decoder_lib.c	27
openssl/crypto/evp/keymgmt_meth.c	19
openssl/crypto/provider.c	2
openssl/crypto/property/property_query.c	3
openssl/crypto/property/property_string.c	17
openssl/crypto/property/property_parse.c	25
openssl/crypto/encode_decode/encoder_local.h	6
openssl/crypto/evp/keymgmt_lib.c	13
openssl/crypto/evp/p_lib.c	19
openssl/include/crypto/evp.h	8
openssl/include/openssl/x509.h	1
openssl/crypto/x509/x_attrib.c	2
openssl/include/openssl/asn1t.h	2
openssl/crypto/asn1/tasn_utl.c	13
openssl/crypto/asn1/a_int.c	10
openssl/crypto/bio/ossl_core_bio.c	3
openssl/crypto/ui/ui_util.c	8
openssl/crypto/evp/encode.c	7
openssl/crypto/evp/m_sigver.c	7
openssl/crypto/evp/signature.c	9
openssl/crypto/evp/exchange.c	2
openssl/crypto/evp/kem.c	2
openssl/crypto/evp/asymcipher.c	2
openssl/crypto/evp/ctrl_params_translate.c	10
openssl/crypto/params_from_text.c	3
openssl/crypto/bn/bn_conv.c	4
openssl/crypto/asn1/p8_pkey.c	4
openssl/crypto/buffer/buffer.c	4
openssl/crypto/asn1/tasn_new.c	9
openssl/crypto/asn1/a_bitstr.c	2
openssl/crypto/evp/evp_pkey.c	1
openssl/crypto/asn1/x_sig.c	3
openssl/crypto/pkcs12/p12_p8d.c	2
openssl/crypto/pkcs12/p12_decr.c	2
openssl/crypto/evp/evp_pbe.c	6
openssl/crypto/evp/evp_local.h	4
openssl/crypto/asn1/d2i_pr.c	1
openssl/crypto/x509/x_pubkey.c	7
openssl/crypto/engine/eng_cnf.c	5
openssl/crypto/engine/eng_all.c	1
openssl/crypto/engine/eng_ctrl.c	7
openssl/crypto/evp/evp_cnf.c	2
openssl/crypto/conf/conf_ssl.c	3
openssl/crypto/encode_decode/encoder_meth.c	3
openssl/crypto/store/store_meth.c	3
openssl/crypto/evp/e_des3.c	11
openssl/crypto/evp/e_xcbc_d.c	1
openssl/crypto/evp/e_rc4.c	2
openssl/crypto/evp/e_rc4_hmac_md5.c	1
openssl/crypto/evp/e_idea.c	4
openssl/crypto/evp/e_seed.c	4
openssl/crypto/evp/e_sm4.c	5
openssl/crypto/evp/e_rc2.c	6
openssl/crypto/evp/e_bf.c	4
openssl/crypto/evp/e_cast.c	4
openssl/crypto/evp/e_rc5.c	4
openssl/crypto/evp/e_aes.c	38
openssl/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl/crypto/evp/e_aria.c	27
openssl/crypto/evp/e_camellia.c	21
openssl/crypto/evp/e_chacha20_poly1305.c	2
openssl/crypto/err/err_all.c	1
openssl/crypto/bn/bn_err.c	1
openssl/crypto/rsa/rsa_err.c	1
openssl/crypto/dh/dh_err.c	1
openssl/crypto/evp/evp_err.c	1
openssl/crypto/buffer/buf_err.c	1
openssl/crypto/objects/obj_err.c	1
openssl/crypto/pem/pem_err.c	1
openssl/crypto/dsa/dsa_err.c	1
openssl/crypto/x509/x509_err.c	1
openssl/crypto/asn1/asn1_err.c	1
openssl/crypto/conf/conf_err.c	1
openssl/crypto/cpt_err.c	1
openssl/crypto/comp/comp_err.c	1
openssl/crypto/ec/ec_err.c	1
openssl/crypto/bio/bio_err.c	1
openssl/crypto/pkcs7/pkcs7err.c	1
openssl/crypto/x509/v3err.c	1
openssl/crypto/pkcs12/pk12err.c	1
openssl/crypto/rand/rand_err.c	1
openssl/crypto/dso/dso_err.c	1
openssl/crypto/ts/ts_err.c	1
openssl/crypto/engine/eng_err.c	1
openssl/crypto/http/http_err.c	1
openssl/crypto/ocsp/ocsp_err.c	1
openssl/crypto/ui/ui_err.c	1
openssl/crypto/cms/cms_err.c	1
openssl/crypto/crmf/crmf_err.c	1
openssl/crypto/cmp/cmp_err.c	1
openssl/crypto/ct/ct_err.c	1
openssl/crypto/ess/ess_err.c	1
openssl/crypto/async/async_err.c	1
openssl/crypto/store/store_err.c	1
openssl/crypto/property/property_err.c	1
openssl/providers/common/provider_err.c	1
openssl/crypto/property/defn_cache.c	5
openssl/crypto/bio/bss_core.c	2
openssl/providers/implementations/rands/drbg.c	2
openssl/crypto/self_test_core.c	2
openssl/crypto/thread/internal.c	2
openssl/crypto/thread/arch/thread_posix.c	4
openssl/crypto/evp/evp_rand.c	3
openssl/crypto/store/store_init.c	1
openssl/crypto/store/store_register.c	1
openssl/crypto/store/store_local.h	1
openssl/crypto/bio/bio_sock.c	1
openssl/crypto/objects/obj_xref.c	2
openssl/crypto/objects/obj_xref.h	2
openssl/crypto/cmp/cmp_util.c	1
openssl/crypto/trace.c	2
openssl/crypto/cms/cms_io.c	2
openssl/crypto/cms/cms_lib.c	5
openssl/crypto/cms/cms_asn1.c	1
openssl/crypto/asn1/a_d2i_fp.c	2
openssl/crypto/cms/cms_sd.c	3
openssl/include/openssl/cms.h	2
openssl/crypto/cms/cms_env.c	4
openssl/crypto/x509/x_x509.c	1
openssl/crypto/cms/cms_local.h	2
openssl/crypto/bio/bss_null.c	1
openssl/crypto/asn1/a_i2d_fp.c	1
openssl/crypto/asn1/tasn_enc.c	8
openssl/crypto/asn1/asn1_local.h	3

Fuzzer: bignum_111

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2802	81.1%
gold	[1:9]	184	5.32%
yellow	[10:29]	4	0.11%
greenyellow	[30:49]	5	0.14%
lawngreen	50+	459	13.2%
All colors	3454	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
6928	45323	9 : View List ['BN_is_word', 'BN_mul_word', 'BN_add', 'BN_lshift', 'BN_div', 'BN_num_bits', 'BN_lshift1', 'BN_mul', 'BN_set_word']	6928	73297	int_bn_mod_inverse	call site: 03041	/src/openssl111/crypto/bn/bn_gcd.c:260
3729	3729	1 : View List ['bn_mod_inverse_no_branch']	3729	3729	int_bn_mod_inverse	call site: 02885	/src/openssl111/crypto/bn/bn_gcd.c:213
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_usub	call site: 03015	/src/openssl111/crypto/bn/bn_add.c:138
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_CTX_new	call site: 02820	/src/openssl111/crypto/bn/bn_ctx.c:138
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_CTX_get	call site: 02853	/src/openssl111/crypto/bn/bn_ctx.c:221
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_STACK_push	call site: 02850	/src/openssl111/crypto/bn/bn_ctx.c:264
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_POOL_get	call site: 02854	/src/openssl111/crypto/bn/bn_ctx.c:318
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_div	call site: 02903	/src/openssl111/crypto/bn/bn_div.c:224
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_mod_exp_recp	call site: 03345	/src/openssl111/crypto/bn/bn_exp.c:180
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_mod_exp_simple	call site: 03403	/src/openssl111/crypto/bn/bn_exp.c:1315
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_new	call site: 00003	/src/openssl111/crypto/bn/bn_lib.c:246
3455	3455	1 : View List ['ERR_put_error']	3455	3455	bn_expand_internal	call site: 00907	/src/openssl111/crypto/bn/bn_lib.c:281

Runtime coverage analysis

Covered functions

227

Functions that are reachable but not covered

781

Reachable functions

1006

Percentage of reachable functions covered

22.37%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl111/fuzz/driver.c	1
openssl111/fuzz/bignum.c	1
openssl111/crypto/bn/bn_lib.c	33
openssl111/crypto/mem.c	7
openssl111/crypto/err/err.c	30
openssl111/crypto/init.c	45
openssl111/crypto/threads_pthread.c	13
openssl111/crypto/async/async.c	10
openssl111/crypto/async/async_local.h	2
openssl111/crypto/stack/stack.c	10
openssl111/crypto/async/arch/async_posix.c	2
openssl111/crypto/rand/drbg_lib.c	4
openssl111/crypto/rand/rand_lib.c	5
openssl111/crypto/mem_sec.c	18
openssl111/crypto/cryptlib.c	6
openssl111/crypto/ex_data.c	10
openssl111/crypto/comp/c_zlib.c	1
openssl111/crypto/rand/rand_unix.c	4
openssl111/crypto/engine/eng_init.c	4
openssl111/crypto/engine/eng_lib.c	23
openssl111/include/internal/refcount.h	2
openssl111/crypto/engine/tb_pkmeth.c	4
openssl111/crypto/evp/pmeth_lib.c	4
openssl111/crypto/engine/tb_asnmth.c	9
openssl111/crypto/asn1/ameth_lib.c	8
openssl111/crypto/engine/eng_list.c	10
openssl111/include/internal/cryptlib.h	7
openssl111/include/openssl/crypto.h	6
openssl111/crypto/conf/conf_mod.c	15
openssl111/include/openssl/conf.h	18
openssl111/crypto/dso/dso_lib.c	8
openssl111/crypto/engine/eng_local.h	14
openssl111/crypto/store/store_init.c	1
openssl111/crypto/store/store_register.c	1
openssl111/crypto/store/store_local.h	2
openssl111/crypto/lhash/lhash.c	11
openssl111/crypto/bio/bio_lib.c	12
openssl111/crypto/bio/b_sock.c	1
openssl111/crypto/evp/names.c	5
openssl111/crypto/objects/o_names.c	10
openssl111/crypto/objects/obj_local.h	18
openssl111/crypto/mem_dbg.c	1
openssl111/crypto/ctype.c	2
openssl111/crypto/evp/evp_pbe.c	6
openssl111/crypto/evp/evp_local.h	3
openssl111/crypto/objects/obj_xref.c	2
openssl111/crypto/objects/obj_xref.h	2
openssl111/include/crypto/evp.h	1
openssl111/crypto/objects/obj_dat.c	22
openssl111/crypto/asn1/a_object.c	6
openssl111/include/openssl/err.h	5
openssl111/crypto/err/err_all.c	1
openssl111/crypto/evp/c_allc.c	1
openssl111/crypto/evp/e_des.c	6
openssl111/crypto/evp/e_des3.c	11
openssl111/crypto/evp/e_xcbc_d.c	1
openssl111/crypto/evp/e_rc4.c	2
openssl111/crypto/evp/e_rc4_hmac_md5.c	1
openssl111/crypto/evp/e_idea.c	4
openssl111/crypto/evp/e_seed.c	4
openssl111/crypto/evp/e_sm4.c	5
openssl111/crypto/evp/e_rc2.c	6
openssl111/crypto/evp/e_bf.c	4
openssl111/crypto/evp/e_cast.c	4
openssl111/crypto/evp/e_rc5.c	4
openssl111/crypto/evp/e_aes.c	38
openssl111/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl111/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl111/crypto/evp/e_aria.c	27
openssl111/crypto/evp/e_camellia.c	21
openssl111/crypto/evp/e_chacha20_poly1305.c	2
openssl111/crypto/evp/c_alld.c	1
openssl111/crypto/evp/m_md4.c	1
openssl111/crypto/evp/m_md5.c	1
openssl111/crypto/evp/m_md5_sha1.c	1
openssl111/crypto/evp/m_sha1.c	7
openssl111/crypto/evp/m_mdc2.c	1
openssl111/crypto/evp/m_ripemd.c	1
openssl111/crypto/evp/m_wp.c	1
openssl111/crypto/sm3/m_sm3.c	1
openssl111/crypto/blake2/m_blake2b.c	1
openssl111/crypto/blake2/m_blake2s.c	1
openssl111/crypto/evp/m_sha3.c	6
openssl111/crypto/conf/conf_sap.c	2
openssl111/crypto/conf/conf_mall.c	1
openssl111/crypto/asn1/asn_moid.c	3
openssl111/crypto/o_str.c	8
openssl111/crypto/conf/conf_lib.c	8
openssl111/crypto/conf/conf_api.c	3
openssl111/crypto/bn/bn_local.h	1
openssl111/crypto/bn/bn_word.c	4
openssl111/crypto/bn/asm/x86_64-gcc.c	10
openssl111/include/internal/constant_time.h	6
openssl111/crypto/bn/bn_shift.c	6
openssl111/crypto/asn1/asn1_lib.c	11
openssl111/crypto/objects/obj_lib.c	1
openssl111/crypto/asn1/asn_mstbl.c	3
openssl111/crypto/x509v3/v3_utl.c	6
openssl111/crypto/asn1/asn1_gen.c	3
openssl111/crypto/asn1/tasn_dec.c	13
openssl111/crypto/engine/eng_openssl.c	20
openssl111/crypto/engine/eng_rdrand.c	4
openssl111/crypto/engine/tb_rand.c	4
openssl111/crypto/engine/eng_dyn.c	12
openssl111/include/openssl/safestack.h	6
openssl111/crypto/dso/dso_dlfcn.c	1
openssl111/engines/e_padlock.c	1
openssl111/engines/e_afalg.c	28
openssl111/engines/e_afalg_err.c	3
openssl111/crypto/evp/cmeth_lib.c	8
openssl111/crypto/evp/evp_lib.c	28
openssl111/crypto/evp/evp_enc.c	14
openssl111/crypto/engine/eng_fat.c	5
openssl111/crypto/engine/tb_cipher.c	7
openssl111/crypto/engine/eng_table.c	8
openssl111/crypto/engine/tb_digest.c	5
openssl111/crypto/engine/tb_rsa.c	4
openssl111/crypto/engine/tb_dsa.c	4
openssl111/crypto/engine/tb_dh.c	4
openssl111/crypto/engine/tb_eckey.c	4
openssl111/crypto/async/async_wait.c	3
openssl111/crypto/async/arch/async_posix.h	1
openssl111/crypto/rsa/rsa_ossl.c	1
openssl111/crypto/dsa/dsa_ossl.c	1
openssl111/crypto/ec/ec_kmeth.c	1
openssl111/crypto/dh/dh_key.c	1
openssl111/crypto/sha/sha_local.h	1
openssl111/include/crypto/md32_common.h	2
openssl111/crypto/engine/eng_pkey.c	1
openssl111/crypto/bio/bss_file.c	2
openssl111/crypto/o_fopen.c	1
openssl111/crypto/pem/pem_pkey.c	1
openssl111/crypto/pem/pem_lib.c	14
openssl111/crypto/bio/bss_mem.c	1
openssl111/crypto/evp/encode.c	7
openssl111/include/crypto/asn1.h	3
openssl111/crypto/evp/evp_key.c	3
openssl111/crypto/ui/ui_lib.c	11
openssl111/crypto/ui/ui_openssl.c	1
openssl111/crypto/ui/ui_null.c	1
openssl111/include/openssl/ui.h	5
openssl111/crypto/err/err_prn.c	1
openssl111/crypto/bio/b_print.c	9
openssl111/crypto/evp/digest.c	7
openssl111/crypto/evp/p_lib.c	6
openssl111/include/openssl/x509.h	1
openssl111/crypto/x509/x_attrib.c	1
openssl111/crypto/asn1/tasn_fre.c	5
openssl111/include/openssl/asn1t.h	6
openssl111/crypto/asn1/tasn_utl.c	9
openssl111/crypto/asn1/a_int.c	8
openssl111/crypto/asn1/p8_pkey.c	3
openssl111/crypto/buffer/buffer.c	2
openssl111/crypto/asn1/tasn_typ.c	6
openssl111/crypto/asn1/tasn_new.c	8
openssl111/crypto/asn1/a_type.c	1
openssl111/crypto/asn1/a_bitstr.c	1
openssl111/crypto/evp/evp_pkey.c	1
openssl111/crypto/bn/bn_print.c	3
openssl111/crypto/asn1/x_sig.c	3
openssl111/crypto/pkcs12/p12_p8d.c	1
openssl111/crypto/pkcs12/p12_decr.c	2
openssl111/crypto/asn1/d2i_pr.c	1
openssl111/crypto/asn1/a_strnid.c	6
openssl111/include/openssl/asn1.h	4
openssl111/crypto/engine/eng_cnf.c	5
openssl111/crypto/engine/eng_ctrl.c	6
openssl111/crypto/getenv.c	1
openssl111/crypto/evp/evp_cnf.c	2
openssl111/crypto/conf/conf_ssl.c	3
openssl111/crypto/engine/eng_all.c	1
openssl111/crypto/conf/conf_def.c	1
openssl111/crypto/x509/x509_def.c	1
openssl111/crypto/bn/bn_err.c	1
openssl111/crypto/rsa/rsa_err.c	1
openssl111/crypto/dh/dh_err.c	1
openssl111/crypto/evp/evp_err.c	1
openssl111/crypto/buffer/buf_err.c	1
openssl111/crypto/objects/obj_err.c	1
openssl111/crypto/pem/pem_err.c	1
openssl111/crypto/dsa/dsa_err.c	1
openssl111/crypto/x509/x509_err.c	1
openssl111/crypto/asn1/asn1_err.c	1
openssl111/crypto/conf/conf_err.c	1
openssl111/crypto/cpt_err.c	1
openssl111/crypto/comp/comp_err.c	1
openssl111/crypto/ec/ec_err.c	1
openssl111/crypto/bio/bio_err.c	1
openssl111/crypto/pkcs7/pkcs7err.c	1
openssl111/crypto/x509v3/v3err.c	1
openssl111/crypto/pkcs12/pk12err.c	1
openssl111/crypto/rand/rand_err.c	1
openssl111/crypto/dso/dso_err.c	1
openssl111/crypto/ts/ts_err.c	1
openssl111/crypto/engine/eng_err.c	1
openssl111/crypto/ocsp/ocsp_err.c	1
openssl111/crypto/ui/ui_err.c	1
openssl111/crypto/cms/cms_err.c	1
openssl111/crypto/ct/ct_err.c	1
openssl111/crypto/async/async_err.c	1
openssl111/crypto/kdf/kdf_err.c	1
openssl111/crypto/store/store_err.c	1
openssl111/crypto/bn/bn_ctx.c	10
openssl111/crypto/bn/bn_exp.c	9
openssl111/crypto/bn/bn_mont.c	10
openssl111/crypto/bn/bn_gcd.c	3
openssl111/crypto/bn/bn_mod.c	2
openssl111/crypto/bn/bn_div.c	3
openssl111/crypto/bn/bn_mul.c	6
openssl111/crypto/bn/bn_add.c	4
openssl111/crypto/bn/bn_sqr.c	4
openssl111/crypto/bn/rsaz_exp.c	2
openssl111/crypto/bn/rsaz_exp.h	2
openssl111/crypto/bn/bn_recp.c	6

Fuzzer: asn1parse_30

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4444	86.7%
gold	[1:9]	354	6.90%
yellow	[10:29]	30	0.58%
greenyellow	[30:49]	5	0.09%
lawngreen	50+	291	5.67%
All colors	5124	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
9386	9386	2 : View List ['conf_diagnostics', 'CONF_modules_load']	12843	16308	CONF_modules_load_file_ex	call site: 03836	/src/openssl/crypto/conf/conf_mod.c:206
6016	6016	1 : View List ['ossl_asn1_template_free']	6016	6016	ossl_asn1_item_embed_free	call site: 02265	/src/openssl/crypto/asn1/tasn_fre.c:48
3457	3457	1 : View List ['ERR_clear_last_mark']	3457	3457	CONF_modules_load_file_ex	call site: 04529	/src/openssl/crypto/conf/conf_mod.c:225
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_lshift	call site: 01690	/src/openssl111/crypto/bn/bn_shift.c:85
3452	3452	1 : View List ['sk_ENGINE_CLEANUP_ITEM_new_null']	3452	3452	int_cleanup_check	call site: 00979	/src/openssl111/crypto/engine/eng_lib.c:118
14	14	1 : View List ['bio_call_callback']	14	14	bio_write_intern	call site: 05051	/src/openssl111/crypto/bio/bio_lib.c:348
11	11	1 : View List ['lh_ADDED_OBJ_retrieve']	11	35	OBJ_obj2nid	call site: 01567	/src/openssl111/crypto/objects/obj_dat.c:331
6	3459	2 : View List ['BN_set_word', 'BN_set_negative']	6	3459	BN_sub_word	call site: 01678	/src/openssl111/crypto/bn/bn_word.c:145
0	17788	4 : View List ['ERR_set_error', 'ERR_new', 'ERR_set_debug', 'ASN1_INTEGER_free']	0	17788	ossl_c2i_ASN1_INTEGER	call site: 03602	/src/openssl/crypto/asn1/a_int.c:306
0	17774	3 : View List ['ERR_set_error', 'ERR_new', 'ERR_set_debug']	0	17774	asn1_item_ex_d2i_intern	call site: 03483	/src/openssl/crypto/asn1/tasn_dec.c:114
0	17774	3 : View List ['ERR_set_error', 'ERR_new', 'ERR_set_debug']	0	17774	NCONF_new_ex	call site: 03834	/src/openssl/crypto/conf/conf_lib.c:190
0	17774	3 : View List ['ERR_set_error', 'ERR_new', 'ERR_set_debug']	0	17774	do_init_module_list_lock	call site: 03885	/src/openssl/crypto/conf/conf_mod.c:102

Runtime coverage analysis

Covered functions

369

Functions that are reachable but not covered

1047

Reachable functions

1383

Percentage of reachable functions covered

24.3%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl30/fuzz/driver.c	1
openssl30/fuzz/asn1parse.c	1
openssl30/crypto/asn1/asn1_parse.c	4
openssl30/crypto/bio/bio_lib.c	16
openssl30/crypto/err/err_blocks.c	2
openssl30/crypto/err/err.c	31
openssl30/crypto/init.c	39
openssl30/crypto/err/err_local.h	5
openssl30/crypto/mem.c	7
openssl30/crypto/threads_pthread.c	13
openssl30/crypto/cpuid.c	4
openssl30/crypto/ctype.c	3
openssl30/crypto/initthread.c	21
openssl30/crypto/stack/stack.c	16
openssl30/crypto/comp/c_zlib.c	1
openssl30/crypto/async/async.c	6
openssl30/crypto/rand/rand_lib.c	10
openssl30/providers/implementations/rands/seeding/rand_unix.c	4
openssl30/crypto/engine/eng_init.c	4
openssl30/crypto/cryptlib.c	2
openssl30/crypto/engine/eng_lib.c	21
openssl30/include/internal/refcount.h	2
openssl30/crypto/engine/tb_pkmeth.c	7
openssl30/crypto/evp/pmeth_lib.c	31
openssl30/crypto/engine/tb_asnmth.c	9
openssl30/crypto/asn1/ameth_lib.c	9
openssl30/crypto/engine/eng_list.c	10
openssl30/crypto/ex_data.c	14
openssl30/crypto/context.c	17
openssl30/include/internal/cryptlib.h	8
openssl30/include/openssl/crypto.h	2
openssl30/crypto/property/property_parse.c	25
openssl30/crypto/property/property_string.c	12
openssl30/crypto/lhash/lhash.c	12
openssl30/crypto/evp/evp_rand.c	3
openssl30/crypto/provider_core.c	43
openssl30/crypto/err/err_all.c	1
openssl30/include/openssl/err.h	4
openssl30/crypto/bn/bn_err.c	1
openssl30/crypto/rsa/rsa_err.c	1
openssl30/crypto/dh/dh_err.c	1
openssl30/crypto/evp/evp_err.c	1
openssl30/crypto/buffer/buf_err.c	1
openssl30/crypto/objects/obj_err.c	1
openssl30/crypto/pem/pem_err.c	1
openssl30/crypto/dsa/dsa_err.c	1
openssl30/crypto/x509/x509_err.c	1
openssl30/crypto/asn1/asn1_err.c	1
openssl30/crypto/conf/conf_err.c	1
openssl30/crypto/cpt_err.c	1
openssl30/crypto/comp/comp_err.c	1
openssl30/crypto/ec/ec_err.c	1
openssl30/crypto/bio/bio_err.c	1
openssl30/crypto/pkcs7/pkcs7err.c	1
openssl30/crypto/x509/v3err.c	1
openssl30/crypto/pkcs12/pk12err.c	1
openssl30/crypto/rand/rand_err.c	1
openssl30/crypto/dso/dso_err.c	1
openssl30/crypto/ts/ts_err.c	1
openssl30/crypto/engine/eng_err.c	1
openssl30/crypto/http/http_err.c	1
openssl30/crypto/ocsp/ocsp_err.c	1
openssl30/crypto/ui/ui_err.c	1
openssl30/crypto/cms/cms_err.c	1
openssl30/crypto/crmf/crmf_err.c	1
openssl30/crypto/cmp/cmp_err.c	1
openssl30/crypto/ct/ct_err.c	1
openssl30/crypto/ess/ess_err.c	1
openssl30/crypto/async/async_err.c	1
openssl30/crypto/store/store_err.c	1
openssl30/crypto/property/property_err.c	1
openssl30/providers/common/provider_err.c	1
openssl30/crypto/evp/c_allc.c	1
openssl30/crypto/evp/e_des.c	6
openssl30/crypto/evp/names.c	9
openssl30/crypto/objects/obj_dat.c	23
openssl30/crypto/evp/c_alld.c	1
openssl30/crypto/evp/legacy_md4.c	1
openssl30/crypto/objects/obj_local.h	18
openssl30/crypto/objects/o_names.c	12
openssl30/crypto/conf/conf_sap.c	2
openssl30/crypto/conf/conf_mod.c	33
openssl30/crypto/engine/eng_openssl.c	20
openssl30/crypto/evp/evp_lib.c	37
openssl30/crypto/dso/dso_lib.c	9
openssl30/crypto/provider_local.h	4
openssl30/crypto/provider_child.c	2
openssl30/crypto/evp/cmeth_lib.c	8
openssl30/crypto/evp/evp_enc.c	24
openssl30/crypto/rsa/rsa_ossl.c	1
openssl30/crypto/engine/tb_rsa.c	4
openssl30/crypto/dsa/dsa_ossl.c	1
openssl30/crypto/engine/tb_dsa.c	4
openssl30/crypto/ec/ec_kmeth.c	1
openssl30/crypto/engine/tb_eckey.c	4
openssl30/crypto/dh/dh_key.c	1
openssl30/crypto/engine/tb_dh.c	4
openssl30/crypto/rand/rand_meth.c	1
openssl30/crypto/engine/tb_rand.c	4
openssl30/crypto/engine/tb_cipher.c	7
openssl30/crypto/params.c	47
openssl30/crypto/evp/evp_utils.c	5
openssl30/crypto/engine/tb_digest.c	7
openssl30/crypto/evp/digest.c	17
openssl30/crypto/sha/sha_local.h	1
openssl30/include/crypto/md32_common.h	2
openssl30/crypto/engine/eng_pkey.c	1
openssl30/crypto/bio/bss_file.c	2
openssl30/crypto/o_fopen.c	1
openssl30/crypto/pem/pem_pkey.c	5
openssl30/crypto/bio/bf_readbuff.c	1
openssl30/crypto/pem/pem_lib.c	15
openssl30/crypto/evp/evp_key.c	3
openssl30/crypto/ui/ui_lib.c	27
openssl30/crypto/ui/ui_openssl.c	1
openssl30/crypto/ui/ui_null.c	1
openssl30/include/openssl/ui.h	2
openssl30/crypto/err/err_prn.c	1
openssl30/crypto/o_str.c	12
openssl30/crypto/bio/bio_print.c	11
openssl30/crypto/passphrase.c	9
openssl30/crypto/encode_decode/decoder_pkey.c	13
openssl30/crypto/encode_decode/decoder_meth.c	16
openssl30/crypto/encode_decode/decoder_lib.c	23
openssl30/crypto/evp/keymgmt_meth.c	21
openssl30/crypto/evp/evp_fetch.c	16
openssl30/crypto/core_namemap.c	19
openssl30/crypto/engine/eng_rdrand.c	4
openssl30/crypto/engine/eng_local.h	14
openssl30/crypto/engine/eng_dyn.c	12
openssl30/include/openssl/safestack.h	4
openssl30/crypto/dso/dso_dlfcn.c	1
openssl30/engines/e_padlock.c	22
openssl30/crypto/asn1/evp_asn1.c	1
openssl30/crypto/asn1/tasn_typ.c	16
openssl30/crypto/asn1/asn1_lib.c	11
openssl30/crypto/asn1/a_octet.c	1
openssl30/crypto/asn1/a_type.c	1
openssl30/crypto/asn1/tasn_fre.c	5
openssl30/crypto/asn1/a_object.c	7
openssl30/engines/e_afalg.c	27
openssl30/engines/e_afalg_err.c	3
openssl30/crypto/engine/eng_fat.c	5
openssl30/crypto/engine/eng_table.c	8
openssl30/crypto/async/async_wait.c	3
openssl30/crypto/async/arch/async_posix.h	1
openssl30/crypto/bsearch.c	1
openssl30/crypto/bn/bn_word.c	4
openssl30/crypto/bn/bn_lib.c	23
openssl30/crypto/bn/bn_local.h	1
openssl30/crypto/mem_sec.c	18
openssl30/crypto/bn/bn_shift.c	2
openssl30/crypto/bn/bn_conv.c	4
openssl30/include/internal/constant_time.h	4
openssl30/crypto/bn/asm/x86_64-gcc.c	2
openssl30/include/crypto/asn1.h	3
openssl30/crypto/property/property.c	25
openssl30/crypto/sparse_array.c	1
openssl30/crypto/core_fetch.c	3
openssl30/crypto/core_algorithm.c	4
openssl30/crypto/getenv.c	1
openssl30/include/openssl/core_dispatch.h	81
openssl30/crypto/provider.c	2
openssl30/crypto/property/property_query.c	3
openssl30/crypto/encode_decode/encoder_local.h	5
openssl30/crypto/evp/keymgmt_lib.c	14
openssl30/crypto/evp/p_lib.c	19
openssl30/include/crypto/evp.h	8
openssl30/include/openssl/x509.h	1
openssl30/crypto/x509/x_attrib.c	2
openssl30/include/openssl/asn1t.h	2
openssl30/crypto/asn1/tasn_utl.c	9
openssl30/crypto/asn1/a_int.c	8
openssl30/crypto/bio/bss_mem.c	3
openssl30/crypto/bio/ossl_core_bio.c	3
openssl30/crypto/ui/ui_util.c	8
openssl30/crypto/evp/encode.c	7
openssl30/crypto/evp/legacy_md5.c	1
openssl30/crypto/evp/m_sigver.c	7
openssl30/crypto/evp/signature.c	9
openssl30/crypto/evp/exchange.c	2
openssl30/crypto/evp/kem.c	2
openssl30/crypto/evp/asymcipher.c	2
openssl30/crypto/evp/ctrl_params_translate.c	10
openssl30/crypto/params_from_text.c	3
openssl30/crypto/asn1/p8_pkey.c	4
openssl30/crypto/asn1/tasn_dec.c	14
openssl30/crypto/buffer/buffer.c	2
openssl30/crypto/asn1/tasn_new.c	9
openssl30/crypto/asn1/a_bitstr.c	1
openssl30/crypto/evp/evp_pkey.c	1
openssl30/crypto/asn1/x_sig.c	3
openssl30/crypto/pkcs12/p12_p8d.c	2
openssl30/crypto/pkcs12/p12_decr.c	2
openssl30/crypto/evp/evp_pbe.c	6
openssl30/crypto/evp/evp_local.h	3
openssl30/crypto/asn1/d2i_pr.c	1
openssl30/crypto/x509/x_pubkey.c	7
openssl30/crypto/x509/x509_def.c	1
openssl30/crypto/conf/conf_lib.c	10
openssl30/crypto/conf/conf_def.c	1
openssl30/crypto/conf/conf_api.c	3
openssl30/include/openssl/conf.h	3
openssl30/crypto/conf/conf_mall.c	1
openssl30/crypto/asn1/asn_moid.c	3
openssl30/crypto/objects/obj_lib.c	1
openssl30/crypto/asn1/asn_mstbl.c	3
openssl30/crypto/x509/v3_utl.c	6
openssl30/crypto/asn1/asn1_gen.c	3
openssl30/crypto/asn1/a_strnid.c	6
openssl30/include/openssl/asn1.h	3
openssl30/crypto/engine/eng_cnf.c	5
openssl30/crypto/engine/eng_all.c	1
openssl30/crypto/engine/eng_ctrl.c	7
openssl30/crypto/evp/evp_cnf.c	2
openssl30/crypto/conf/conf_ssl.c	3
openssl30/crypto/provider_conf.c	10
openssl30/crypto/encode_decode/encoder_meth.c	3
openssl30/crypto/store/store_meth.c	3
openssl30/crypto/evp/legacy_md5_sha1.c	1
openssl30/crypto/evp/legacy_sha.c	13
openssl30/crypto/evp/legacy_mdc2.c	1
openssl30/crypto/evp/legacy_ripemd.c	1
openssl30/crypto/evp/legacy_wp.c	1
openssl30/crypto/sm3/legacy_sm3.c	1
openssl30/crypto/evp/legacy_blake2.c	2
openssl30/crypto/evp/e_des3.c	11
openssl30/crypto/evp/e_xcbc_d.c	1
openssl30/crypto/evp/e_rc4.c	2
openssl30/crypto/evp/e_rc4_hmac_md5.c	1
openssl30/crypto/evp/e_idea.c	4
openssl30/crypto/evp/e_seed.c	4
openssl30/crypto/evp/e_sm4.c	5
openssl30/crypto/evp/e_rc2.c	6
openssl30/crypto/evp/e_bf.c	4
openssl30/crypto/evp/e_cast.c	4
openssl30/crypto/evp/e_rc5.c	4
openssl30/crypto/evp/e_aes.c	38
openssl30/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl30/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl30/crypto/evp/e_aria.c	27
openssl30/crypto/evp/e_camellia.c	21
openssl30/crypto/evp/e_chacha20_poly1305.c	2
openssl30/crypto/store/store_init.c	1
openssl30/crypto/store/store_register.c	1
openssl30/crypto/store/store_local.h	1
openssl30/crypto/bio/bio_sock.c	1
openssl30/crypto/objects/obj_xref.c	2
openssl30/crypto/objects/obj_xref.h	2
openssl30/crypto/cmp/cmp_util.c	1
openssl30/crypto/trace.c	2
openssl30/crypto/bio/bf_prefix.c	1
openssl30/crypto/bio/bio_dump.c	4

Fuzzer: asn1_30

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3804	50.8%
gold	[1:9]	980	13.0%
yellow	[10:29]	124	1.65%
greenyellow	[30:49]	39	0.52%
lawngreen	50+	2536	33.8%
All colors	7483	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
9914	9914	2 : View List ['ec_GF2m_simple_oct2point', 'ec_GFp_simple_oct2point']	9914	9914	EC_POINT_oct2point	call site: 06189	/src/openssl111/crypto/ec/ec_oct.c:113
9386	9386	2 : View List ['conf_diagnostics', 'CONF_modules_load']	9386	16308	CONF_modules_load_file_ex	call site: 03644	/src/openssl/crypto/conf/conf_mod.c:206
8805	8805	2 : View List ['ec_GF2m_simple_set_compressed_coordinates', 'ec_GFp_simple_set_compressed_coordinates']	8805	8805	EC_POINT_set_compressed_coordinates	call site: 06200	/src/openssl111/crypto/ec/ec_oct.c:32
7452	7452	1 : View List ['key_to_epki_der_priv_bio']	7452	7452	key_to_pki_der_priv_bio	call site: 00000	/src/openssl/providers/implementations/encode_decode/encode_key2any.c:253
5960	5960	1 : View List ['ossl_dh_key2buf']	5960	18059	dh_get_params	call site: 00000	/src/openssl/providers/implementations/keymgmt/dh_kmgmt.c:328
5952	23726	4 : View List ['ERR_set_error', 'ERR_set_debug', 'ERR_new', 'OSSL_PARAM_set_BN']	5952	23726	ossl_param_build_set_bn_pad	call site: 00000	/src/openssl/crypto/param_build_set.c:75
5947	5947	1 : View List ['OSSL_PARAM_set_long']	5947	5947	ossl_param_build_set_long	call site: 00000	/src/openssl/crypto/param_build_set.c:39
5947	5947	1 : View List ['OSSL_PARAM_BLD_push_BN_pad']	5947	5947	ossl_param_build_set_bn_pad	call site: 00000	/src/openssl/crypto/param_build_set.c:72
5937	5937	1 : View List ['OSSL_PARAM_BLD_push_int']	5937	5937	ossl_param_build_set_int	call site: 00000	/src/openssl/crypto/param_build_set.c:25
5937	5937	1 : View List ['OSSL_PARAM_BLD_push_long']	5937	5937	ossl_param_build_set_long	call site: 00000	/src/openssl/crypto/param_build_set.c:36
5936	5936	1 : View List ['OSSL_PARAM_BLD_push_utf8_string']	5936	5936	ossl_param_build_set_utf8_string	call site: 00000	/src/openssl/crypto/param_build_set.c:47
5935	5935	1 : View List ['OSSL_PARAM_BLD_push_octet_string']	5935	5935	ossl_param_build_set_octet_string	call site: 00000	/src/openssl/crypto/param_build_set.c:60

Runtime coverage analysis

Covered functions

2942

Functions that are reachable but not covered

740

Reachable functions

2302

Percentage of reachable functions covered

67.85%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl30/fuzz/driver.c	1
openssl30/fuzz/asn1.c	1
openssl30/crypto/asn1/tasn_dec.c	14
openssl30/crypto/err/err_blocks.c	2
openssl30/crypto/err/err.c	31
openssl30/crypto/init.c	40
openssl30/crypto/err/err_local.h	5
openssl30/crypto/mem.c	7
openssl30/crypto/threads_pthread.c	13
openssl30/crypto/cpuid.c	4
openssl30/crypto/ctype.c	4
openssl30/crypto/initthread.c	21
openssl30/crypto/stack/stack.c	17
openssl30/crypto/comp/c_zlib.c	2
openssl30/crypto/async/async.c	6
openssl30/crypto/rand/rand_lib.c	19
openssl30/providers/implementations/rands/seeding/rand_unix.c	4
openssl30/crypto/engine/eng_init.c	4
openssl30/crypto/cryptlib.c	2
openssl30/crypto/engine/eng_lib.c	21
openssl30/include/internal/refcount.h	2
openssl30/crypto/engine/tb_pkmeth.c	7
openssl30/crypto/evp/pmeth_lib.c	31
openssl30/crypto/engine/tb_asnmth.c	9
openssl30/crypto/asn1/ameth_lib.c	9
openssl30/crypto/engine/eng_list.c	10
openssl30/crypto/ex_data.c	14
openssl30/crypto/context.c	17
openssl30/include/internal/cryptlib.h	8
openssl30/include/openssl/crypto.h	2
openssl30/crypto/property/property_parse.c	25
openssl30/crypto/property/property_string.c	12
openssl30/crypto/lhash/lhash.c	12
openssl30/crypto/evp/evp_rand.c	16
openssl30/crypto/provider_core.c	43
openssl30/crypto/err/err_all.c	1
openssl30/include/openssl/err.h	4
openssl30/crypto/bn/bn_err.c	1
openssl30/crypto/rsa/rsa_err.c	1
openssl30/crypto/dh/dh_err.c	1
openssl30/crypto/evp/evp_err.c	1
openssl30/crypto/buffer/buf_err.c	1
openssl30/crypto/objects/obj_err.c	1
openssl30/crypto/pem/pem_err.c	1
openssl30/crypto/dsa/dsa_err.c	1
openssl30/crypto/x509/x509_err.c	1
openssl30/crypto/asn1/asn1_err.c	1
openssl30/crypto/conf/conf_err.c	1
openssl30/crypto/cpt_err.c	1
openssl30/crypto/comp/comp_err.c	1
openssl30/crypto/ec/ec_err.c	1
openssl30/crypto/bio/bio_err.c	1
openssl30/crypto/pkcs7/pkcs7err.c	1
openssl30/crypto/x509/v3err.c	1
openssl30/crypto/pkcs12/pk12err.c	1
openssl30/crypto/rand/rand_err.c	1
openssl30/crypto/dso/dso_err.c	1
openssl30/crypto/ts/ts_err.c	1
openssl30/crypto/engine/eng_err.c	1
openssl30/crypto/http/http_err.c	1
openssl30/crypto/ocsp/ocsp_err.c	1
openssl30/crypto/ui/ui_err.c	1
openssl30/crypto/cms/cms_err.c	1
openssl30/crypto/crmf/crmf_err.c	1
openssl30/crypto/cmp/cmp_err.c	1
openssl30/crypto/ct/ct_err.c	1
openssl30/crypto/ess/ess_err.c	1
openssl30/crypto/async/async_err.c	1
openssl30/crypto/store/store_err.c	1
openssl30/crypto/property/property_err.c	1
openssl30/providers/common/provider_err.c	1
openssl30/crypto/evp/c_allc.c	1
openssl30/crypto/evp/e_des.c	6
openssl30/crypto/evp/names.c	9
openssl30/crypto/objects/obj_dat.c	24
openssl30/crypto/evp/c_alld.c	1
openssl30/crypto/evp/legacy_md4.c	1
openssl30/crypto/objects/obj_local.h	18
openssl30/crypto/objects/o_names.c	12
openssl30/crypto/conf/conf_sap.c	2
openssl30/crypto/conf/conf_mod.c	33
openssl30/crypto/engine/eng_openssl.c	20
openssl30/crypto/evp/evp_lib.c	38
openssl30/crypto/dso/dso_lib.c	9
openssl30/crypto/provider_local.h	4
openssl30/crypto/provider_child.c	2
openssl30/crypto/evp/cmeth_lib.c	8
openssl30/crypto/evp/evp_enc.c	24
openssl30/crypto/rsa/rsa_ossl.c	1
openssl30/crypto/engine/tb_rsa.c	4
openssl30/crypto/dsa/dsa_ossl.c	1
openssl30/crypto/engine/tb_dsa.c	4
openssl30/crypto/ec/ec_kmeth.c	3
openssl30/crypto/engine/tb_eckey.c	6
openssl30/crypto/dh/dh_key.c	1
openssl30/crypto/engine/tb_dh.c	5
openssl30/crypto/rand/rand_meth.c	1
openssl30/crypto/engine/tb_rand.c	6
openssl30/crypto/engine/tb_cipher.c	7
openssl30/crypto/params.c	48
openssl30/crypto/evp/evp_utils.c	5
openssl30/crypto/engine/tb_digest.c	7
openssl30/crypto/evp/digest.c	17
openssl30/crypto/sha/sha_local.h	1
openssl30/include/crypto/md32_common.h	2
openssl30/crypto/engine/eng_pkey.c	1
openssl30/crypto/bio/bss_file.c	2
openssl30/crypto/o_fopen.c	1
openssl30/crypto/bio/bio_lib.c	17
openssl30/crypto/pem/pem_pkey.c	5
openssl30/crypto/bio/bf_readbuff.c	1
openssl30/crypto/pem/pem_lib.c	15
openssl30/crypto/evp/evp_key.c	3
openssl30/crypto/ui/ui_lib.c	27
openssl30/crypto/ui/ui_openssl.c	1
openssl30/crypto/ui/ui_null.c	1
openssl30/include/openssl/ui.h	2
openssl30/crypto/err/err_prn.c	1
openssl30/crypto/o_str.c	12
openssl30/crypto/bio/bio_print.c	11
openssl30/crypto/passphrase.c	10
openssl30/crypto/encode_decode/decoder_pkey.c	13
openssl30/crypto/encode_decode/decoder_meth.c	16
openssl30/crypto/encode_decode/decoder_lib.c	24
openssl30/crypto/evp/keymgmt_meth.c	21
openssl30/crypto/evp/evp_fetch.c	16
openssl30/crypto/core_namemap.c	19
openssl30/crypto/engine/eng_rdrand.c	4
openssl30/crypto/engine/eng_local.h	14
openssl30/crypto/engine/eng_dyn.c	12
openssl30/include/openssl/safestack.h	4
openssl30/crypto/dso/dso_dlfcn.c	1
openssl30/engines/e_padlock.c	22
openssl30/crypto/asn1/evp_asn1.c	1
openssl30/crypto/asn1/tasn_typ.c	19
openssl30/crypto/asn1/asn1_lib.c	12
openssl30/crypto/asn1/a_octet.c	1
openssl30/crypto/asn1/a_type.c	1
openssl30/crypto/asn1/tasn_fre.c	5
openssl30/crypto/asn1/a_object.c	7
openssl30/engines/e_afalg.c	27
openssl30/engines/e_afalg_err.c	3
openssl30/crypto/engine/eng_fat.c	5
openssl30/crypto/engine/eng_table.c	8
openssl30/crypto/async/async_wait.c	3
openssl30/crypto/async/arch/async_posix.h	1
openssl30/crypto/bsearch.c	1
openssl30/crypto/bn/bn_word.c	4
openssl30/crypto/bn/bn_lib.c	42
openssl30/crypto/bn/bn_local.h	1
openssl30/crypto/mem_sec.c	18
openssl30/crypto/bn/bn_shift.c	6
openssl30/crypto/bn/bn_conv.c	5
openssl30/include/internal/constant_time.h	6
openssl30/crypto/bn/asm/x86_64-gcc.c	10
openssl30/include/crypto/asn1.h	3
openssl30/crypto/property/property.c	25
openssl30/crypto/sparse_array.c	1
openssl30/crypto/core_fetch.c	3
openssl30/crypto/core_algorithm.c	4
openssl30/crypto/getenv.c	1
openssl30/include/openssl/core_dispatch.h	96
openssl30/crypto/provider.c	2
openssl30/crypto/property/property_query.c	3
openssl30/crypto/encode_decode/encoder_local.h	10
openssl30/crypto/evp/keymgmt_lib.c	14
openssl30/crypto/evp/p_lib.c	24
openssl30/include/crypto/evp.h	8
openssl30/include/openssl/x509.h	4
openssl30/crypto/x509/x_attrib.c	2
openssl30/include/openssl/asn1t.h	2
openssl30/crypto/asn1/tasn_utl.c	13
openssl30/crypto/asn1/a_int.c	12
openssl30/crypto/bio/bss_mem.c	3
openssl30/crypto/bio/ossl_core_bio.c	3
openssl30/crypto/ui/ui_util.c	8
openssl30/crypto/evp/encode.c	7
openssl30/crypto/evp/legacy_md5.c	1
openssl30/crypto/evp/m_sigver.c	7
openssl30/crypto/evp/signature.c	9
openssl30/crypto/evp/exchange.c	2
openssl30/crypto/evp/kem.c	2
openssl30/crypto/evp/asymcipher.c	2
openssl30/crypto/evp/ctrl_params_translate.c	10
openssl30/crypto/params_from_text.c	3
openssl30/crypto/asn1/p8_pkey.c	6
openssl30/crypto/evp/evp_pkey.c	2
openssl30/crypto/asn1/x_sig.c	3
openssl30/crypto/pkcs12/p12_p8d.c	2
openssl30/crypto/pkcs12/p12_decr.c	2
openssl30/crypto/evp/evp_pbe.c	6
openssl30/crypto/evp/evp_local.h	3
openssl30/crypto/asn1/d2i_pr.c	5
openssl30/crypto/x509/x_pubkey.c	7
openssl30/crypto/x509/x509_def.c	1
openssl30/crypto/conf/conf_lib.c	10
openssl30/crypto/conf/conf_def.c	1
openssl30/crypto/conf/conf_api.c	3
openssl30/include/openssl/conf.h	3
openssl30/crypto/conf/conf_mall.c	1
openssl30/crypto/asn1/asn_moid.c	3
openssl30/crypto/objects/obj_lib.c	1
openssl30/crypto/asn1/asn_mstbl.c	3
openssl30/crypto/x509/v3_utl.c	10
openssl30/crypto/asn1/asn1_gen.c	3
openssl30/crypto/asn1/a_strnid.c	6
openssl30/include/openssl/asn1.h	6
openssl30/crypto/engine/eng_cnf.c	5
openssl30/crypto/engine/eng_all.c	1
openssl30/crypto/engine/eng_ctrl.c	7
openssl30/crypto/evp/evp_cnf.c	2
openssl30/crypto/conf/conf_ssl.c	3
openssl30/crypto/provider_conf.c	10
openssl30/crypto/encode_decode/encoder_meth.c	18
openssl30/crypto/store/store_meth.c	3
openssl30/crypto/evp/legacy_md5_sha1.c	1
openssl30/crypto/evp/legacy_sha.c	13
openssl30/crypto/evp/legacy_mdc2.c	1
openssl30/crypto/evp/legacy_ripemd.c	1
openssl30/crypto/evp/legacy_wp.c	1
openssl30/crypto/sm3/legacy_sm3.c	1
openssl30/crypto/evp/legacy_blake2.c	2
openssl30/crypto/evp/e_des3.c	11
openssl30/crypto/evp/e_xcbc_d.c	1
openssl30/crypto/evp/e_rc4.c	2
openssl30/crypto/evp/e_rc4_hmac_md5.c	1
openssl30/crypto/evp/e_idea.c	4
openssl30/crypto/evp/e_seed.c	4
openssl30/crypto/evp/e_sm4.c	5
openssl30/crypto/evp/e_rc2.c	6
openssl30/crypto/evp/e_bf.c	4
openssl30/crypto/evp/e_cast.c	4
openssl30/crypto/evp/e_rc5.c	4
openssl30/crypto/evp/e_aes.c	38
openssl30/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl30/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl30/crypto/evp/e_aria.c	27
openssl30/crypto/evp/e_camellia.c	21
openssl30/crypto/evp/e_chacha20_poly1305.c	2
openssl30/crypto/store/store_init.c	1
openssl30/crypto/store/store_register.c	1
openssl30/crypto/store/store_local.h	1
openssl30/crypto/bio/bio_sock.c	1
openssl30/crypto/objects/obj_xref.c	2
openssl30/crypto/objects/obj_xref.h	2
openssl30/crypto/cmp/cmp_util.c	1
openssl30/crypto/trace.c	2
openssl30/crypto/buffer/buffer.c	5
openssl30/crypto/asn1/tasn_new.c	9
openssl30/crypto/asn1/a_bitstr.c	3
openssl30/crypto/bio/bss_null.c	1
openssl30/crypto/asn1/tasn_prn.c	9
openssl30/crypto/asn1/asn1_local.h	3
openssl30/crypto/asn1/asn1_parse.c	4
openssl30/crypto/asn1/a_utctm.c	1
openssl30/crypto/asn1/a_time.c	6
openssl30/crypto/o_time.c	4
openssl30/crypto/asn1/a_gentm.c	1
openssl30/crypto/bio/bio_dump.c	4
openssl30/crypto/bio/bf_prefix.c	1
openssl30/crypto/asn1/a_strex.c	6
openssl30/crypto/asn1/tasn_enc.c	8
openssl30/crypto/asn1/a_utf8.c	2
openssl30/include/internal/unicode.h	1
openssl30/crypto/ts/ts_asn1.c	12
openssl30/crypto/ts/ts_req_print.c	1
openssl30/crypto/ts/ts_req_utils.c	2
openssl30/crypto/ts/ts_lib.c	5
openssl30/crypto/x509/x509_v3.c	5
openssl30/crypto/x509/v3_prn.c	3
openssl30/crypto/x509/v3_lib.c	4
openssl30/include/openssl/x509v3.h	2
openssl30/crypto/asn1/a_print.c	1
openssl30/crypto/ts/ts_rsp_print.c	5
openssl30/crypto/x509/v3_san.c	1
openssl30/crypto/x509/x509_obj.c	1
openssl30/crypto/ess/ess_asn1.c	10
openssl30/crypto/dh/dh_asn1.c	5
openssl30/crypto/dh/dh_lib.c	6
openssl30/crypto/ffc/ffc_params.c	6
openssl30/crypto/dh/dh_group_params.c	1
openssl30/crypto/ffc/ffc_dh.c	4
openssl30/crypto/dsa/dsa_sign.c	3
openssl30/crypto/asn1_dsa.c	3
openssl30/include/internal/packet.h	14
openssl30/crypto/dsa/dsa_asn1.c	6
openssl30/crypto/dsa/dsa_lib.c	1
openssl30/crypto/rsa/rsa_asn1.c	4
openssl30/crypto/rsa/rsa_lib.c	1
openssl30/crypto/rsa/rsa_local.h	1
openssl30/crypto/rsa/rsa_mp.c	2
openssl30/crypto/bn/bn_blind.c	1
openssl30/crypto/ec/ec_asn1.c	14
openssl30/crypto/ec/ec_curve.c	6
openssl30/crypto/ec/ec_lib.c	36
openssl30/crypto/bn/bn_ctx.c	15
openssl30/crypto/ec/ec_cvt.c	2
openssl30/crypto/ec/ecp_mont.c	1
openssl30/crypto/ec/ecp_nistz256.c	2
openssl30/crypto/ec/ecp_nistp224.c	2
openssl30/crypto/ec/ecp_nistp256.c	2
openssl30/crypto/ec/ecp_nistp521.c	2
openssl30/crypto/ec/ec_mult.c	2
openssl30/crypto/bn/bn_mont.c	11
openssl30/crypto/ec/ec2_smpl.c	1
openssl30/crypto/ec/ec_local.h	1
openssl30/crypto/bn/bn_add.c	4
openssl30/crypto/bn/bn_div.c	3
openssl30/crypto/bn/bn_gcd.c	3
openssl30/crypto/bn/bn_mod.c	7
openssl30/crypto/bn/bn_mul.c	6
openssl30/crypto/ec/ec_oct.c	4
openssl30/crypto/ec/ecp_oct.c	3
openssl30/crypto/bn/bn_sqr.c	4
openssl30/crypto/bn/bn_sqrt.c	1
openssl30/crypto/bn/bn_exp.c	8
openssl30/crypto/bn/rsaz_exp.c	2
openssl30/crypto/bn/rsaz_exp.h	2
openssl30/crypto/bn/bn_recp.c	6
openssl30/crypto/bn/bn_rand.c	2
openssl30/crypto/bn/bn_kron.c	1
openssl30/crypto/ec/ec2_oct.c	3
openssl30/crypto/bn/bn_gf2m.c	7
openssl30/crypto/ec/eck_prn.c	2
openssl30/crypto/evp/ec_support.c	1
openssl30/crypto/asn1/t_pkey.c	2
openssl30/crypto/bn/bn_intern.c	1
openssl30/crypto/ec/ec_key.c	11
openssl30/crypto/ec/ec_ameth.c	3
openssl30/crypto/encode_decode/encoder_pkey.c	7
openssl30/crypto/encode_decode/encoder_lib.c	18
openssl30/crypto/asn1/i2d_evp.c	2
openssl30/ssl/ssl_asn1.c	5
openssl30/ssl/ssl_sess.c	3
openssl30/ssl/ssl_init.c	8
openssl30/ssl/ssl_ciph.c	10
openssl30/include/openssl/ssl.h	3
openssl30/crypto/comp/comp_lib.c	2
openssl30/ssl/s3_lib.c	3
openssl30/ssl/ssl_err.c	1
openssl30/ssl/ssl_lib.c	8
openssl30/crypto/x509/x_x509.c	2
openssl30/ssl/ssl_txt.c	1
openssl30/ssl/tls_depr.c	1
openssl30/crypto/x509/x509_txt.c	1

Fuzzer: bndiv

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5044	91.4%
gold	[1:9]	267	4.84%
yellow	[10:29]	11	0.19%
greenyellow	[30:49]	1	0.01%
lawngreen	50+	190	3.44%
All colors	5513	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
17774	17774	3 : View List ['ERR_set_error', 'ERR_new', 'ERR_set_debug']	17774	17774	do_init_module_list_lock	call site: 00482	/src/openssl/crypto/conf/conf_mod.c:102
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_usub	call site: 05478	/src/openssl111/crypto/bn/bn_add.c:138
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_div	call site: 05351	/src/openssl111/crypto/bn/bn_div.c:224
3453	3453	1 : View List ['BN_set_word']	3453	3453	BN_add	call site: 05478	/src/openssl111/crypto/bn/bn_add.c:29
3453	3453	1 : View List ['BN_set_word']	3453	3453	bn_rshift_fixed_top	call site: 05378	/src/openssl111/crypto/bn/bn_shift.c:186
95	95	1 : View List ['BN_free']	95	95	bin2bn	call site: 00004	/src/openssl/crypto/bn/bn_lib.c:507
6	6	1 : View List ['bn_mul_comba4']	6	18	bn_mul_recursive	call site: 05440	/src/openssl111/crypto/bn/bn_mul.c:244
0	3453	1 : View List ['BN_new']	95	7012	bin2bn	call site: 00003	/src/openssl/crypto/bn/bn_lib.c:447
0	22	3 : View List ['sk_THREAD_EVENT_HANDLER_PTR_free', 'CRYPTO_THREAD_lock_free', 'CRYPTO_free']	0	22	create_global_tevent_register	call site: 00051	/src/openssl/crypto/initthread.c:66
0	5	1 : View List ['CRYPTO_THREAD_unlock']	0	5	init_thread_deregister	call site: 01398	/src/openssl/crypto/initthread.c:446
0	4	1 : View List ['CRYPTO_free']	0	4	err_clear_data	call site: 00014	/src/openssl/crypto/err/err_local.h:23
0	0	None	9397	9415	ossl_rand_cleanup_int	call site: 00146	/src/openssl/crypto/rand/rand_lib.c:84

Runtime coverage analysis

Covered functions

221

Functions that are reachable but not covered

1248

Reachable functions

1463

Percentage of reachable functions covered

14.7%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl/fuzz/driver.c	1
openssl/fuzz/bndiv.c	1
openssl/crypto/bn/bn_lib.c	34
openssl/crypto/mem.c	6
openssl/crypto/err/err_blocks.c	4
openssl/crypto/err/err.c	30
openssl/crypto/init.c	40
openssl/crypto/err/err_local.h	6
openssl/crypto/threads_pthread.c	14
openssl/crypto/cpuid.c	4
openssl/crypto/ctype.c	3
openssl/crypto/initthread.c	21
openssl/crypto/stack/stack.c	19
openssl/crypto/err/err_save.c	1
openssl/crypto/comp/c_zlib.c	1
openssl/crypto/comp/c_brotli.c	1
openssl/crypto/comp/c_zstd.c	1
openssl/crypto/async/async.c	6
openssl/crypto/async/arch/async_posix.c	2
openssl/crypto/rand/rand_lib.c	11
openssl/providers/implementations/rands/seeding/rand_unix.c	4
openssl/crypto/engine/eng_init.c	4
openssl/crypto/cryptlib.c	2
openssl/crypto/engine/eng_lib.c	21
openssl/include/internal/refcount.h	4
openssl/crypto/engine/tb_pkmeth.c	7
openssl/crypto/evp/pmeth_lib.c	31
openssl/crypto/engine/tb_asnmth.c	8
openssl/crypto/asn1/ameth_lib.c	9
openssl/crypto/engine/eng_list.c	10
openssl/crypto/ex_data.c	12
openssl/crypto/context.c	16
openssl/crypto/property/property.c	29
openssl/crypto/sparse_array.c	1
openssl/crypto/provider_conf.c	14
openssl/crypto/evp/c_allc.c	1
openssl/crypto/evp/e_des.c	6
openssl/crypto/evp/names.c	9
openssl/crypto/objects/obj_dat.c	29
openssl/crypto/evp/c_alld.c	1
openssl/crypto/evp/legacy_md4.c	1
openssl/crypto/objects/o_names.c	12
openssl/crypto/objects/obj_local.h	18
openssl/crypto/lhash/lhash.c	13
openssl/crypto/evp/legacy_md5.c	1
openssl/crypto/evp/legacy_md5_sha1.c	1
openssl/crypto/evp/legacy_sha.c	13
openssl/crypto/evp/legacy_mdc2.c	1
openssl/crypto/evp/legacy_ripemd.c	1
openssl/crypto/evp/legacy_wp.c	1
openssl/crypto/sm3/legacy_sm3.c	1
openssl/crypto/evp/legacy_blake2.c	2
openssl/crypto/conf/conf_sap.c	2
openssl/crypto/conf/conf_mod.c	33
openssl/crypto/err/err_mark.c	3
openssl/crypto/getenv.c	1
openssl/crypto/o_str.c	14
openssl/crypto/x509/x509_def.c	1
openssl/crypto/bio/bio_print.c	9
openssl/include/internal/common.h	1
openssl/crypto/conf/conf_lib.c	10
openssl/crypto/conf/conf_def.c	1
openssl/include/openssl/err.h	4
openssl/crypto/conf/conf_api.c	3
openssl/include/openssl/conf.h	3
openssl/crypto/conf/conf_mall.c	1
openssl/crypto/asn1/asn_moid.c	3
openssl/crypto/bsearch.c	1
openssl/crypto/asn1/a_object.c	6
openssl/crypto/bn/bn_local.h	1
openssl/crypto/mem_sec.c	18
openssl/crypto/bn/bn_word.c	4
openssl/crypto/bn/asm/x86_64-gcc.c	7
openssl/crypto/bn/bn_shift.c	3
openssl/crypto/asn1/asn1_lib.c	13
openssl/crypto/objects/obj_lib.c	1
openssl/crypto/asn1/asn_mstbl.c	3
openssl/crypto/x509/v3_utl.c	6
openssl/crypto/asn1/asn1_gen.c	3
openssl/crypto/asn1/tasn_dec.c	14
openssl/crypto/asn1/a_strnid.c	6
openssl/include/openssl/asn1.h	3
openssl/crypto/engine/eng_openssl.c	20
openssl/include/internal/cryptlib.h	7
openssl/include/openssl/crypto.h	2
openssl/crypto/evp/evp_lib.c	37
openssl/crypto/provider_core.c	49
openssl/crypto/engine/eng_rdrand.c	4
openssl/crypto/engine/tb_rand.c	4
openssl/crypto/engine/eng_local.h	14
openssl/crypto/engine/eng_dyn.c	12
openssl/crypto/dso/dso_lib.c	9
openssl/include/openssl/safestack.h	4
openssl/crypto/dso/dso_dlfcn.c	1
openssl/engines/e_padlock.c	22
openssl/crypto/engine/tb_cipher.c	7
openssl/crypto/evp/cmeth_lib.c	8
openssl/crypto/evp/evp_enc.c	26
openssl/crypto/params.c	48
openssl/crypto/evp/evp_utils.c	5
openssl/crypto/asn1/evp_asn1.c	1
openssl/crypto/asn1/tasn_typ.c	9
openssl/crypto/asn1/a_octet.c	1
openssl/crypto/asn1/a_type.c	1
openssl/crypto/asn1/tasn_fre.c	5
openssl/engines/e_afalg.c	28
openssl/engines/e_afalg_err.c	3
openssl/crypto/provider_local.h	4
openssl/crypto/provider_child.c	4
openssl/providers/implementations/rands/crngt.c	2
openssl/crypto/evp/digest.c	18
openssl/crypto/evp/evp_fetch.c	16
openssl/crypto/core_namemap.c	22
openssl/crypto/engine/eng_fat.c	5
openssl/crypto/engine/eng_table.c	8
openssl/crypto/engine/tb_digest.c	7
openssl/crypto/engine/tb_rsa.c	4
openssl/crypto/engine/tb_dsa.c	4
openssl/crypto/engine/tb_dh.c	4
openssl/crypto/engine/tb_eckey.c	4
openssl/include/crypto/asn1.h	3
openssl/crypto/core_fetch.c	3
openssl/crypto/core_algorithm.c	4
openssl/include/openssl/core_dispatch.h	79
openssl/crypto/encode_decode/decoder_pkey.c	27
openssl/crypto/async/async_wait.c	3
openssl/crypto/async/arch/async_posix.h	1
openssl/crypto/rsa/rsa_ossl.c	1
openssl/crypto/dsa/dsa_ossl.c	1
openssl/crypto/ec/ec_kmeth.c	1
openssl/crypto/dh/dh_key.c	1
openssl/crypto/rand/rand_meth.c	1
openssl/crypto/sha/sha_local.h	1
openssl/include/crypto/md32_common.h	2
openssl/crypto/engine/eng_pkey.c	1
openssl/crypto/bio/bss_file.c	2
openssl/crypto/o_fopen.c	1
openssl/crypto/bio/bio_lib.c	16
openssl/crypto/pem/pem_pkey.c	5
openssl/crypto/bio/bf_readbuff.c	1
openssl/crypto/pem/pem_lib.c	15
openssl/crypto/evp/evp_key.c	3
openssl/crypto/ui/ui_lib.c	27
openssl/crypto/ui/ui_openssl.c	1
openssl/crypto/ui/ui_null.c	1
openssl/include/openssl/ui.h	2
openssl/crypto/err/err_prn.c	1
openssl/crypto/passphrase.c	9
openssl/crypto/encode_decode/decoder_meth.c	21
openssl/crypto/encode_decode/decoder_lib.c	27
openssl/crypto/evp/keymgmt_meth.c	19
openssl/crypto/provider.c	2
openssl/crypto/property/property_query.c	3
openssl/crypto/property/property_string.c	17
openssl/crypto/property/property_parse.c	25
openssl/crypto/encode_decode/encoder_local.h	6
openssl/crypto/evp/keymgmt_lib.c	13
openssl/crypto/evp/p_lib.c	19
openssl/include/crypto/evp.h	8
openssl/include/openssl/x509.h	1
openssl/crypto/x509/x_attrib.c	2
openssl/include/openssl/asn1t.h	2
openssl/crypto/asn1/tasn_utl.c	9
openssl/crypto/asn1/a_int.c	8
openssl/crypto/bio/bss_mem.c	3
openssl/crypto/bio/ossl_core_bio.c	3
openssl/crypto/ui/ui_util.c	8
openssl/crypto/evp/encode.c	7
openssl/crypto/evp/m_sigver.c	7
openssl/crypto/evp/signature.c	9
openssl/crypto/evp/exchange.c	2
openssl/crypto/evp/kem.c	2
openssl/crypto/evp/asymcipher.c	2
openssl/crypto/evp/ctrl_params_translate.c	10
openssl/crypto/params_from_text.c	3
openssl/crypto/bn/bn_conv.c	4
openssl/crypto/asn1/p8_pkey.c	4
openssl/crypto/buffer/buffer.c	2
openssl/crypto/asn1/tasn_new.c	9
openssl/crypto/asn1/a_bitstr.c	1
openssl/crypto/evp/evp_pkey.c	1
openssl/crypto/asn1/x_sig.c	3
openssl/crypto/pkcs12/p12_p8d.c	2
openssl/crypto/pkcs12/p12_decr.c	2
openssl/crypto/evp/evp_pbe.c	6
openssl/crypto/evp/evp_local.h	4
openssl/crypto/asn1/d2i_pr.c	1
openssl/crypto/x509/x_pubkey.c	7
openssl/crypto/engine/eng_cnf.c	5
openssl/crypto/engine/eng_all.c	1
openssl/crypto/engine/eng_ctrl.c	7
openssl/crypto/evp/evp_cnf.c	2
openssl/crypto/conf/conf_ssl.c	3
openssl/crypto/encode_decode/encoder_meth.c	3
openssl/crypto/store/store_meth.c	3
openssl/crypto/evp/e_des3.c	11
openssl/crypto/evp/e_xcbc_d.c	1
openssl/crypto/evp/e_rc4.c	2
openssl/crypto/evp/e_rc4_hmac_md5.c	1
openssl/crypto/evp/e_idea.c	4
openssl/crypto/evp/e_seed.c	4
openssl/crypto/evp/e_sm4.c	5
openssl/crypto/evp/e_rc2.c	6
openssl/crypto/evp/e_bf.c	4
openssl/crypto/evp/e_cast.c	4
openssl/crypto/evp/e_rc5.c	4
openssl/crypto/evp/e_aes.c	38
openssl/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl/crypto/evp/e_aria.c	27
openssl/crypto/evp/e_camellia.c	21
openssl/crypto/evp/e_chacha20_poly1305.c	2
openssl/crypto/err/err_all.c	1
openssl/crypto/bn/bn_err.c	1
openssl/crypto/rsa/rsa_err.c	1
openssl/crypto/dh/dh_err.c	1
openssl/crypto/evp/evp_err.c	1
openssl/crypto/buffer/buf_err.c	1
openssl/crypto/objects/obj_err.c	1
openssl/crypto/pem/pem_err.c	1
openssl/crypto/dsa/dsa_err.c	1
openssl/crypto/x509/x509_err.c	1
openssl/crypto/asn1/asn1_err.c	1
openssl/crypto/conf/conf_err.c	1
openssl/crypto/cpt_err.c	1
openssl/crypto/comp/comp_err.c	1
openssl/crypto/ec/ec_err.c	1
openssl/crypto/bio/bio_err.c	1
openssl/crypto/pkcs7/pkcs7err.c	1
openssl/crypto/x509/v3err.c	1
openssl/crypto/pkcs12/pk12err.c	1
openssl/crypto/rand/rand_err.c	1
openssl/crypto/dso/dso_err.c	1
openssl/crypto/ts/ts_err.c	1
openssl/crypto/engine/eng_err.c	1
openssl/crypto/http/http_err.c	1
openssl/crypto/ocsp/ocsp_err.c	1
openssl/crypto/ui/ui_err.c	1
openssl/crypto/cms/cms_err.c	1
openssl/crypto/crmf/crmf_err.c	1
openssl/crypto/cmp/cmp_err.c	1
openssl/crypto/ct/ct_err.c	1
openssl/crypto/ess/ess_err.c	1
openssl/crypto/async/async_err.c	1
openssl/crypto/store/store_err.c	1
openssl/crypto/property/property_err.c	1
openssl/providers/common/provider_err.c	1
openssl/crypto/property/defn_cache.c	5
openssl/crypto/bio/bss_core.c	2
openssl/providers/implementations/rands/drbg.c	2
openssl/crypto/self_test_core.c	2
openssl/crypto/thread/internal.c	2
openssl/crypto/thread/arch/thread_posix.c	4
openssl/crypto/evp/evp_rand.c	3
openssl/crypto/store/store_init.c	1
openssl/crypto/store/store_register.c	1
openssl/crypto/store/store_local.h	1
openssl/crypto/bio/bio_sock.c	1
openssl/crypto/objects/obj_xref.c	2
openssl/crypto/objects/obj_xref.h	2
openssl/crypto/cmp/cmp_util.c	1
openssl/crypto/trace.c	2
openssl/crypto/bn/bn_div.c	3
openssl/crypto/bn/bn_ctx.c	7
openssl/crypto/bn/bn_mul.c	6
openssl/crypto/bn/bn_add.c	3
openssl/crypto/bn/bn_print.c	2

Fuzzer: x509_30

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4569	61.1%
gold	[1:9]	983	13.1%
yellow	[10:29]	275	3.67%
greenyellow	[30:49]	45	0.60%
lawngreen	50+	1604	21.4%
All colors	7476	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
11909	17885	10 : View List ['ossl_assert_int.33564', 'evp_keymgmt_util_clear_operation_cache', 'evp_keymgmt_util_cache_keydata', 'CRYPTO_THREAD_read_lock', 'evp_keymgmt_util_find_operation_cache', 'evp_keymgmt_freedata', 'match_type', 'CRYPTO_THREAD_unlock', 'evp_keymgmt_util_export', 'CRYPTO_THREAD_write_lock']	11909	17885	evp_keymgmt_util_export_to_provider	call site: 02887	/src/openssl/crypto/evp/keymgmt_lib.c:117
9914	9914	2 : View List ['ec_GF2m_simple_oct2point', 'ec_GFp_simple_oct2point']	9914	9914	EC_POINT_oct2point	call site: 00000	/src/openssl111/crypto/ec/ec_oct.c:113
9386	9386	2 : View List ['conf_diagnostics', 'CONF_modules_load']	9386	16308	CONF_modules_load_file_ex	call site: 03646	/src/openssl/crypto/conf/conf_mod.c:206
8805	8805	2 : View List ['ec_GF2m_simple_set_compressed_coordinates', 'ec_GFp_simple_set_compressed_coordinates']	8805	8805	EC_POINT_set_compressed_coordinates	call site: 00000	/src/openssl111/crypto/ec/ec_oct.c:32
6213	6213	1 : View List ['ec_param_explicit_to_text']	6213	6213	ec_param_to_text	call site: 00000	/src/openssl/providers/implementations/encode_decode/encode_key2text.c:472
5960	5960	1 : View List ['ossl_dh_key2buf']	5960	18059	dh_get_params	call site: 00000	/src/openssl/providers/implementations/keymgmt/dh_kmgmt.c:328
5937	5937	1 : View List ['OSSL_PARAM_BLD_push_int']	5937	5937	ossl_param_build_set_int	call site: 00000	/src/openssl/crypto/param_build_set.c:25
5936	5936	1 : View List ['OSSL_PARAM_BLD_push_utf8_string']	5936	5936	ossl_param_build_set_utf8_string	call site: 00000	/src/openssl/crypto/param_build_set.c:47
5935	5935	1 : View List ['OSSL_PARAM_BLD_push_octet_string']	5935	5935	ossl_param_build_set_octet_string	call site: 00000	/src/openssl/crypto/param_build_set.c:60
5933	5933	1 : View List ['ossl_property_merge']	5933	6001	ossl_method_store_fetch	call site: 00000	/src/openssl/crypto/property/property.c:526
5933	5933	1 : View List ['OSSL_PARAM_set_utf8_string']	5933	5933	ossl_param_build_set_utf8_string	call site: 00000	/src/openssl/crypto/param_build_set.c:50
5933	5933	1 : View List ['OSSL_PARAM_set_octet_string']	5933	5933	ossl_param_build_set_octet_string	call site: 00000	/src/openssl/crypto/param_build_set.c:64

Runtime coverage analysis

Covered functions

2681

Functions that are reachable but not covered

1020

Reachable functions

2371

Percentage of reachable functions covered

56.98%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl30/fuzz/driver.c	1
openssl30/fuzz/x509.c	2
openssl30/crypto/x509/x_x509.c	7
openssl30/crypto/asn1/tasn_dec.c	14
openssl30/crypto/err/err_blocks.c	2
openssl30/crypto/err/err.c	31
openssl30/crypto/init.c	39
openssl30/crypto/err/err_local.h	5
openssl30/crypto/mem.c	7
openssl30/crypto/threads_pthread.c	13
openssl30/crypto/cpuid.c	4
openssl30/crypto/ctype.c	5
openssl30/crypto/initthread.c	21
openssl30/crypto/stack/stack.c	21
openssl30/crypto/comp/c_zlib.c	1
openssl30/crypto/async/async.c	6
openssl30/crypto/rand/rand_lib.c	10
openssl30/providers/implementations/rands/seeding/rand_unix.c	4
openssl30/crypto/engine/eng_init.c	4
openssl30/crypto/cryptlib.c	2
openssl30/crypto/engine/eng_lib.c	21
openssl30/include/internal/refcount.h	2
openssl30/crypto/engine/tb_pkmeth.c	7
openssl30/crypto/evp/pmeth_lib.c	35
openssl30/crypto/engine/tb_asnmth.c	9
openssl30/crypto/asn1/ameth_lib.c	9
openssl30/crypto/engine/eng_list.c	10
openssl30/crypto/ex_data.c	14
openssl30/crypto/context.c	17
openssl30/include/internal/cryptlib.h	8
openssl30/include/openssl/crypto.h	2
openssl30/crypto/property/property_parse.c	25
openssl30/crypto/property/property_string.c	12
openssl30/crypto/lhash/lhash.c	12
openssl30/crypto/evp/evp_rand.c	3
openssl30/crypto/provider_core.c	43
openssl30/crypto/err/err_all.c	1
openssl30/include/openssl/err.h	4
openssl30/crypto/bn/bn_err.c	1
openssl30/crypto/rsa/rsa_err.c	1
openssl30/crypto/dh/dh_err.c	1
openssl30/crypto/evp/evp_err.c	1
openssl30/crypto/buffer/buf_err.c	1
openssl30/crypto/objects/obj_err.c	1
openssl30/crypto/pem/pem_err.c	1
openssl30/crypto/dsa/dsa_err.c	1
openssl30/crypto/x509/x509_err.c	1
openssl30/crypto/asn1/asn1_err.c	1
openssl30/crypto/conf/conf_err.c	1
openssl30/crypto/cpt_err.c	1
openssl30/crypto/comp/comp_err.c	1
openssl30/crypto/ec/ec_err.c	1
openssl30/crypto/bio/bio_err.c	1
openssl30/crypto/pkcs7/pkcs7err.c	1
openssl30/crypto/x509/v3err.c	1
openssl30/crypto/pkcs12/pk12err.c	1
openssl30/crypto/rand/rand_err.c	1
openssl30/crypto/dso/dso_err.c	1
openssl30/crypto/ts/ts_err.c	1
openssl30/crypto/engine/eng_err.c	1
openssl30/crypto/http/http_err.c	1
openssl30/crypto/ocsp/ocsp_err.c	1
openssl30/crypto/ui/ui_err.c	1
openssl30/crypto/cms/cms_err.c	1
openssl30/crypto/crmf/crmf_err.c	1
openssl30/crypto/cmp/cmp_err.c	1
openssl30/crypto/ct/ct_err.c	1
openssl30/crypto/ess/ess_err.c	1
openssl30/crypto/async/async_err.c	1
openssl30/crypto/store/store_err.c	1
openssl30/crypto/property/property_err.c	1
openssl30/providers/common/provider_err.c	1
openssl30/crypto/evp/c_allc.c	1
openssl30/crypto/evp/e_des.c	6
openssl30/crypto/evp/names.c	9
openssl30/crypto/objects/obj_dat.c	24
openssl30/crypto/evp/c_alld.c	1
openssl30/crypto/evp/legacy_md4.c	1
openssl30/crypto/objects/obj_local.h	18
openssl30/crypto/objects/o_names.c	12
openssl30/crypto/conf/conf_sap.c	2
openssl30/crypto/conf/conf_mod.c	33
openssl30/crypto/engine/eng_openssl.c	20
openssl30/crypto/evp/evp_lib.c	41
openssl30/crypto/dso/dso_lib.c	9
openssl30/crypto/provider_local.h	4
openssl30/crypto/provider_child.c	2
openssl30/crypto/evp/cmeth_lib.c	8
openssl30/crypto/evp/evp_enc.c	24
openssl30/crypto/rsa/rsa_ossl.c	1
openssl30/crypto/engine/tb_rsa.c	4
openssl30/crypto/dsa/dsa_ossl.c	1
openssl30/crypto/engine/tb_dsa.c	4
openssl30/crypto/ec/ec_kmeth.c	1
openssl30/crypto/engine/tb_eckey.c	4
openssl30/crypto/dh/dh_key.c	1
openssl30/crypto/engine/tb_dh.c	4
openssl30/crypto/rand/rand_meth.c	1
openssl30/crypto/engine/tb_rand.c	4
openssl30/crypto/engine/tb_cipher.c	7
openssl30/crypto/params.c	47
openssl30/crypto/evp/evp_utils.c	5
openssl30/crypto/engine/tb_digest.c	7
openssl30/crypto/evp/digest.c	20
openssl30/crypto/sha/sha_local.h	1
openssl30/include/crypto/md32_common.h	2
openssl30/crypto/engine/eng_pkey.c	1
openssl30/crypto/bio/bss_file.c	2
openssl30/crypto/o_fopen.c	1
openssl30/crypto/bio/bio_lib.c	17
openssl30/crypto/pem/pem_pkey.c	5
openssl30/crypto/bio/bf_readbuff.c	1
openssl30/crypto/pem/pem_lib.c	15
openssl30/crypto/evp/evp_key.c	3
openssl30/crypto/ui/ui_lib.c	27
openssl30/crypto/ui/ui_openssl.c	1
openssl30/crypto/ui/ui_null.c	1
openssl30/include/openssl/ui.h	2
openssl30/crypto/err/err_prn.c	2
openssl30/crypto/o_str.c	12
openssl30/crypto/bio/bio_print.c	11
openssl30/crypto/passphrase.c	10
openssl30/crypto/encode_decode/decoder_pkey.c	13
openssl30/crypto/encode_decode/decoder_meth.c	16
openssl30/crypto/encode_decode/decoder_lib.c	23
openssl30/crypto/evp/keymgmt_meth.c	23
openssl30/crypto/evp/evp_fetch.c	16
openssl30/crypto/core_namemap.c	19
openssl30/crypto/engine/eng_rdrand.c	4
openssl30/crypto/engine/eng_local.h	14
openssl30/crypto/engine/eng_dyn.c	12
openssl30/include/openssl/safestack.h	4
openssl30/crypto/dso/dso_dlfcn.c	1
openssl30/engines/e_padlock.c	22
openssl30/crypto/asn1/evp_asn1.c	1
openssl30/crypto/asn1/tasn_typ.c	17
openssl30/crypto/asn1/asn1_lib.c	15
openssl30/crypto/asn1/a_octet.c	2
openssl30/crypto/asn1/a_type.c	3
openssl30/crypto/asn1/tasn_fre.c	5
openssl30/crypto/asn1/a_object.c	7
openssl30/engines/e_afalg.c	27
openssl30/engines/e_afalg_err.c	3
openssl30/crypto/engine/eng_fat.c	5
openssl30/crypto/engine/eng_table.c	8
openssl30/crypto/async/async_wait.c	3
openssl30/crypto/async/arch/async_posix.h	1
openssl30/crypto/bsearch.c	1
openssl30/crypto/bn/bn_word.c	4
openssl30/crypto/bn/bn_lib.c	24
openssl30/crypto/bn/bn_local.h	1
openssl30/crypto/mem_sec.c	18
openssl30/crypto/bn/bn_shift.c	2
openssl30/crypto/bn/bn_conv.c	4
openssl30/include/internal/constant_time.h	4
openssl30/crypto/bn/asm/x86_64-gcc.c	2
openssl30/include/crypto/asn1.h	3
openssl30/crypto/property/property.c	25
openssl30/crypto/sparse_array.c	1
openssl30/crypto/core_fetch.c	3
openssl30/crypto/core_algorithm.c	4
openssl30/crypto/getenv.c	1
openssl30/include/openssl/core_dispatch.h	81
openssl30/crypto/provider.c	2
openssl30/crypto/property/property_query.c	3
openssl30/crypto/encode_decode/encoder_local.h	10
openssl30/crypto/evp/keymgmt_lib.c	16
openssl30/crypto/evp/p_lib.c	36
openssl30/include/crypto/evp.h	8
openssl30/include/openssl/x509.h	8
openssl30/crypto/x509/x_attrib.c	2
openssl30/include/openssl/asn1t.h	2
openssl30/crypto/asn1/tasn_utl.c	13
openssl30/crypto/asn1/a_int.c	15
openssl30/crypto/bio/bss_mem.c	3
openssl30/crypto/bio/ossl_core_bio.c	3
openssl30/crypto/ui/ui_util.c	8
openssl30/crypto/evp/encode.c	7
openssl30/crypto/evp/legacy_md5.c	1
openssl30/crypto/evp/m_sigver.c	9
openssl30/crypto/evp/signature.c	11
openssl30/crypto/evp/exchange.c	3
openssl30/crypto/evp/kem.c	3
openssl30/crypto/evp/asymcipher.c	3
openssl30/crypto/evp/ctrl_params_translate.c	13
openssl30/crypto/params_from_text.c	3
openssl30/crypto/asn1/p8_pkey.c	4
openssl30/crypto/evp/evp_pkey.c	1
openssl30/crypto/asn1/x_sig.c	3
openssl30/crypto/pkcs12/p12_p8d.c	2
openssl30/crypto/pkcs12/p12_decr.c	2
openssl30/crypto/evp/evp_pbe.c	6
openssl30/crypto/evp/evp_local.h	3
openssl30/crypto/asn1/d2i_pr.c	1
openssl30/crypto/x509/x_pubkey.c	10
openssl30/crypto/x509/x509_def.c	1
openssl30/crypto/conf/conf_lib.c	10
openssl30/crypto/conf/conf_def.c	1
openssl30/crypto/conf/conf_api.c	3
openssl30/include/openssl/conf.h	3
openssl30/crypto/conf/conf_mall.c	1
openssl30/crypto/asn1/asn_moid.c	3
openssl30/crypto/objects/obj_lib.c	2
openssl30/crypto/asn1/asn_mstbl.c	3
openssl30/crypto/x509/v3_utl.c	18
openssl30/crypto/asn1/asn1_gen.c	3
openssl30/crypto/asn1/a_strnid.c	6
openssl30/include/openssl/asn1.h	5
openssl30/crypto/engine/eng_cnf.c	5
openssl30/crypto/engine/eng_all.c	1
openssl30/crypto/engine/eng_ctrl.c	7
openssl30/crypto/evp/evp_cnf.c	2
openssl30/crypto/conf/conf_ssl.c	3
openssl30/crypto/provider_conf.c	10
openssl30/crypto/encode_decode/encoder_meth.c	18
openssl30/crypto/store/store_meth.c	3
openssl30/crypto/evp/legacy_md5_sha1.c	1
openssl30/crypto/evp/legacy_sha.c	13
openssl30/crypto/evp/legacy_mdc2.c	1
openssl30/crypto/evp/legacy_ripemd.c	1
openssl30/crypto/evp/legacy_wp.c	1
openssl30/crypto/sm3/legacy_sm3.c	1
openssl30/crypto/evp/legacy_blake2.c	2
openssl30/crypto/evp/e_des3.c	11
openssl30/crypto/evp/e_xcbc_d.c	1
openssl30/crypto/evp/e_rc4.c	2
openssl30/crypto/evp/e_rc4_hmac_md5.c	1
openssl30/crypto/evp/e_idea.c	4
openssl30/crypto/evp/e_seed.c	4
openssl30/crypto/evp/e_sm4.c	5
openssl30/crypto/evp/e_rc2.c	6
openssl30/crypto/evp/e_bf.c	4
openssl30/crypto/evp/e_cast.c	4
openssl30/crypto/evp/e_rc5.c	4
openssl30/crypto/evp/e_aes.c	38
openssl30/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl30/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl30/crypto/evp/e_aria.c	27
openssl30/crypto/evp/e_camellia.c	21
openssl30/crypto/evp/e_chacha20_poly1305.c	2
openssl30/crypto/store/store_init.c	1
openssl30/crypto/store/store_register.c	1
openssl30/crypto/store/store_local.h	1
openssl30/crypto/bio/bio_sock.c	1
openssl30/crypto/objects/obj_xref.c	5
openssl30/crypto/objects/obj_xref.h	4
openssl30/crypto/cmp/cmp_util.c	1
openssl30/crypto/trace.c	2
openssl30/crypto/buffer/buffer.c	5
openssl30/crypto/asn1/tasn_new.c	9
openssl30/crypto/asn1/a_bitstr.c	2
openssl30/crypto/bio/bss_null.c	1
openssl30/crypto/x509/t_x509.c	5
openssl30/crypto/x509/x509_set.c	12
openssl30/crypto/x509/x509_cmp.c	19
openssl30/crypto/bio/bio_dump.c	4
openssl30/crypto/asn1/a_strex.c	9
openssl30/crypto/x509/x_name.c	8
openssl30/crypto/x509/x509_obj.c	1
openssl30/crypto/x509/x509name.c	9
openssl30/crypto/asn1/asn1_parse.c	4
openssl30/crypto/asn1/tasn_enc.c	8
openssl30/crypto/asn1/asn1_local.h	3
openssl30/crypto/asn1/a_utf8.c	2
openssl30/include/internal/unicode.h	1
openssl30/crypto/asn1/a_time.c	12
openssl30/crypto/o_time.c	6
openssl30/crypto/bio/bf_prefix.c	1
openssl30/crypto/encode_decode/encoder_pkey.c	7
openssl30/crypto/encode_decode/encoder_lib.c	17
openssl30/crypto/x509/v3_prn.c	4
openssl30/crypto/x509/x509_v3.c	7
openssl30/crypto/x509/v3_lib.c	6
openssl30/include/openssl/x509v3.h	18
openssl30/crypto/asn1/a_print.c	1
openssl30/crypto/x509/x_x509a.c	5
openssl30/crypto/x509/x_crl.c	5
openssl30/crypto/ocsp/ocsp_asn.c	10
openssl30/crypto/x509/x509_lu.c	16
openssl30/include/openssl/x509_vfy.h	9
openssl30/crypto/x509/x509_vpm.c	15
openssl30/crypto/x509/x509cset.c	4
openssl30/crypto/x509/v3_purp.c	18
openssl30/crypto/x509/x_all.c	4
openssl30/crypto/asn1/a_digest.c	2
openssl30/crypto/x509/x509_ext.c	6
openssl30/crypto/x509/v3_bcons.c	2
openssl30/crypto/x509/v3_pcia.c	2
openssl30/crypto/x509/v3_crld.c	1
openssl30/crypto/asn1/a_dup.c	1
openssl30/crypto/x509/x509_vfy.c	69
openssl30/crypto/x509/pcy_tree.c	14
openssl30/crypto/x509/pcy_node.c	7
openssl30/crypto/x509/pcy_local.h	7
openssl30/crypto/x509/pcy_data.c	2
openssl30/crypto/x509/v3_cpols.c	2
openssl30/crypto/asn1/x_algor.c	4
openssl30/crypto/asn1/a_verify.c	2
openssl30/crypto/rsa/rsa_ameth.c	3
openssl30/crypto/rsa/rsa_backend.c	2
openssl30/crypto/rsa/rsa_asn1.c	2
openssl30/crypto/asn1/asn_pack.c	1
openssl30/crypto/rsa/rsa_pss.c	3
openssl30/crypto/rsa/rsa_lib.c	4
openssl30/crypto/asn1/a_utctm.c	1
openssl30/crypto/asn1/a_gentm.c	1
openssl30/crypto/x509/v3_genn.c	5
openssl30/crypto/x509/pcy_cache.c	6
openssl30/crypto/x509/pcy_map.c	1
openssl30/crypto/x509/v3_pmaps.c	2
openssl30/crypto/x509/v3_pcons.c	2
openssl30/crypto/x509/pcy_lib.c	1
openssl30/include/internal/dane.h	2
openssl30/crypto/asn1/a_mbstr.c	7
openssl30/crypto/x509/x509_trust.c	5
openssl30/crypto/x509/v3_ncons.c	15
openssl30/crypto/punycode.c	6
openssl30/crypto/x509/v3_asid.c	6
openssl30/crypto/x509/v3_addr.c	10
openssl30/crypto/ocsp/ocsp_cl.c	5
openssl30/crypto/ocsp/ocsp_vfy.c	9
openssl30/crypto/x509/x509_txt.c	1
openssl30/include/openssl/ocsp.h	1
openssl30/crypto/ocsp/ocsp_lib.c	4

Fuzzer: bignum

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5227	87.3%
gold	[1:9]	270	4.51%
yellow	[10:29]	10	0.16%
greenyellow	[30:49]	2	0.03%
lawngreen	50+	477	7.96%
All colors	5986	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
17774	17774	3 : View List ['ERR_set_error', 'ERR_new', 'ERR_set_debug']	17774	17774	do_init_module_list_lock	call site: 00480	/src/openssl/crypto/conf/conf_mod.c:102
6928	45323	9 : View List ['BN_is_word', 'BN_mul_word', 'BN_add', 'BN_lshift', 'BN_div', 'BN_num_bits', 'BN_lshift1', 'BN_mul', 'BN_set_word']	6928	73297	int_bn_mod_inverse	call site: 05572	/src/openssl111/crypto/bn/bn_gcd.c:260
3729	3729	1 : View List ['bn_mod_inverse_no_branch']	3729	3729	int_bn_mod_inverse	call site: 05413	/src/openssl111/crypto/bn/bn_gcd.c:213
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_usub	call site: 05543	/src/openssl111/crypto/bn/bn_add.c:138
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_div	call site: 05431	/src/openssl111/crypto/bn/bn_div.c:224
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_MONT_CTX_new	call site: 05386	/src/openssl111/crypto/bn/bn_mont.c:232
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_lshift	call site: 00674	/src/openssl111/crypto/bn/bn_shift.c:85
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_rshift	call site: 05580	/src/openssl111/crypto/bn/bn_shift.c:154
6	6	1 : View List ['bn_mul_comba4']	6	18	bn_mul_recursive	call site: 05506	/src/openssl111/crypto/bn/bn_mul.c:244
0	3556	1 : View List ['BN_sqr']	0	7110	BN_mod_mul	call site: 05942	/src/openssl111/crypto/bn/bn_mod.c:206
0	3463	2 : View List ['BN_is_zero', 'BN_sub_word']	0	3463	BN_add_word	call site: 00656	/src/openssl111/crypto/bn/bn_word.c:113
0	3461	1 : View List ['BN_add_word']	0	3461	BN_sub_word	call site: 00660	/src/openssl111/crypto/bn/bn_word.c:152

Runtime coverage analysis

Covered functions

274

Functions that are reachable but not covered

1273

Reachable functions

1545

Percentage of reachable functions covered

17.61%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl/fuzz/driver.c	1
openssl/fuzz/bignum.c	1
openssl/crypto/bn/bn_lib.c	43
openssl/crypto/mem.c	6
openssl/crypto/err/err_blocks.c	4
openssl/crypto/err/err.c	30
openssl/crypto/init.c	40
openssl/crypto/err/err_local.h	6
openssl/crypto/threads_pthread.c	14
openssl/crypto/cpuid.c	4
openssl/crypto/ctype.c	3
openssl/crypto/initthread.c	21
openssl/crypto/stack/stack.c	19
openssl/crypto/err/err_save.c	1
openssl/crypto/comp/c_zlib.c	1
openssl/crypto/comp/c_brotli.c	1
openssl/crypto/comp/c_zstd.c	1
openssl/crypto/async/async.c	6
openssl/crypto/async/arch/async_posix.c	2
openssl/crypto/rand/rand_lib.c	11
openssl/providers/implementations/rands/seeding/rand_unix.c	4
openssl/crypto/engine/eng_init.c	4
openssl/crypto/cryptlib.c	2
openssl/crypto/engine/eng_lib.c	21
openssl/include/internal/refcount.h	4
openssl/crypto/engine/tb_pkmeth.c	7
openssl/crypto/evp/pmeth_lib.c	31
openssl/crypto/engine/tb_asnmth.c	8
openssl/crypto/asn1/ameth_lib.c	9
openssl/crypto/engine/eng_list.c	10
openssl/crypto/ex_data.c	12
openssl/crypto/context.c	16
openssl/crypto/property/property.c	29
openssl/crypto/sparse_array.c	1
openssl/crypto/provider_conf.c	14
openssl/crypto/evp/c_allc.c	1
openssl/crypto/evp/e_des.c	6
openssl/crypto/evp/names.c	9
openssl/crypto/objects/obj_dat.c	29
openssl/crypto/evp/c_alld.c	1
openssl/crypto/evp/legacy_md4.c	1
openssl/crypto/objects/o_names.c	12
openssl/crypto/objects/obj_local.h	18
openssl/crypto/lhash/lhash.c	13
openssl/crypto/evp/legacy_md5.c	1
openssl/crypto/evp/legacy_md5_sha1.c	1
openssl/crypto/evp/legacy_sha.c	13
openssl/crypto/evp/legacy_mdc2.c	1
openssl/crypto/evp/legacy_ripemd.c	1
openssl/crypto/evp/legacy_wp.c	1
openssl/crypto/sm3/legacy_sm3.c	1
openssl/crypto/evp/legacy_blake2.c	2
openssl/crypto/conf/conf_sap.c	2
openssl/crypto/conf/conf_mod.c	33
openssl/crypto/err/err_mark.c	3
openssl/crypto/getenv.c	1
openssl/crypto/o_str.c	14
openssl/crypto/x509/x509_def.c	1
openssl/crypto/bio/bio_print.c	9
openssl/include/internal/common.h	1
openssl/crypto/conf/conf_lib.c	10
openssl/crypto/conf/conf_def.c	1
openssl/include/openssl/err.h	4
openssl/crypto/conf/conf_api.c	3
openssl/include/openssl/conf.h	3
openssl/crypto/conf/conf_mall.c	1
openssl/crypto/asn1/asn_moid.c	3
openssl/crypto/bsearch.c	1
openssl/crypto/asn1/a_object.c	6
openssl/crypto/bn/bn_local.h	1
openssl/crypto/mem_sec.c	18
openssl/crypto/bn/bn_word.c	4
openssl/crypto/bn/asm/x86_64-gcc.c	10
openssl/crypto/bn/bn_shift.c	6
openssl/crypto/asn1/asn1_lib.c	13
openssl/crypto/objects/obj_lib.c	1
openssl/crypto/asn1/asn_mstbl.c	3
openssl/crypto/x509/v3_utl.c	6
openssl/crypto/asn1/asn1_gen.c	3
openssl/crypto/asn1/tasn_dec.c	14
openssl/crypto/asn1/a_strnid.c	6
openssl/include/openssl/asn1.h	3
openssl/crypto/engine/eng_openssl.c	20
openssl/include/internal/cryptlib.h	7
openssl/include/openssl/crypto.h	2
openssl/crypto/evp/evp_lib.c	37
openssl/crypto/provider_core.c	49
openssl/crypto/engine/eng_rdrand.c	4
openssl/crypto/engine/tb_rand.c	4
openssl/crypto/engine/eng_local.h	14
openssl/crypto/engine/eng_dyn.c	12
openssl/crypto/dso/dso_lib.c	9
openssl/include/openssl/safestack.h	4
openssl/crypto/dso/dso_dlfcn.c	1
openssl/engines/e_padlock.c	22
openssl/crypto/engine/tb_cipher.c	7
openssl/crypto/evp/cmeth_lib.c	8
openssl/crypto/evp/evp_enc.c	26
openssl/crypto/params.c	48
openssl/crypto/evp/evp_utils.c	5
openssl/crypto/asn1/evp_asn1.c	1
openssl/crypto/asn1/tasn_typ.c	9
openssl/crypto/asn1/a_octet.c	1
openssl/crypto/asn1/a_type.c	1
openssl/crypto/asn1/tasn_fre.c	5
openssl/engines/e_afalg.c	28
openssl/engines/e_afalg_err.c	3
openssl/crypto/provider_local.h	4
openssl/crypto/provider_child.c	4
openssl/providers/implementations/rands/crngt.c	2
openssl/crypto/evp/digest.c	18
openssl/crypto/evp/evp_fetch.c	16
openssl/crypto/core_namemap.c	22
openssl/crypto/engine/eng_fat.c	5
openssl/crypto/engine/eng_table.c	8
openssl/crypto/engine/tb_digest.c	7
openssl/crypto/engine/tb_rsa.c	4
openssl/crypto/engine/tb_dsa.c	4
openssl/crypto/engine/tb_dh.c	4
openssl/crypto/engine/tb_eckey.c	4
openssl/include/crypto/asn1.h	3
openssl/crypto/core_fetch.c	3
openssl/crypto/core_algorithm.c	4
openssl/include/openssl/core_dispatch.h	79
openssl/crypto/encode_decode/decoder_pkey.c	27
openssl/crypto/async/async_wait.c	3
openssl/crypto/async/arch/async_posix.h	1
openssl/crypto/rsa/rsa_ossl.c	1
openssl/crypto/dsa/dsa_ossl.c	1
openssl/crypto/ec/ec_kmeth.c	1
openssl/crypto/dh/dh_key.c	1
openssl/crypto/rand/rand_meth.c	1
openssl/crypto/sha/sha_local.h	1
openssl/include/crypto/md32_common.h	2
openssl/crypto/engine/eng_pkey.c	1
openssl/crypto/bio/bss_file.c	2
openssl/crypto/o_fopen.c	1
openssl/crypto/bio/bio_lib.c	16
openssl/crypto/pem/pem_pkey.c	5
openssl/crypto/bio/bf_readbuff.c	1
openssl/crypto/pem/pem_lib.c	15
openssl/crypto/evp/evp_key.c	3
openssl/crypto/ui/ui_lib.c	27
openssl/crypto/ui/ui_openssl.c	1
openssl/crypto/ui/ui_null.c	1
openssl/include/openssl/ui.h	2
openssl/crypto/err/err_prn.c	1
openssl/crypto/passphrase.c	9
openssl/crypto/encode_decode/decoder_meth.c	21
openssl/crypto/encode_decode/decoder_lib.c	27
openssl/crypto/evp/keymgmt_meth.c	19
openssl/crypto/provider.c	2
openssl/crypto/property/property_query.c	3
openssl/crypto/property/property_string.c	17
openssl/crypto/property/property_parse.c	25
openssl/crypto/encode_decode/encoder_local.h	6
openssl/crypto/evp/keymgmt_lib.c	13
openssl/crypto/evp/p_lib.c	19
openssl/include/crypto/evp.h	8
openssl/include/openssl/x509.h	1
openssl/crypto/x509/x_attrib.c	2
openssl/include/openssl/asn1t.h	2
openssl/crypto/asn1/tasn_utl.c	9
openssl/crypto/asn1/a_int.c	8
openssl/crypto/bio/bss_mem.c	3
openssl/crypto/bio/ossl_core_bio.c	3
openssl/crypto/ui/ui_util.c	8
openssl/crypto/evp/encode.c	7
openssl/crypto/evp/m_sigver.c	7
openssl/crypto/evp/signature.c	9
openssl/crypto/evp/exchange.c	2
openssl/crypto/evp/kem.c	2
openssl/crypto/evp/asymcipher.c	2
openssl/crypto/evp/ctrl_params_translate.c	10
openssl/crypto/params_from_text.c	3
openssl/crypto/bn/bn_conv.c	4
openssl/crypto/asn1/p8_pkey.c	4
openssl/crypto/buffer/buffer.c	2
openssl/crypto/asn1/tasn_new.c	9
openssl/crypto/asn1/a_bitstr.c	1
openssl/crypto/evp/evp_pkey.c	1
openssl/crypto/asn1/x_sig.c	3
openssl/crypto/pkcs12/p12_p8d.c	2
openssl/crypto/pkcs12/p12_decr.c	2
openssl/crypto/evp/evp_pbe.c	6
openssl/crypto/evp/evp_local.h	4
openssl/crypto/asn1/d2i_pr.c	1
openssl/crypto/x509/x_pubkey.c	7
openssl/crypto/engine/eng_cnf.c	5
openssl/crypto/engine/eng_all.c	1
openssl/crypto/engine/eng_ctrl.c	7
openssl/crypto/evp/evp_cnf.c	2
openssl/crypto/conf/conf_ssl.c	3
openssl/crypto/encode_decode/encoder_meth.c	3
openssl/crypto/store/store_meth.c	3
openssl/crypto/evp/e_des3.c	11
openssl/crypto/evp/e_xcbc_d.c	1
openssl/crypto/evp/e_rc4.c	2
openssl/crypto/evp/e_rc4_hmac_md5.c	1
openssl/crypto/evp/e_idea.c	4
openssl/crypto/evp/e_seed.c	4
openssl/crypto/evp/e_sm4.c	5
openssl/crypto/evp/e_rc2.c	6
openssl/crypto/evp/e_bf.c	4
openssl/crypto/evp/e_cast.c	4
openssl/crypto/evp/e_rc5.c	4
openssl/crypto/evp/e_aes.c	38
openssl/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl/crypto/evp/e_aria.c	27
openssl/crypto/evp/e_camellia.c	21
openssl/crypto/evp/e_chacha20_poly1305.c	2
openssl/crypto/err/err_all.c	1
openssl/crypto/bn/bn_err.c	1
openssl/crypto/rsa/rsa_err.c	1
openssl/crypto/dh/dh_err.c	1
openssl/crypto/evp/evp_err.c	1
openssl/crypto/buffer/buf_err.c	1
openssl/crypto/objects/obj_err.c	1
openssl/crypto/pem/pem_err.c	1
openssl/crypto/dsa/dsa_err.c	1
openssl/crypto/x509/x509_err.c	1
openssl/crypto/asn1/asn1_err.c	1
openssl/crypto/conf/conf_err.c	1
openssl/crypto/cpt_err.c	1
openssl/crypto/comp/comp_err.c	1
openssl/crypto/ec/ec_err.c	1
openssl/crypto/bio/bio_err.c	1
openssl/crypto/pkcs7/pkcs7err.c	1
openssl/crypto/x509/v3err.c	1
openssl/crypto/pkcs12/pk12err.c	1
openssl/crypto/rand/rand_err.c	1
openssl/crypto/dso/dso_err.c	1
openssl/crypto/ts/ts_err.c	1
openssl/crypto/engine/eng_err.c	1
openssl/crypto/http/http_err.c	1
openssl/crypto/ocsp/ocsp_err.c	1
openssl/crypto/ui/ui_err.c	1
openssl/crypto/cms/cms_err.c	1
openssl/crypto/crmf/crmf_err.c	1
openssl/crypto/cmp/cmp_err.c	1
openssl/crypto/ct/ct_err.c	1
openssl/crypto/ess/ess_err.c	1
openssl/crypto/async/async_err.c	1
openssl/crypto/store/store_err.c	1
openssl/crypto/property/property_err.c	1
openssl/providers/common/provider_err.c	1
openssl/crypto/property/defn_cache.c	5
openssl/crypto/bio/bss_core.c	2
openssl/providers/implementations/rands/drbg.c	2
openssl/crypto/self_test_core.c	2
openssl/crypto/thread/internal.c	2
openssl/crypto/thread/arch/thread_posix.c	4
openssl/crypto/evp/evp_rand.c	3
openssl/crypto/store/store_init.c	1
openssl/crypto/store/store_register.c	1
openssl/crypto/store/store_local.h	1
openssl/crypto/bio/bio_sock.c	1
openssl/crypto/objects/obj_xref.c	2
openssl/crypto/objects/obj_xref.h	2
openssl/crypto/cmp/cmp_util.c	1
openssl/crypto/trace.c	2
openssl/crypto/bn/bn_ctx.c	14
openssl/crypto/bn/bn_exp.c	9
openssl/crypto/bn/bn_mont.c	10
openssl/crypto/bn/bn_gcd.c	3
openssl/crypto/bn/bn_mod.c	2
openssl/crypto/bn/bn_div.c	3
openssl/crypto/bn/bn_mul.c	6
openssl/crypto/bn/bn_add.c	4
openssl/crypto/bn/bn_sqr.c	4
openssl/crypto/bn/rsaz_exp.c	2
openssl/crypto/bn/rsaz_exp.h	2
openssl/include/internal/constant_time.h	6
openssl/crypto/bn/bn_recp.c	6
openssl/crypto/bn/bn_print.c	2

Fuzzer: bignum_30

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4812	85.0%
gold	[1:9]	341	6.02%
yellow	[10:29]	34	0.60%
greenyellow	[30:49]	6	0.10%
lawngreen	50+	467	8.25%
All colors	5660	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
17774	17774	3 : View List ['ERR_set_error', 'ERR_new', 'ERR_set_debug']	17774	17774	do_init_module_list_lock	call site: 03883	/src/openssl/crypto/conf/conf_mod.c:102
6928	45323	9 : View List ['BN_is_word', 'BN_mul_word', 'BN_add', 'BN_lshift', 'BN_div', 'BN_num_bits', 'BN_lshift1', 'BN_mul', 'BN_set_word']	6928	73297	int_bn_mod_inverse	call site: 05252	/src/openssl111/crypto/bn/bn_gcd.c:260
3729	3729	1 : View List ['bn_mod_inverse_no_branch']	3729	3729	int_bn_mod_inverse	call site: 05098	/src/openssl111/crypto/bn/bn_gcd.c:213
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_usub	call site: 05226	/src/openssl111/crypto/bn/bn_add.c:138
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_CTX_get	call site: 05069	/src/openssl111/crypto/bn/bn_ctx.c:221
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_div	call site: 05115	/src/openssl111/crypto/bn/bn_div.c:224
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_MONT_CTX_new	call site: 05076	/src/openssl111/crypto/bn/bn_mont.c:232
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_lshift	call site: 01687	/src/openssl111/crypto/bn/bn_shift.c:85
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_rshift	call site: 05258	/src/openssl111/crypto/bn/bn_shift.c:154
3452	3452	1 : View List ['sk_ENGINE_CLEANUP_ITEM_new_null']	3452	3452	int_cleanup_check	call site: 00978	/src/openssl111/crypto/engine/eng_lib.c:118
6	6	1 : View List ['bn_mul_comba4']	6	18	bn_mul_recursive	call site: 05190	/src/openssl111/crypto/bn/bn_mul.c:244
2	2	1 : View List ['BN_set_flags']	2	38611	BN_MONT_CTX_set	call site: 05088	/src/openssl111/crypto/bn/bn_mont.c:291

Runtime coverage analysis

Covered functions

320

Functions that are reachable but not covered

1111

Reachable functions

1422

Percentage of reachable functions covered

21.87%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl30/fuzz/driver.c	1
openssl30/fuzz/bignum.c	1
openssl30/crypto/bn/bn_lib.c	39
openssl30/crypto/mem.c	7
openssl30/crypto/err/err_blocks.c	2
openssl30/crypto/err/err.c	31
openssl30/crypto/init.c	39
openssl30/crypto/err/err_local.h	5
openssl30/crypto/threads_pthread.c	13
openssl30/crypto/cpuid.c	4
openssl30/crypto/ctype.c	3
openssl30/crypto/initthread.c	21
openssl30/crypto/stack/stack.c	16
openssl30/crypto/comp/c_zlib.c	1
openssl30/crypto/async/async.c	6
openssl30/crypto/rand/rand_lib.c	10
openssl30/providers/implementations/rands/seeding/rand_unix.c	4
openssl30/crypto/engine/eng_init.c	4
openssl30/crypto/cryptlib.c	2
openssl30/crypto/engine/eng_lib.c	21
openssl30/include/internal/refcount.h	2
openssl30/crypto/engine/tb_pkmeth.c	7
openssl30/crypto/evp/pmeth_lib.c	31
openssl30/crypto/engine/tb_asnmth.c	9
openssl30/crypto/asn1/ameth_lib.c	9
openssl30/crypto/engine/eng_list.c	10
openssl30/crypto/ex_data.c	14
openssl30/crypto/context.c	17
openssl30/include/internal/cryptlib.h	8
openssl30/include/openssl/crypto.h	2
openssl30/crypto/property/property_parse.c	25
openssl30/crypto/property/property_string.c	12
openssl30/crypto/lhash/lhash.c	12
openssl30/crypto/evp/evp_rand.c	3
openssl30/crypto/provider_core.c	43
openssl30/crypto/err/err_all.c	1
openssl30/include/openssl/err.h	4
openssl30/crypto/bn/bn_err.c	1
openssl30/crypto/rsa/rsa_err.c	1
openssl30/crypto/dh/dh_err.c	1
openssl30/crypto/evp/evp_err.c	1
openssl30/crypto/buffer/buf_err.c	1
openssl30/crypto/objects/obj_err.c	1
openssl30/crypto/pem/pem_err.c	1
openssl30/crypto/dsa/dsa_err.c	1
openssl30/crypto/x509/x509_err.c	1
openssl30/crypto/asn1/asn1_err.c	1
openssl30/crypto/conf/conf_err.c	1
openssl30/crypto/cpt_err.c	1
openssl30/crypto/comp/comp_err.c	1
openssl30/crypto/ec/ec_err.c	1
openssl30/crypto/bio/bio_err.c	1
openssl30/crypto/pkcs7/pkcs7err.c	1
openssl30/crypto/x509/v3err.c	1
openssl30/crypto/pkcs12/pk12err.c	1
openssl30/crypto/rand/rand_err.c	1
openssl30/crypto/dso/dso_err.c	1
openssl30/crypto/ts/ts_err.c	1
openssl30/crypto/engine/eng_err.c	1
openssl30/crypto/http/http_err.c	1
openssl30/crypto/ocsp/ocsp_err.c	1
openssl30/crypto/ui/ui_err.c	1
openssl30/crypto/cms/cms_err.c	1
openssl30/crypto/crmf/crmf_err.c	1
openssl30/crypto/cmp/cmp_err.c	1
openssl30/crypto/ct/ct_err.c	1
openssl30/crypto/ess/ess_err.c	1
openssl30/crypto/async/async_err.c	1
openssl30/crypto/store/store_err.c	1
openssl30/crypto/property/property_err.c	1
openssl30/providers/common/provider_err.c	1
openssl30/crypto/evp/c_allc.c	1
openssl30/crypto/evp/e_des.c	6
openssl30/crypto/evp/names.c	9
openssl30/crypto/objects/obj_dat.c	23
openssl30/crypto/evp/c_alld.c	1
openssl30/crypto/evp/legacy_md4.c	1
openssl30/crypto/objects/obj_local.h	18
openssl30/crypto/objects/o_names.c	12
openssl30/crypto/conf/conf_sap.c	2
openssl30/crypto/conf/conf_mod.c	33
openssl30/crypto/engine/eng_openssl.c	20
openssl30/crypto/evp/evp_lib.c	37
openssl30/crypto/dso/dso_lib.c	9
openssl30/crypto/provider_local.h	4
openssl30/crypto/provider_child.c	2
openssl30/crypto/evp/cmeth_lib.c	8
openssl30/crypto/evp/evp_enc.c	24
openssl30/crypto/rsa/rsa_ossl.c	1
openssl30/crypto/engine/tb_rsa.c	4
openssl30/crypto/dsa/dsa_ossl.c	1
openssl30/crypto/engine/tb_dsa.c	4
openssl30/crypto/ec/ec_kmeth.c	1
openssl30/crypto/engine/tb_eckey.c	4
openssl30/crypto/dh/dh_key.c	1
openssl30/crypto/engine/tb_dh.c	4
openssl30/crypto/rand/rand_meth.c	1
openssl30/crypto/engine/tb_rand.c	4
openssl30/crypto/engine/tb_cipher.c	7
openssl30/crypto/params.c	47
openssl30/crypto/evp/evp_utils.c	5
openssl30/crypto/engine/tb_digest.c	7
openssl30/crypto/evp/digest.c	17
openssl30/crypto/sha/sha_local.h	1
openssl30/include/crypto/md32_common.h	2
openssl30/crypto/engine/eng_pkey.c	1
openssl30/crypto/bio/bss_file.c	2
openssl30/crypto/o_fopen.c	1
openssl30/crypto/bio/bio_lib.c	16
openssl30/crypto/pem/pem_pkey.c	5
openssl30/crypto/bio/bf_readbuff.c	1
openssl30/crypto/pem/pem_lib.c	15
openssl30/crypto/evp/evp_key.c	3
openssl30/crypto/ui/ui_lib.c	27
openssl30/crypto/ui/ui_openssl.c	1
openssl30/crypto/ui/ui_null.c	1
openssl30/include/openssl/ui.h	2
openssl30/crypto/err/err_prn.c	1
openssl30/crypto/o_str.c	12
openssl30/crypto/bio/bio_print.c	9
openssl30/crypto/passphrase.c	9
openssl30/crypto/encode_decode/decoder_pkey.c	13
openssl30/crypto/encode_decode/decoder_meth.c	16
openssl30/crypto/encode_decode/decoder_lib.c	23
openssl30/crypto/evp/keymgmt_meth.c	21
openssl30/crypto/evp/evp_fetch.c	16
openssl30/crypto/core_namemap.c	19
openssl30/crypto/engine/eng_rdrand.c	4
openssl30/crypto/engine/eng_local.h	14
openssl30/crypto/engine/eng_dyn.c	12
openssl30/include/openssl/safestack.h	4
openssl30/crypto/dso/dso_dlfcn.c	1
openssl30/engines/e_padlock.c	22
openssl30/crypto/asn1/evp_asn1.c	1
openssl30/crypto/asn1/tasn_typ.c	9
openssl30/crypto/asn1/asn1_lib.c	11
openssl30/crypto/asn1/a_octet.c	1
openssl30/crypto/asn1/a_type.c	1
openssl30/crypto/asn1/tasn_fre.c	5
openssl30/crypto/asn1/a_object.c	6
openssl30/engines/e_afalg.c	27
openssl30/engines/e_afalg_err.c	3
openssl30/crypto/engine/eng_fat.c	5
openssl30/crypto/engine/eng_table.c	8
openssl30/crypto/async/async_wait.c	3
openssl30/crypto/async/arch/async_posix.h	1
openssl30/crypto/bsearch.c	1
openssl30/crypto/bn/bn_word.c	4
openssl30/crypto/bn/bn_local.h	1
openssl30/crypto/mem_sec.c	18
openssl30/crypto/bn/bn_shift.c	6
openssl30/crypto/bn/bn_conv.c	4
openssl30/include/internal/constant_time.h	6
openssl30/crypto/bn/asm/x86_64-gcc.c	10
openssl30/include/crypto/asn1.h	3
openssl30/crypto/property/property.c	25
openssl30/crypto/sparse_array.c	1
openssl30/crypto/core_fetch.c	3
openssl30/crypto/core_algorithm.c	4
openssl30/crypto/getenv.c	1
openssl30/include/openssl/core_dispatch.h	81
openssl30/crypto/provider.c	2
openssl30/crypto/property/property_query.c	3
openssl30/crypto/encode_decode/encoder_local.h	5
openssl30/crypto/evp/keymgmt_lib.c	14
openssl30/crypto/evp/p_lib.c	19
openssl30/include/crypto/evp.h	8
openssl30/include/openssl/x509.h	1
openssl30/crypto/x509/x_attrib.c	2
openssl30/include/openssl/asn1t.h	2
openssl30/crypto/asn1/tasn_utl.c	9
openssl30/crypto/asn1/a_int.c	8
openssl30/crypto/bio/bss_mem.c	3
openssl30/crypto/bio/ossl_core_bio.c	3
openssl30/crypto/ui/ui_util.c	8
openssl30/crypto/evp/encode.c	7
openssl30/crypto/evp/legacy_md5.c	1
openssl30/crypto/evp/m_sigver.c	7
openssl30/crypto/evp/signature.c	9
openssl30/crypto/evp/exchange.c	2
openssl30/crypto/evp/kem.c	2
openssl30/crypto/evp/asymcipher.c	2
openssl30/crypto/evp/ctrl_params_translate.c	10
openssl30/crypto/params_from_text.c	3
openssl30/crypto/asn1/p8_pkey.c	4
openssl30/crypto/asn1/tasn_dec.c	14
openssl30/crypto/buffer/buffer.c	2
openssl30/crypto/asn1/tasn_new.c	9
openssl30/crypto/asn1/a_bitstr.c	1
openssl30/crypto/evp/evp_pkey.c	1
openssl30/crypto/asn1/x_sig.c	3
openssl30/crypto/pkcs12/p12_p8d.c	2
openssl30/crypto/pkcs12/p12_decr.c	2
openssl30/crypto/evp/evp_pbe.c	6
openssl30/crypto/evp/evp_local.h	3
openssl30/crypto/asn1/d2i_pr.c	1
openssl30/crypto/x509/x_pubkey.c	7
openssl30/crypto/x509/x509_def.c	1
openssl30/crypto/conf/conf_lib.c	10
openssl30/crypto/conf/conf_def.c	1
openssl30/crypto/conf/conf_api.c	3
openssl30/include/openssl/conf.h	3
openssl30/crypto/conf/conf_mall.c	1
openssl30/crypto/asn1/asn_moid.c	3
openssl30/crypto/objects/obj_lib.c	1
openssl30/crypto/asn1/asn_mstbl.c	3
openssl30/crypto/x509/v3_utl.c	6
openssl30/crypto/asn1/asn1_gen.c	3
openssl30/crypto/asn1/a_strnid.c	6
openssl30/include/openssl/asn1.h	3
openssl30/crypto/engine/eng_cnf.c	5
openssl30/crypto/engine/eng_all.c	1
openssl30/crypto/engine/eng_ctrl.c	7
openssl30/crypto/evp/evp_cnf.c	2
openssl30/crypto/conf/conf_ssl.c	3
openssl30/crypto/provider_conf.c	10
openssl30/crypto/encode_decode/encoder_meth.c	3
openssl30/crypto/store/store_meth.c	3
openssl30/crypto/evp/legacy_md5_sha1.c	1
openssl30/crypto/evp/legacy_sha.c	13
openssl30/crypto/evp/legacy_mdc2.c	1
openssl30/crypto/evp/legacy_ripemd.c	1
openssl30/crypto/evp/legacy_wp.c	1
openssl30/crypto/sm3/legacy_sm3.c	1
openssl30/crypto/evp/legacy_blake2.c	2
openssl30/crypto/evp/e_des3.c	11
openssl30/crypto/evp/e_xcbc_d.c	1
openssl30/crypto/evp/e_rc4.c	2
openssl30/crypto/evp/e_rc4_hmac_md5.c	1
openssl30/crypto/evp/e_idea.c	4
openssl30/crypto/evp/e_seed.c	4
openssl30/crypto/evp/e_sm4.c	5
openssl30/crypto/evp/e_rc2.c	6
openssl30/crypto/evp/e_bf.c	4
openssl30/crypto/evp/e_cast.c	4
openssl30/crypto/evp/e_rc5.c	4
openssl30/crypto/evp/e_aes.c	38
openssl30/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl30/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl30/crypto/evp/e_aria.c	27
openssl30/crypto/evp/e_camellia.c	21
openssl30/crypto/evp/e_chacha20_poly1305.c	2
openssl30/crypto/store/store_init.c	1
openssl30/crypto/store/store_register.c	1
openssl30/crypto/store/store_local.h	1
openssl30/crypto/bio/bio_sock.c	1
openssl30/crypto/objects/obj_xref.c	2
openssl30/crypto/objects/obj_xref.h	2
openssl30/crypto/cmp/cmp_util.c	1
openssl30/crypto/trace.c	2
openssl30/crypto/bn/bn_ctx.c	11
openssl30/crypto/bn/bn_exp.c	9
openssl30/crypto/bn/bn_mont.c	10
openssl30/crypto/bn/bn_gcd.c	3
openssl30/crypto/bn/bn_mod.c	2
openssl30/crypto/bn/bn_div.c	3
openssl30/crypto/bn/bn_mul.c	6
openssl30/crypto/bn/bn_add.c	4
openssl30/crypto/bn/bn_sqr.c	4
openssl30/crypto/bn/rsaz_exp.c	2
openssl30/crypto/bn/rsaz_exp.h	2
openssl30/crypto/bn/bn_recp.c	6
openssl30/crypto/bn/bn_print.c	2

Fuzzer: x509

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3973	55.3%
gold	[1:9]	1050	14.6%
yellow	[10:29]	152	2.11%
greenyellow	[30:49]	66	0.91%
lawngreen	50+	1938	26.9%
All colors	7179	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
47407	47409	8 : View List ['sk_BIGNUM_const_push', 'RSA_get0_q', 'RSA_get0_iqmp', 'RSA_get_multi_prime_extra_count', 'sk_RSA_PRIME_INFO_value.14409', 'RSA_get0_p', 'RSA_get0_dmq1', 'RSA_get0_dmp1']	47407	47409	ossl_rsa_get0_all_params	call site: 00000	/src/openssl/crypto/rsa/rsa_lib.c:856
20741	30171	13 : View List ['DSO_free', 'DSO_merge', 'DSO_convert_filename', 'DSO_new', 'ossl_safe_getenv', 'CRYPTO_THREAD_read_lock', 'DSO_bind_func', 'get_provider_store', 'CRYPTO_THREAD_unlock', 'DSO_load', 'CRYPTO_strdup', 'CRYPTO_free', 'DSO_ctrl']	24200	86971	provider_init	call site: 01590	/src/openssl/crypto/provider_core.c:886
13653	55394	7 : View List ['ERR_set_error', 'RAND_priv_bytes_ex', 'ERR_new', 'ossl_ecx_public_from_private', 'ossl_ecx_key_allocate_privkey', 'ossl_ecx_key_free', 'ERR_set_debug']	13653	55394	ossl_ecx_key_op	call site: 00000	/src/openssl/crypto/ec/ecx_backend.c:190
11909	17885	10 : View List ['ossl_assert_int.33564', 'evp_keymgmt_util_clear_operation_cache', 'evp_keymgmt_util_cache_keydata', 'CRYPTO_THREAD_read_lock', 'evp_keymgmt_util_find_operation_cache', 'evp_keymgmt_freedata', 'match_type', 'CRYPTO_THREAD_unlock', 'evp_keymgmt_util_export', 'CRYPTO_THREAD_write_lock']	11909	17885	evp_keymgmt_util_export_to_provider	call site: 03173	/src/openssl/crypto/evp/keymgmt_lib.c:117
11887	30146	5 : View List ['ecdsa_setup_md', 'OSSL_PARAM_get_size_t', 'OSSL_PARAM_locate_const', 'OSSL_PARAM_get_utf8_string', 'OSSL_PARAM_get_uint']	11887	30146	ecdsa_set_ctx_params	call site: 00000	/src/openssl/providers/implementations/signature/ecdsa_sig.c:499
11848	11848	2 : View List ['sk_INFOPAIR_new_null', 'ossl_provider_info_add_parameter']	11848	21247	ossl_provider_new	call site: 04306	/src/openssl/crypto/provider_core.c:558
9914	9914	2 : View List ['ec_GF2m_simple_oct2point', 'ec_GFp_simple_oct2point']	9914	9914	EC_POINT_oct2point	call site: 00000	/src/openssl111/crypto/ec/ec_oct.c:113
9386	9386	2 : View List ['conf_diagnostics', 'CONF_modules_load']	9386	16308	CONF_modules_load_file_ex	call site: 00400	/src/openssl/crypto/conf/conf_mod.c:206
8805	8805	2 : View List ['ec_GF2m_simple_set_compressed_coordinates', 'ec_GFp_simple_set_compressed_coordinates']	8805	8805	EC_POINT_set_compressed_coordinates	call site: 00000	/src/openssl111/crypto/ec/ec_oct.c:32
7466	7510	4 : View List ['X509_cmp_time', 'X509_get0_notBefore', 'verify_cb_cert', 'X509_get0_notAfter']	7466	7510	ossl_x509_check_cert_time	call site: 06448	/src/openssl/crypto/x509/x509_vfy.c:1790
6912	13837	5 : View List ['ENGINE_get_digest', 'ENGINE_finish', 'EVP_PKEY_CTX_ctrl', 'ENGINE_init', 'CRYPTO_zalloc']	6912	61260	evp_md_init_internal	call site: 03575	/src/openssl/crypto/evp/digest.c:226
6588	24366	5 : View List ['ERR_new', 'ERR_set_error', 'EVP_MD_get_type', 'EVP_PKEY_CTX_get_signature_md', 'ERR_set_debug']	6588	47659	ossl_rsa_pss_to_ctx	call site: 06360	/src/openssl/crypto/rsa/rsa_ameth.c:559

Runtime coverage analysis

Covered functions

2985

Functions that are reachable but not covered

955

Reachable functions

2501

Percentage of reachable functions covered

61.82%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl/fuzz/driver.c	1
openssl/fuzz/x509.c	2
openssl/crypto/x509/x_x509.c	6
openssl/crypto/asn1/tasn_dec.c	14
openssl/crypto/err/err_blocks.c	4
openssl/crypto/err/err.c	30
openssl/crypto/init.c	40
openssl/crypto/err/err_local.h	6
openssl/crypto/mem.c	6
openssl/crypto/threads_pthread.c	14
openssl/crypto/err/err_save.c	1
openssl/crypto/initthread.c	21
openssl/crypto/stack/stack.c	22
openssl/crypto/comp/c_zlib.c	1
openssl/crypto/comp/c_brotli.c	1
openssl/crypto/comp/c_zstd.c	1
openssl/crypto/async/async.c	6
openssl/crypto/async/arch/async_posix.c	2
openssl/crypto/rand/rand_lib.c	11
openssl/providers/implementations/rands/seeding/rand_unix.c	4
openssl/crypto/engine/eng_init.c	4
openssl/crypto/cryptlib.c	2
openssl/crypto/engine/eng_lib.c	21
openssl/include/internal/refcount.h	4
openssl/crypto/engine/tb_pkmeth.c	7
openssl/crypto/evp/pmeth_lib.c	34
openssl/crypto/engine/tb_asnmth.c	8
openssl/crypto/asn1/ameth_lib.c	9
openssl/crypto/engine/eng_list.c	10
openssl/crypto/ex_data.c	12
openssl/crypto/context.c	16
openssl/crypto/property/property.c	29
openssl/crypto/sparse_array.c	1
openssl/crypto/provider_conf.c	14
openssl/crypto/evp/c_allc.c	1
openssl/crypto/evp/e_des.c	6
openssl/crypto/evp/names.c	9
openssl/crypto/objects/obj_dat.c	30
openssl/crypto/evp/c_alld.c	1
openssl/crypto/evp/legacy_md4.c	1
openssl/crypto/objects/o_names.c	12
openssl/crypto/objects/obj_local.h	18
openssl/crypto/lhash/lhash.c	13
openssl/crypto/evp/legacy_md5.c	1
openssl/crypto/evp/legacy_md5_sha1.c	1
openssl/crypto/evp/legacy_sha.c	13
openssl/crypto/evp/legacy_mdc2.c	1
openssl/crypto/evp/legacy_ripemd.c	1
openssl/crypto/evp/legacy_wp.c	1
openssl/crypto/sm3/legacy_sm3.c	1
openssl/crypto/evp/legacy_blake2.c	2
openssl/crypto/conf/conf_sap.c	2
openssl/crypto/conf/conf_mod.c	33
openssl/crypto/err/err_mark.c	3
openssl/crypto/getenv.c	1
openssl/crypto/o_str.c	14
openssl/crypto/x509/x509_def.c	1
openssl/crypto/bio/bio_print.c	11
openssl/include/internal/common.h	1
openssl/crypto/ctype.c	5
openssl/crypto/conf/conf_lib.c	10
openssl/crypto/conf/conf_def.c	1
openssl/include/openssl/err.h	4
openssl/crypto/conf/conf_api.c	3
openssl/include/openssl/conf.h	3
openssl/crypto/conf/conf_mall.c	1
openssl/crypto/asn1/asn_moid.c	3
openssl/crypto/bsearch.c	1
openssl/crypto/asn1/a_object.c	7
openssl/crypto/bn/bn_lib.c	26
openssl/crypto/bn/bn_local.h	1
openssl/crypto/mem_sec.c	18
openssl/crypto/bn/bn_word.c	4
openssl/crypto/bn/asm/x86_64-gcc.c	2
openssl/crypto/bn/bn_shift.c	2
openssl/crypto/asn1/asn1_lib.c	17
openssl/crypto/objects/obj_lib.c	2
openssl/crypto/asn1/asn_mstbl.c	3
openssl/crypto/x509/v3_utl.c	6
openssl/crypto/asn1/asn1_gen.c	3
openssl/crypto/asn1/a_strnid.c	6
openssl/include/openssl/asn1.h	5
openssl/crypto/engine/eng_openssl.c	20
openssl/include/internal/cryptlib.h	7
openssl/include/openssl/crypto.h	2
openssl/crypto/evp/evp_lib.c	41
openssl/crypto/provider_core.c	49
openssl/crypto/engine/eng_rdrand.c	4
openssl/crypto/engine/tb_rand.c	4
openssl/crypto/engine/eng_local.h	14
openssl/crypto/engine/eng_dyn.c	12
openssl/crypto/dso/dso_lib.c	9
openssl/include/openssl/safestack.h	4
openssl/crypto/dso/dso_dlfcn.c	1
openssl/engines/e_padlock.c	22
openssl/crypto/engine/tb_cipher.c	7
openssl/crypto/evp/cmeth_lib.c	8
openssl/crypto/evp/evp_enc.c	26
openssl/crypto/params.c	48
openssl/crypto/evp/evp_utils.c	5
openssl/crypto/asn1/evp_asn1.c	1
openssl/crypto/asn1/tasn_typ.c	17
openssl/crypto/asn1/a_octet.c	2
openssl/crypto/asn1/a_type.c	3
openssl/crypto/asn1/tasn_fre.c	5
openssl/engines/e_afalg.c	28
openssl/engines/e_afalg_err.c	3
openssl/crypto/provider_local.h	4
openssl/crypto/provider_child.c	4
openssl/providers/implementations/rands/crngt.c	2
openssl/crypto/evp/digest.c	21
openssl/crypto/evp/evp_fetch.c	16
openssl/crypto/core_namemap.c	22
openssl/crypto/engine/eng_fat.c	5
openssl/crypto/engine/eng_table.c	8
openssl/crypto/engine/tb_digest.c	7
openssl/crypto/engine/tb_rsa.c	4
openssl/crypto/engine/tb_dsa.c	4
openssl/crypto/engine/tb_dh.c	4
openssl/crypto/engine/tb_eckey.c	4
openssl/include/crypto/asn1.h	3
openssl/crypto/core_fetch.c	3
openssl/crypto/core_algorithm.c	4
openssl/include/openssl/core_dispatch.h	79
openssl/crypto/encode_decode/decoder_pkey.c	27
openssl/crypto/async/async_wait.c	3
openssl/crypto/async/arch/async_posix.h	1
openssl/crypto/rsa/rsa_ossl.c	1
openssl/crypto/dsa/dsa_ossl.c	1
openssl/crypto/ec/ec_kmeth.c	1
openssl/crypto/dh/dh_key.c	1
openssl/crypto/rand/rand_meth.c	1
openssl/crypto/sha/sha_local.h	1
openssl/include/crypto/md32_common.h	2
openssl/crypto/engine/eng_pkey.c	1
openssl/crypto/bio/bss_file.c	2
openssl/crypto/o_fopen.c	1
openssl/crypto/bio/bio_lib.c	17
openssl/crypto/pem/pem_pkey.c	5
openssl/crypto/bio/bf_readbuff.c	1
openssl/crypto/pem/pem_lib.c	15
openssl/crypto/evp/evp_key.c	3
openssl/crypto/ui/ui_lib.c	27
openssl/crypto/ui/ui_openssl.c	1
openssl/crypto/ui/ui_null.c	1
openssl/include/openssl/ui.h	2
openssl/crypto/err/err_prn.c	2
openssl/crypto/passphrase.c	10
openssl/crypto/encode_decode/decoder_meth.c	21
openssl/crypto/encode_decode/decoder_lib.c	27
openssl/crypto/evp/keymgmt_meth.c	19
openssl/crypto/provider.c	2
openssl/crypto/property/property_query.c	3
openssl/crypto/property/property_string.c	17
openssl/crypto/property/property_parse.c	25
openssl/crypto/encode_decode/encoder_local.h	11
openssl/crypto/evp/keymgmt_lib.c	13
openssl/crypto/evp/p_lib.c	29
openssl/include/crypto/evp.h	8
openssl/include/openssl/x509.h	8
openssl/crypto/x509/x_attrib.c	2
openssl/include/openssl/asn1t.h	2
openssl/crypto/asn1/tasn_utl.c	13
openssl/crypto/asn1/a_int.c	13
openssl/crypto/bio/bss_mem.c	3
openssl/crypto/bio/ossl_core_bio.c	3
openssl/crypto/ui/ui_util.c	8
openssl/crypto/evp/encode.c	7
openssl/crypto/evp/m_sigver.c	9
openssl/crypto/evp/signature.c	11
openssl/crypto/evp/exchange.c	3
openssl/crypto/evp/kem.c	3
openssl/crypto/evp/asymcipher.c	3
openssl/crypto/evp/ctrl_params_translate.c	13
openssl/crypto/params_from_text.c	3
openssl/crypto/bn/bn_conv.c	4
openssl/crypto/asn1/p8_pkey.c	4
openssl/crypto/evp/evp_pkey.c	1
openssl/crypto/asn1/x_sig.c	3
openssl/crypto/pkcs12/p12_p8d.c	2
openssl/crypto/pkcs12/p12_decr.c	2
openssl/crypto/evp/evp_pbe.c	6
openssl/crypto/evp/evp_local.h	4
openssl/crypto/asn1/d2i_pr.c	1
openssl/crypto/x509/x_pubkey.c	12
openssl/crypto/engine/eng_cnf.c	5
openssl/crypto/engine/eng_all.c	1
openssl/crypto/engine/eng_ctrl.c	7
openssl/crypto/evp/evp_cnf.c	2
openssl/crypto/conf/conf_ssl.c	3
openssl/crypto/encode_decode/encoder_meth.c	18
openssl/crypto/store/store_meth.c	3
openssl/crypto/evp/e_des3.c	11
openssl/crypto/evp/e_xcbc_d.c	1
openssl/crypto/evp/e_rc4.c	2
openssl/crypto/evp/e_rc4_hmac_md5.c	1
openssl/crypto/evp/e_idea.c	4
openssl/crypto/evp/e_seed.c	4
openssl/crypto/evp/e_sm4.c	5
openssl/crypto/evp/e_rc2.c	6
openssl/crypto/evp/e_bf.c	4
openssl/crypto/evp/e_cast.c	4
openssl/crypto/evp/e_rc5.c	4
openssl/crypto/evp/e_aes.c	38
openssl/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl/crypto/evp/e_aria.c	27
openssl/crypto/evp/e_camellia.c	21
openssl/crypto/evp/e_chacha20_poly1305.c	2
openssl/crypto/err/err_all.c	1
openssl/crypto/bn/bn_err.c	1
openssl/crypto/rsa/rsa_err.c	1
openssl/crypto/dh/dh_err.c	1
openssl/crypto/evp/evp_err.c	1
openssl/crypto/buffer/buf_err.c	1
openssl/crypto/objects/obj_err.c	1
openssl/crypto/pem/pem_err.c	1
openssl/crypto/dsa/dsa_err.c	1
openssl/crypto/x509/x509_err.c	1
openssl/crypto/asn1/asn1_err.c	1
openssl/crypto/conf/conf_err.c	1
openssl/crypto/cpt_err.c	1
openssl/crypto/comp/comp_err.c	1
openssl/crypto/ec/ec_err.c	1
openssl/crypto/bio/bio_err.c	1
openssl/crypto/pkcs7/pkcs7err.c	1
openssl/crypto/x509/v3err.c	1
openssl/crypto/pkcs12/pk12err.c	1
openssl/crypto/rand/rand_err.c	1
openssl/crypto/dso/dso_err.c	1
openssl/crypto/ts/ts_err.c	1
openssl/crypto/engine/eng_err.c	1
openssl/crypto/http/http_err.c	1
openssl/crypto/ocsp/ocsp_err.c	1
openssl/crypto/ui/ui_err.c	1
openssl/crypto/cms/cms_err.c	1
openssl/crypto/crmf/crmf_err.c	1
openssl/crypto/cmp/cmp_err.c	1
openssl/crypto/ct/ct_err.c	1
openssl/crypto/ess/ess_err.c	1
openssl/crypto/async/async_err.c	1
openssl/crypto/store/store_err.c	1
openssl/crypto/property/property_err.c	1
openssl/providers/common/provider_err.c	1
openssl/crypto/property/defn_cache.c	5
openssl/crypto/bio/bss_core.c	2
openssl/providers/implementations/rands/drbg.c	2
openssl/crypto/self_test_core.c	2
openssl/crypto/thread/internal.c	2
openssl/crypto/thread/arch/thread_posix.c	4
openssl/crypto/evp/evp_rand.c	3
openssl/crypto/store/store_init.c	1
openssl/crypto/store/store_register.c	1
openssl/crypto/store/store_local.h	1
openssl/crypto/bio/bio_sock.c	1
openssl/crypto/objects/obj_xref.c	9
openssl/crypto/objects/obj_xref.h	4
openssl/crypto/cmp/cmp_util.c	1
openssl/crypto/trace.c	2
openssl/crypto/cpuid.c	4
openssl/crypto/buffer/buffer.c	5
openssl/crypto/asn1/tasn_new.c	9
openssl/crypto/asn1/a_bitstr.c	2
openssl/crypto/bio/bss_null.c	1
openssl/crypto/x509/t_x509.c	6
openssl/crypto/x509/x509_set.c	10
openssl/crypto/x509/x509_cmp.c	18
openssl/crypto/bio/bio_dump.c	4
openssl/crypto/asn1/a_strex.c	8
openssl/crypto/x509/x_name.c	8
openssl/crypto/x509/x509_obj.c	1
openssl/crypto/x509/x509name.c	6
openssl/crypto/asn1/asn1_parse.c	4
openssl/crypto/asn1/tasn_enc.c	8
openssl/crypto/asn1/asn1_local.h	3
openssl/crypto/asn1/a_utf8.c	2
openssl/include/internal/unicode.h	1
openssl/crypto/asn1/a_time.c	11
openssl/crypto/o_time.c	6
openssl/crypto/bio/bf_prefix.c	1
openssl/crypto/encode_decode/encoder_pkey.c	7
openssl/crypto/encode_decode/encoder_lib.c	18
openssl/crypto/x509/v3_prn.c	4
openssl/crypto/x509/x509_v3.c	7
openssl/crypto/x509/v3_lib.c	6
openssl/include/openssl/x509v3.h	13
openssl/crypto/asn1/a_print.c	1
openssl/crypto/x509/x_x509a.c	5
openssl/crypto/x509/x_crl.c	5
openssl/crypto/ocsp/ocsp_asn.c	10
openssl/crypto/x509/x509_lu.c	16
openssl/include/openssl/x509_vfy.h	9
openssl/crypto/x509/x509_vpm.c	15
openssl/crypto/x509/x509cset.c	4
openssl/crypto/x509/v3_purp.c	16
openssl/crypto/x509/x_all.c	4
openssl/crypto/asn1/a_digest.c	2
openssl/crypto/x509/x509_ext.c	6
openssl/crypto/x509/v3_bcons.c	2
openssl/crypto/x509/v3_pcia.c	2
openssl/crypto/x509/v3_crld.c	1
openssl/crypto/asn1/a_dup.c	1
openssl/crypto/x509/x509_vfy.c	49
openssl/crypto/x509/pcy_tree.c	14
openssl/crypto/x509/pcy_node.c	7
openssl/crypto/x509/pcy_local.h	8
openssl/crypto/x509/pcy_data.c	2
openssl/crypto/x509/v3_cpols.c	4
openssl/crypto/asn1/x_algor.c	4
openssl/crypto/asn1/a_verify.c	2
openssl/crypto/rsa/rsa_ameth.c	3
openssl/crypto/rsa/rsa_backend.c	2
openssl/crypto/rsa/rsa_asn1.c	2
openssl/crypto/asn1/asn_pack.c	1
openssl/crypto/rsa/rsa_pss.c	3
openssl/crypto/rsa/rsa_lib.c	4
openssl/crypto/asn1/a_utctm.c	1
openssl/crypto/asn1/a_gentm.c	1
openssl/crypto/x509/v3_genn.c	3
openssl/crypto/x509/pcy_cache.c	6
openssl/crypto/x509/pcy_map.c	1
openssl/crypto/x509/v3_pmaps.c	2
openssl/crypto/x509/v3_pcons.c	2
openssl/crypto/x509/pcy_lib.c	1
openssl/include/internal/dane.h	2
openssl/crypto/ocsp/ocsp_cl.c	5
openssl/crypto/ocsp/ocsp_vfy.c	9
openssl/crypto/x509/x509_trust.c	5
openssl/crypto/x509/x509_txt.c	1
openssl/include/openssl/ocsp.h	1
openssl/crypto/ocsp/ocsp_lib.c	4

Fuzzer: client_111

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2090	54.6%
gold	[1:9]	767	20.0%
yellow	[10:29]	36	0.94%
greenyellow	[30:49]	14	0.36%
lawngreen	50+	919	24.0%
All colors	3826	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
21421	70665	11 : View List ['X509_STORE_CTX_free', 'ssl_add_cert_to_wpacket', 'sk_X509_num', 'sk_X509_value.1369', 'ssl_security_cert_chain', 'ossl_statem_fatal', 'X509_STORE_CTX_new', 'X509_STORE_CTX_init', 'X509_verify_cert', 'ERR_clear_error', 'X509_STORE_CTX_get0_chain']	21421	70665	ssl_add_cert_chain	call site: 00000	/src/openssl111/ssl/statem/statem_lib.c:919
19882	19892	6 : View List ['verify_cb_cert', 'internal_verify', 'check_name_constraints', 'X509v3_asid_validate_path', 'X509v3_addr_validate_path', 'X509_chain_check_suiteb']	19882	19892	verify_chain	call site: 00000	/src/openssl111/crypto/x509/x509_vfy.c:222
14662	61106	10 : View List ['WPACKET_start_sub_packet_len__', 'sk_OCSP_RESPID_value', 'WPACKET_sub_allocate_bytes__', 'WPACKET_close', 'WPACKET_allocate_bytes', 'i2d_OCSP_RESPID', 'ossl_statem_fatal', 'sk_OCSP_RESPID_num', 'i2d_X509_EXTENSIONS', 'WPACKET_put_bytes__']	14662	61106	tls_construct_ctos_status_request	call site: 00000	/src/openssl111/ssl/statem/extensions_clnt.c:316
8526	8526	2 : View List ['SSL_use_PrivateKey', 'SSL_use_certificate']	8526	28302	tls_prepare_client_certificate	call site: 00000	/src/openssl111/ssl/statem/statem_clnt.c:3510
7290	7290	2 : View List ['RAND_DRBG_get0_private', 'RAND_DRBG_bytes']	7290	7290	RAND_priv_bytes	call site: 03165	/src/openssl111/crypto/rand/rand_lib.c:930
6958	6958	2 : View List ['OPENSSL_die', 'evp_EncryptDecryptUpdate']	6958	13870	EVP_DecryptUpdate	call site: 02159	/src/openssl111/crypto/evp/evp_enc.c:494
6928	21688	3 : View List ['bn_mul_mont_fixed_top', 'MOD_EXP_CTIME_COPY_TO_PREBUF', 'MOD_EXP_CTIME_COPY_FROM_PREBUF']	6930	25333	BN_mod_exp_mont_consttime	call site: 00000	/src/openssl111/crypto/bn/bn_exp.c:920
5391	5545	2 : View List ['EC_GROUP_free', 'EC_GROUP_new_from_ecpkparameters']	5391	16130	d2i_ECPKParameters	call site: 00000	/src/openssl111/crypto/ec/ec_asn1.c:960
5036	5036	1 : View List ['ssl_validate_ct']	5036	5036	tls_process_initial_server_flight	call site: 00000	/src/openssl111/ssl/statem/statem_clnt.c:2847
4707	4707	1 : View List ['srp_generate_client_master_secret']	4707	4717	tls_client_key_exchange_post_work	call site: 00000	/src/openssl111/ssl/statem/statem_clnt.c:3381
4677	4677	1 : View List ['ssl_check_srvr_ecc_cert_and_alg']	4677	8336	ssl3_check_cert_and_algorithm	call site: 00000	/src/openssl111/ssl/statem/statem_clnt.c:3612
4597	8256	2 : View List ['ossl_statem_fatal', 'SRP_Calc_A_param']	4597	13572	tls_process_server_done	call site: 00000	/src/openssl111/ssl/statem/statem_clnt.c:2868

Runtime coverage analysis

Covered functions

2183

Functions that are reachable but not covered

587

Reachable functions

1442

Percentage of reachable functions covered

59.29%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl111/fuzz/driver.c	1
openssl111/fuzz/client.c	2
openssl111/ssl/methods.c	1
openssl111/ssl/ssl_lib.c	32
openssl111/crypto/err/err.c	30
openssl111/crypto/init.c	46
openssl111/crypto/mem.c	7
openssl111/crypto/threads_pthread.c	14
openssl111/crypto/async/async.c	17
openssl111/crypto/async/async_local.h	4
openssl111/crypto/stack/stack.c	10
openssl111/crypto/async/arch/async_posix.c	3
openssl111/crypto/rand/drbg_lib.c	20
openssl111/crypto/rand/rand_lib.c	17
openssl111/crypto/mem_sec.c	18
openssl111/crypto/cryptlib.c	6
openssl111/crypto/ex_data.c	10
openssl111/crypto/comp/c_zlib.c	2
openssl111/crypto/rand/rand_unix.c	6
openssl111/crypto/engine/eng_init.c	4
openssl111/crypto/engine/eng_lib.c	23
openssl111/include/internal/refcount.h	2
openssl111/crypto/engine/tb_pkmeth.c	4
openssl111/crypto/evp/pmeth_lib.c	4
openssl111/crypto/engine/tb_asnmth.c	9
openssl111/crypto/asn1/ameth_lib.c	9
openssl111/crypto/engine/eng_list.c	10
openssl111/include/internal/cryptlib.h	7
openssl111/include/openssl/crypto.h	6
openssl111/crypto/conf/conf_mod.c	15
openssl111/include/openssl/conf.h	18
openssl111/crypto/dso/dso_lib.c	8
openssl111/crypto/engine/eng_local.h	14
openssl111/crypto/store/store_init.c	1
openssl111/crypto/store/store_register.c	1
openssl111/crypto/store/store_local.h	2
openssl111/crypto/lhash/lhash.c	11
openssl111/crypto/bio/bio_lib.c	17
openssl111/crypto/bio/b_sock.c	1
openssl111/crypto/evp/names.c	5
openssl111/crypto/objects/o_names.c	10
openssl111/crypto/objects/obj_local.h	18
openssl111/crypto/mem_dbg.c	1
openssl111/crypto/ctype.c	2
openssl111/crypto/evp/evp_pbe.c	6
openssl111/crypto/evp/evp_local.h	3
openssl111/crypto/objects/obj_xref.c	2
openssl111/crypto/objects/obj_xref.h	2
openssl111/include/crypto/evp.h	1
openssl111/crypto/objects/obj_dat.c	22
openssl111/crypto/asn1/a_object.c	6
openssl111/include/openssl/err.h	5
openssl111/crypto/err/err_all.c	1
openssl111/crypto/evp/c_allc.c	1
openssl111/crypto/evp/e_des.c	6
openssl111/crypto/evp/e_des3.c	11
openssl111/crypto/evp/e_xcbc_d.c	1
openssl111/crypto/evp/e_rc4.c	2
openssl111/crypto/evp/e_rc4_hmac_md5.c	1
openssl111/crypto/evp/e_idea.c	4
openssl111/crypto/evp/e_seed.c	4
openssl111/crypto/evp/e_sm4.c	5
openssl111/crypto/evp/e_rc2.c	6
openssl111/crypto/evp/e_bf.c	4
openssl111/crypto/evp/e_cast.c	4
openssl111/crypto/evp/e_rc5.c	4
openssl111/crypto/evp/e_aes.c	38
openssl111/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl111/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl111/crypto/evp/e_aria.c	27
openssl111/crypto/evp/e_camellia.c	21
openssl111/crypto/evp/e_chacha20_poly1305.c	2
openssl111/crypto/evp/c_alld.c	1
openssl111/crypto/evp/m_md4.c	1
openssl111/crypto/evp/m_md5.c	1
openssl111/crypto/evp/m_md5_sha1.c	1
openssl111/crypto/evp/m_sha1.c	7
openssl111/crypto/evp/m_mdc2.c	1
openssl111/crypto/evp/m_ripemd.c	1
openssl111/crypto/evp/m_wp.c	1
openssl111/crypto/sm3/m_sm3.c	1
openssl111/crypto/blake2/m_blake2b.c	1
openssl111/crypto/blake2/m_blake2s.c	1
openssl111/crypto/evp/m_sha3.c	6
openssl111/crypto/conf/conf_sap.c	2
openssl111/crypto/conf/conf_mall.c	1
openssl111/crypto/asn1/asn_moid.c	3
openssl111/crypto/o_str.c	8
openssl111/crypto/conf/conf_lib.c	8
openssl111/crypto/conf/conf_api.c	3
openssl111/crypto/bn/bn_lib.c	17
openssl111/crypto/bn/bn_local.h	1
openssl111/crypto/bn/bn_word.c	4
openssl111/crypto/bn/asm/x86_64-gcc.c	2
openssl111/include/internal/constant_time.h	4
openssl111/crypto/bn/bn_shift.c	2
openssl111/crypto/asn1/asn1_lib.c	12
openssl111/crypto/objects/obj_lib.c	1
openssl111/crypto/asn1/asn_mstbl.c	3
openssl111/crypto/x509v3/v3_utl.c	6
openssl111/crypto/asn1/asn1_gen.c	3
openssl111/crypto/asn1/tasn_dec.c	13
openssl111/crypto/engine/eng_openssl.c	20
openssl111/crypto/engine/eng_rdrand.c	4
openssl111/crypto/engine/tb_rand.c	6
openssl111/crypto/engine/eng_dyn.c	12
openssl111/include/openssl/safestack.h	7
openssl111/crypto/dso/dso_dlfcn.c	1
openssl111/engines/e_padlock.c	1
openssl111/engines/e_afalg.c	28
openssl111/engines/e_afalg_err.c	3
openssl111/crypto/evp/cmeth_lib.c	8
openssl111/crypto/evp/evp_lib.c	29
openssl111/crypto/evp/evp_enc.c	14
openssl111/crypto/engine/eng_fat.c	5
openssl111/crypto/engine/tb_cipher.c	7
openssl111/crypto/engine/eng_table.c	8
openssl111/crypto/engine/tb_digest.c	5
openssl111/crypto/engine/tb_rsa.c	4
openssl111/crypto/engine/tb_dsa.c	4
openssl111/crypto/engine/tb_dh.c	4
openssl111/crypto/engine/tb_eckey.c	4
openssl111/crypto/async/async_wait.c	5
openssl111/crypto/async/arch/async_posix.h	1
openssl111/crypto/rsa/rsa_ossl.c	1
openssl111/crypto/dsa/dsa_ossl.c	1
openssl111/crypto/ec/ec_kmeth.c	1
openssl111/crypto/dh/dh_key.c	1
openssl111/crypto/sha/sha_local.h	1
openssl111/include/crypto/md32_common.h	2
openssl111/crypto/engine/eng_pkey.c	1
openssl111/crypto/bio/bss_file.c	2
openssl111/crypto/o_fopen.c	1
openssl111/crypto/pem/pem_pkey.c	1
openssl111/crypto/pem/pem_lib.c	14
openssl111/crypto/bio/bss_mem.c	2
openssl111/crypto/evp/encode.c	7
openssl111/include/crypto/asn1.h	3
openssl111/crypto/evp/evp_key.c	3
openssl111/crypto/ui/ui_lib.c	11
openssl111/crypto/ui/ui_openssl.c	1
openssl111/crypto/ui/ui_null.c	1
openssl111/include/openssl/ui.h	5
openssl111/crypto/err/err_prn.c	1
openssl111/crypto/bio/b_print.c	9
openssl111/crypto/evp/digest.c	7
openssl111/crypto/evp/p_lib.c	11
openssl111/include/openssl/x509.h	9
openssl111/crypto/x509/x_attrib.c	1
openssl111/crypto/asn1/tasn_fre.c	5
openssl111/include/openssl/asn1t.h	7
openssl111/crypto/asn1/tasn_utl.c	10
openssl111/crypto/asn1/a_int.c	10
openssl111/crypto/asn1/p8_pkey.c	3
openssl111/crypto/buffer/buffer.c	4
openssl111/crypto/asn1/tasn_typ.c	7
openssl111/crypto/asn1/tasn_new.c	8
openssl111/crypto/asn1/a_type.c	1
openssl111/crypto/asn1/a_bitstr.c	2
openssl111/crypto/evp/evp_pkey.c	1
openssl111/crypto/bn/bn_print.c	1
openssl111/crypto/asn1/x_sig.c	3
openssl111/crypto/pkcs12/p12_p8d.c	1
openssl111/crypto/pkcs12/p12_decr.c	2
openssl111/crypto/asn1/d2i_pr.c	3
openssl111/crypto/asn1/a_strnid.c	6
openssl111/include/openssl/asn1.h	11
openssl111/crypto/engine/eng_cnf.c	5
openssl111/crypto/engine/eng_ctrl.c	6
openssl111/crypto/getenv.c	1
openssl111/crypto/evp/evp_cnf.c	2
openssl111/crypto/conf/conf_ssl.c	6
openssl111/crypto/engine/eng_all.c	1
openssl111/crypto/conf/conf_def.c	1
openssl111/crypto/x509/x509_def.c	1
openssl111/crypto/bn/bn_err.c	1
openssl111/crypto/rsa/rsa_err.c	1
openssl111/crypto/dh/dh_err.c	1
openssl111/crypto/evp/evp_err.c	1
openssl111/crypto/buffer/buf_err.c	1
openssl111/crypto/objects/obj_err.c	1
openssl111/crypto/pem/pem_err.c	1
openssl111/crypto/dsa/dsa_err.c	1
openssl111/crypto/x509/x509_err.c	1
openssl111/crypto/asn1/asn1_err.c	1
openssl111/crypto/conf/conf_err.c	1
openssl111/crypto/cpt_err.c	1
openssl111/crypto/comp/comp_err.c	1
openssl111/crypto/ec/ec_err.c	1
openssl111/crypto/bio/bio_err.c	1
openssl111/crypto/pkcs7/pkcs7err.c	1
openssl111/crypto/x509v3/v3err.c	1
openssl111/crypto/pkcs12/pk12err.c	1
openssl111/crypto/rand/rand_err.c	1
openssl111/crypto/dso/dso_err.c	1
openssl111/crypto/ts/ts_err.c	1
openssl111/crypto/engine/eng_err.c	1
openssl111/crypto/ocsp/ocsp_err.c	1
openssl111/crypto/ui/ui_err.c	1
openssl111/crypto/cms/cms_err.c	1
openssl111/crypto/ct/ct_err.c	1
openssl111/crypto/async/async_err.c	1
openssl111/crypto/kdf/kdf_err.c	1
openssl111/crypto/store/store_err.c	1
openssl111/ssl/ssl_init.c	8
openssl111/ssl/ssl_ciph.c	23
openssl111/include/openssl/ssl.h	15
openssl111/crypto/comp/comp_lib.c	3
openssl111/ssl/s3_lib.c	3
openssl111/ssl/ssl_err.c	1
openssl111/ssl/ssl_cert.c	14
openssl111/ssl/ssl_local.h	6
openssl111/crypto/x509/x509_lu.c	8
openssl111/include/openssl/x509_vfy.h	7
openssl111/crypto/x509/x509_cmp.c	5
openssl111/crypto/x509/x_name.c	2
openssl111/crypto/asn1/tasn_enc.c	8
openssl111/crypto/x509/x509_vpm.c	10
openssl111/crypto/ct/ct_log.c	3
openssl111/include/openssl/ct.h	3
openssl111/crypto/rand/drbg_ctr.c	1
openssl111/ssl/tls_srp.c	2
openssl111/ssl/ssl_mcnf.c	2
openssl111/ssl/ssl_conf.c	13
openssl111/ssl/ssl_rsa.c	5
openssl111/crypto/x509/x_all.c	1
openssl111/crypto/asn1/a_d2i_fp.c	2
openssl111/crypto/x509/x_pubkey.c	2
openssl111/crypto/x509/x_x509.c	1
openssl111/ssl/ssl_sess.c	7
openssl111/crypto/x509/x_crl.c	1
openssl111/ssl/statem/extensions_cust.c	4
openssl111/ssl/record/rec_layer_s3.c	6
openssl111/ssl/record/ssl3_record.c	2
openssl111/crypto/x509/x509_set.c	1
openssl111/ssl/statem/statem.c	4
openssl111/ssl/record/ssl3_buffer.c	3
openssl111/ssl/record/rec_layer_d1.c	1
openssl111/ssl/pqueue.c	2
openssl111/ssl/statem/statem_lib.c	1
openssl111/include/internal/dane.h	1
openssl111/crypto/x509/x_exten.c	1
openssl111/include/openssl/ocsp.h	1
openssl111/crypto/ocsp/ocsp_asn.c	1
openssl111/crypto/ct/ct_sct.c	2

Fuzzer: bndiv_111

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2610	87.4%
gold	[1:9]	183	6.13%
yellow	[10:29]	6	0.20%
greenyellow	[30:49]	3	0.10%
lawngreen	50+	181	6.06%
All colors	2983	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_usub	call site: 02950	/src/openssl111/crypto/bn/bn_add.c:138
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_CTX_new	call site: 00000	/src/openssl111/crypto/bn/bn_ctx.c:138
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_CTX_get	call site: 02834	/src/openssl111/crypto/bn/bn_ctx.c:221
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_STACK_push	call site: 02831	/src/openssl111/crypto/bn/bn_ctx.c:264
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_POOL_get	call site: 02835	/src/openssl111/crypto/bn/bn_ctx.c:318
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_div	call site: 02827	/src/openssl111/crypto/bn/bn_div.c:224
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_new	call site: 00004	/src/openssl111/crypto/bn/bn_lib.c:246
3455	3455	1 : View List ['ERR_put_error']	3455	3455	bn_expand_internal	call site: 00908	/src/openssl111/crypto/bn/bn_lib.c:281
3455	3455	1 : View List ['ERR_put_error']	3455	3455	OPENSSL_init_crypto	call site: 00009	/src/openssl111/crypto/init.c:613
3454	3454	1 : View List ['ENGINE_register_all_complete']	3454	3459	OPENSSL_init_crypto	call site: 00014	/src/openssl111/crypto/init.c:737
3452	3452	1 : View List ['drbg_delete_thread_state']	3452	3456	ossl_init_thread_stop	call site: 00042	/src/openssl111/crypto/init.c:440
95	95	1 : View List ['BN_free']	95	95	BN_bin2bn	call site: 02817	/src/openssl111/crypto/bn/bn_lib.c:454

Runtime coverage analysis

Covered functions

176

Functions that are reachable but not covered

755

Reachable functions

926

Percentage of reachable functions covered

18.47%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl111/fuzz/driver.c	1
openssl111/fuzz/bndiv.c	1
openssl111/crypto/bn/bn_lib.c	24
openssl111/crypto/mem.c	7
openssl111/crypto/err/err.c	30
openssl111/crypto/init.c	45
openssl111/crypto/threads_pthread.c	13
openssl111/crypto/async/async.c	10
openssl111/crypto/async/async_local.h	2
openssl111/crypto/stack/stack.c	10
openssl111/crypto/async/arch/async_posix.c	2
openssl111/crypto/rand/drbg_lib.c	4
openssl111/crypto/rand/rand_lib.c	5
openssl111/crypto/mem_sec.c	18
openssl111/crypto/cryptlib.c	6
openssl111/crypto/ex_data.c	10
openssl111/crypto/comp/c_zlib.c	1
openssl111/crypto/rand/rand_unix.c	4
openssl111/crypto/engine/eng_init.c	4
openssl111/crypto/engine/eng_lib.c	23
openssl111/include/internal/refcount.h	2
openssl111/crypto/engine/tb_pkmeth.c	4
openssl111/crypto/evp/pmeth_lib.c	4
openssl111/crypto/engine/tb_asnmth.c	9
openssl111/crypto/asn1/ameth_lib.c	8
openssl111/crypto/engine/eng_list.c	10
openssl111/include/internal/cryptlib.h	7
openssl111/include/openssl/crypto.h	6
openssl111/crypto/conf/conf_mod.c	15
openssl111/include/openssl/conf.h	18
openssl111/crypto/dso/dso_lib.c	8
openssl111/crypto/engine/eng_local.h	14
openssl111/crypto/store/store_init.c	1
openssl111/crypto/store/store_register.c	1
openssl111/crypto/store/store_local.h	2
openssl111/crypto/lhash/lhash.c	11
openssl111/crypto/bio/bio_lib.c	12
openssl111/crypto/bio/b_sock.c	1
openssl111/crypto/evp/names.c	5
openssl111/crypto/objects/o_names.c	10
openssl111/crypto/objects/obj_local.h	18
openssl111/crypto/mem_dbg.c	1
openssl111/crypto/ctype.c	2
openssl111/crypto/evp/evp_pbe.c	6
openssl111/crypto/evp/evp_local.h	3
openssl111/crypto/objects/obj_xref.c	2
openssl111/crypto/objects/obj_xref.h	2
openssl111/include/crypto/evp.h	1
openssl111/crypto/objects/obj_dat.c	22
openssl111/crypto/asn1/a_object.c	6
openssl111/include/openssl/err.h	5
openssl111/crypto/err/err_all.c	1
openssl111/crypto/evp/c_allc.c	1
openssl111/crypto/evp/e_des.c	6
openssl111/crypto/evp/e_des3.c	11
openssl111/crypto/evp/e_xcbc_d.c	1
openssl111/crypto/evp/e_rc4.c	2
openssl111/crypto/evp/e_rc4_hmac_md5.c	1
openssl111/crypto/evp/e_idea.c	4
openssl111/crypto/evp/e_seed.c	4
openssl111/crypto/evp/e_sm4.c	5
openssl111/crypto/evp/e_rc2.c	6
openssl111/crypto/evp/e_bf.c	4
openssl111/crypto/evp/e_cast.c	4
openssl111/crypto/evp/e_rc5.c	4
openssl111/crypto/evp/e_aes.c	38
openssl111/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl111/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl111/crypto/evp/e_aria.c	27
openssl111/crypto/evp/e_camellia.c	21
openssl111/crypto/evp/e_chacha20_poly1305.c	2
openssl111/crypto/evp/c_alld.c	1
openssl111/crypto/evp/m_md4.c	1
openssl111/crypto/evp/m_md5.c	1
openssl111/crypto/evp/m_md5_sha1.c	1
openssl111/crypto/evp/m_sha1.c	7
openssl111/crypto/evp/m_mdc2.c	1
openssl111/crypto/evp/m_ripemd.c	1
openssl111/crypto/evp/m_wp.c	1
openssl111/crypto/sm3/m_sm3.c	1
openssl111/crypto/blake2/m_blake2b.c	1
openssl111/crypto/blake2/m_blake2s.c	1
openssl111/crypto/evp/m_sha3.c	6
openssl111/crypto/conf/conf_sap.c	2
openssl111/crypto/conf/conf_mall.c	1
openssl111/crypto/asn1/asn_moid.c	3
openssl111/crypto/o_str.c	8
openssl111/crypto/conf/conf_lib.c	8
openssl111/crypto/conf/conf_api.c	3
openssl111/crypto/bn/bn_local.h	1
openssl111/crypto/bn/bn_word.c	4
openssl111/crypto/bn/asm/x86_64-gcc.c	7
openssl111/include/internal/constant_time.h	4
openssl111/crypto/bn/bn_shift.c	3
openssl111/crypto/asn1/asn1_lib.c	11
openssl111/crypto/objects/obj_lib.c	1
openssl111/crypto/asn1/asn_mstbl.c	3
openssl111/crypto/x509v3/v3_utl.c	6
openssl111/crypto/asn1/asn1_gen.c	3
openssl111/crypto/asn1/tasn_dec.c	13
openssl111/crypto/engine/eng_openssl.c	20
openssl111/crypto/engine/eng_rdrand.c	4
openssl111/crypto/engine/tb_rand.c	4
openssl111/crypto/engine/eng_dyn.c	12
openssl111/include/openssl/safestack.h	6
openssl111/crypto/dso/dso_dlfcn.c	1
openssl111/engines/e_padlock.c	1
openssl111/engines/e_afalg.c	28
openssl111/engines/e_afalg_err.c	3
openssl111/crypto/evp/cmeth_lib.c	8
openssl111/crypto/evp/evp_lib.c	28
openssl111/crypto/evp/evp_enc.c	14
openssl111/crypto/engine/eng_fat.c	5
openssl111/crypto/engine/tb_cipher.c	7
openssl111/crypto/engine/eng_table.c	8
openssl111/crypto/engine/tb_digest.c	5
openssl111/crypto/engine/tb_rsa.c	4
openssl111/crypto/engine/tb_dsa.c	4
openssl111/crypto/engine/tb_dh.c	4
openssl111/crypto/engine/tb_eckey.c	4
openssl111/crypto/async/async_wait.c	3
openssl111/crypto/async/arch/async_posix.h	1
openssl111/crypto/rsa/rsa_ossl.c	1
openssl111/crypto/dsa/dsa_ossl.c	1
openssl111/crypto/ec/ec_kmeth.c	1
openssl111/crypto/dh/dh_key.c	1
openssl111/crypto/sha/sha_local.h	1
openssl111/include/crypto/md32_common.h	2
openssl111/crypto/engine/eng_pkey.c	1
openssl111/crypto/bio/bss_file.c	2
openssl111/crypto/o_fopen.c	1
openssl111/crypto/pem/pem_pkey.c	1
openssl111/crypto/pem/pem_lib.c	14
openssl111/crypto/bio/bss_mem.c	1
openssl111/crypto/evp/encode.c	7
openssl111/include/crypto/asn1.h	3
openssl111/crypto/evp/evp_key.c	3
openssl111/crypto/ui/ui_lib.c	11
openssl111/crypto/ui/ui_openssl.c	1
openssl111/crypto/ui/ui_null.c	1
openssl111/include/openssl/ui.h	5
openssl111/crypto/err/err_prn.c	1
openssl111/crypto/bio/b_print.c	9
openssl111/crypto/evp/digest.c	7
openssl111/crypto/evp/p_lib.c	6
openssl111/include/openssl/x509.h	1
openssl111/crypto/x509/x_attrib.c	1
openssl111/crypto/asn1/tasn_fre.c	5
openssl111/include/openssl/asn1t.h	6
openssl111/crypto/asn1/tasn_utl.c	9
openssl111/crypto/asn1/a_int.c	8
openssl111/crypto/asn1/p8_pkey.c	3
openssl111/crypto/buffer/buffer.c	2
openssl111/crypto/asn1/tasn_typ.c	6
openssl111/crypto/asn1/tasn_new.c	8
openssl111/crypto/asn1/a_type.c	1
openssl111/crypto/asn1/a_bitstr.c	1
openssl111/crypto/evp/evp_pkey.c	1
openssl111/crypto/bn/bn_print.c	3
openssl111/crypto/asn1/x_sig.c	3
openssl111/crypto/pkcs12/p12_p8d.c	1
openssl111/crypto/pkcs12/p12_decr.c	2
openssl111/crypto/asn1/d2i_pr.c	1
openssl111/crypto/asn1/a_strnid.c	6
openssl111/include/openssl/asn1.h	4
openssl111/crypto/engine/eng_cnf.c	5
openssl111/crypto/engine/eng_ctrl.c	6
openssl111/crypto/getenv.c	1
openssl111/crypto/evp/evp_cnf.c	2
openssl111/crypto/conf/conf_ssl.c	3
openssl111/crypto/engine/eng_all.c	1
openssl111/crypto/conf/conf_def.c	1
openssl111/crypto/x509/x509_def.c	1
openssl111/crypto/bn/bn_err.c	1
openssl111/crypto/rsa/rsa_err.c	1
openssl111/crypto/dh/dh_err.c	1
openssl111/crypto/evp/evp_err.c	1
openssl111/crypto/buffer/buf_err.c	1
openssl111/crypto/objects/obj_err.c	1
openssl111/crypto/pem/pem_err.c	1
openssl111/crypto/dsa/dsa_err.c	1
openssl111/crypto/x509/x509_err.c	1
openssl111/crypto/asn1/asn1_err.c	1
openssl111/crypto/conf/conf_err.c	1
openssl111/crypto/cpt_err.c	1
openssl111/crypto/comp/comp_err.c	1
openssl111/crypto/ec/ec_err.c	1
openssl111/crypto/bio/bio_err.c	1
openssl111/crypto/pkcs7/pkcs7err.c	1
openssl111/crypto/x509v3/v3err.c	1
openssl111/crypto/pkcs12/pk12err.c	1
openssl111/crypto/rand/rand_err.c	1
openssl111/crypto/dso/dso_err.c	1
openssl111/crypto/ts/ts_err.c	1
openssl111/crypto/engine/eng_err.c	1
openssl111/crypto/ocsp/ocsp_err.c	1
openssl111/crypto/ui/ui_err.c	1
openssl111/crypto/cms/cms_err.c	1
openssl111/crypto/ct/ct_err.c	1
openssl111/crypto/async/async_err.c	1
openssl111/crypto/kdf/kdf_err.c	1
openssl111/crypto/store/store_err.c	1
openssl111/crypto/bn/bn_div.c	3
openssl111/crypto/bn/bn_ctx.c	7
openssl111/crypto/bn/bn_mul.c	6
openssl111/crypto/bn/bn_add.c	3

Fuzzer: v3name

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4647	85.4%
gold	[1:9]	469	8.62%
yellow	[10:29]	17	0.31%
greenyellow	[30:49]	17	0.31%
lawngreen	50+	286	5.26%
All colors	5436	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
9386	9386	2 : View List ['conf_diagnostics', 'CONF_modules_load']	12843	16308	CONF_modules_load_file_ex	call site: 00400	/src/openssl/crypto/conf/conf_mod.c:206
5925	5925	1 : View List ['get_default_context']	5925	5925	ossl_lib_ctx_get_concrete	call site: 00163	/src/openssl/crypto/context.c:520
5924	11854	5 : View List ['EVP_RAND_CTX_free', 'CRYPTO_DOWN_REF.9536', 'CRYPTO_FREE_REF.9537', 'EVP_RAND_free', 'CRYPTO_free']	5924	11854	EVP_RAND_CTX_free	call site: 04981	/src/openssl/crypto/evp/evp_rand.c:378
5924	5924	1 : View List ['ossl_rand_crng_ctx_free']	5924	5954	context_deinit_objs	call site: 05025	/src/openssl/crypto/context.c:310
3474	39065	5 : View List ['ERR_set_error', 'ERR_new', 'ASN1_INTEGER_get', 'ERR_set_debug', 'OBJ_obj2nid']	3474	39065	ossl_asn1_do_adb	call site: 02529	/src/openssl/crypto/asn1/tasn_utl.c:234
3457	3457	1 : View List ['ERR_clear_last_mark']	3457	3457	CONF_modules_load_file_ex	call site: 04486	/src/openssl/crypto/conf/conf_mod.c:225
3455	3489	4 : View List ['ERR_put_error', 'CRYPTO_realloc', 'CRYPTO_malloc', 'ossl_assert_int']	3455	3489	doapr_outch	call site: 00348	/src/openssl111/crypto/bio/b_print.c:839
3455	3465	2 : View List ['ERR_put_error', 'ASN1_OBJECT_free']	3455	3465	OBJ_dup	call site: 00730	/src/openssl111/crypto/objects/obj_lib.c:47
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BUF_MEM_new	call site: 00000	/src/openssl111/crypto/buffer/buffer.c:36
80	94	3 : View List ['CRYPTO_clear_free', 'CRYPTO_free', 'CRYPTO_secure_clear_free']	80	94	BUF_MEM_free	call site: 00000	/src/openssl111/crypto/buffer/buffer.c:45
14	17788	4 : View List ['ERR_set_error', 'ERR_new', 'ERR_set_debug', 'ASN1_INTEGER_free']	14	17788	ossl_c2i_ASN1_INTEGER	call site: 05282	/src/openssl/crypto/asn1/a_int.c:306
11	11	1 : View List ['lh_ADDED_OBJ_retrieve']	11	19	ossl_obj_obj2nid	call site: 00691	/src/openssl/crypto/objects/obj_dat.c:374

Runtime coverage analysis

Covered functions

467

Functions that are reachable but not covered

1099

Reachable functions

1507

Percentage of reachable functions covered

27.07%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl/fuzz/driver.c	1
openssl/fuzz/v3name.c	1
openssl/crypto/x509/v3_genn.c	6
openssl/crypto/asn1/tasn_dec.c	14
openssl/crypto/err/err_blocks.c	4
openssl/crypto/err/err.c	30
openssl/crypto/init.c	40
openssl/crypto/err/err_local.h	6
openssl/crypto/mem.c	6
openssl/crypto/threads_pthread.c	14
openssl/crypto/err/err_save.c	1
openssl/crypto/initthread.c	21
openssl/crypto/stack/stack.c	19
openssl/crypto/comp/c_zlib.c	1
openssl/crypto/comp/c_brotli.c	1
openssl/crypto/comp/c_zstd.c	1
openssl/crypto/async/async.c	6
openssl/crypto/async/arch/async_posix.c	2
openssl/crypto/rand/rand_lib.c	11
openssl/providers/implementations/rands/seeding/rand_unix.c	4
openssl/crypto/engine/eng_init.c	4
openssl/crypto/cryptlib.c	2
openssl/crypto/engine/eng_lib.c	21
openssl/include/internal/refcount.h	4
openssl/crypto/engine/tb_pkmeth.c	7
openssl/crypto/evp/pmeth_lib.c	31
openssl/crypto/engine/tb_asnmth.c	8
openssl/crypto/asn1/ameth_lib.c	9
openssl/crypto/engine/eng_list.c	10
openssl/crypto/ex_data.c	12
openssl/crypto/context.c	16
openssl/crypto/property/property.c	29
openssl/crypto/sparse_array.c	1
openssl/crypto/provider_conf.c	14
openssl/crypto/evp/c_allc.c	1
openssl/crypto/evp/e_des.c	6
openssl/crypto/evp/names.c	9
openssl/crypto/objects/obj_dat.c	29
openssl/crypto/evp/c_alld.c	1
openssl/crypto/evp/legacy_md4.c	1
openssl/crypto/objects/o_names.c	12
openssl/crypto/objects/obj_local.h	18
openssl/crypto/lhash/lhash.c	13
openssl/crypto/evp/legacy_md5.c	1
openssl/crypto/evp/legacy_md5_sha1.c	1
openssl/crypto/evp/legacy_sha.c	13
openssl/crypto/evp/legacy_mdc2.c	1
openssl/crypto/evp/legacy_ripemd.c	1
openssl/crypto/evp/legacy_wp.c	1
openssl/crypto/sm3/legacy_sm3.c	1
openssl/crypto/evp/legacy_blake2.c	2
openssl/crypto/conf/conf_sap.c	2
openssl/crypto/conf/conf_mod.c	33
openssl/crypto/err/err_mark.c	3
openssl/crypto/getenv.c	1
openssl/crypto/o_str.c	14
openssl/crypto/x509/x509_def.c	1
openssl/crypto/bio/bio_print.c	9
openssl/include/internal/common.h	1
openssl/crypto/ctype.c	3
openssl/crypto/conf/conf_lib.c	10
openssl/crypto/conf/conf_def.c	1
openssl/include/openssl/err.h	4
openssl/crypto/conf/conf_api.c	3
openssl/include/openssl/conf.h	3
openssl/crypto/conf/conf_mall.c	1
openssl/crypto/asn1/asn_moid.c	3
openssl/crypto/bsearch.c	1
openssl/crypto/asn1/a_object.c	6
openssl/crypto/bn/bn_lib.c	26
openssl/crypto/bn/bn_local.h	1
openssl/crypto/mem_sec.c	18
openssl/crypto/bn/bn_word.c	4
openssl/crypto/bn/asm/x86_64-gcc.c	2
openssl/crypto/bn/bn_shift.c	2
openssl/crypto/asn1/asn1_lib.c	15
openssl/crypto/objects/obj_lib.c	2
openssl/crypto/asn1/asn_mstbl.c	3
openssl/crypto/x509/v3_utl.c	6
openssl/crypto/asn1/asn1_gen.c	3
openssl/crypto/asn1/a_strnid.c	6
openssl/include/openssl/asn1.h	3
openssl/crypto/engine/eng_openssl.c	20
openssl/include/internal/cryptlib.h	7
openssl/include/openssl/crypto.h	2
openssl/crypto/evp/evp_lib.c	37
openssl/crypto/provider_core.c	49
openssl/crypto/engine/eng_rdrand.c	4
openssl/crypto/engine/tb_rand.c	4
openssl/crypto/engine/eng_local.h	14
openssl/crypto/engine/eng_dyn.c	12
openssl/crypto/dso/dso_lib.c	9
openssl/include/openssl/safestack.h	4
openssl/crypto/dso/dso_dlfcn.c	1
openssl/engines/e_padlock.c	22
openssl/crypto/engine/tb_cipher.c	7
openssl/crypto/evp/cmeth_lib.c	8
openssl/crypto/evp/evp_enc.c	26
openssl/crypto/params.c	48
openssl/crypto/evp/evp_utils.c	5
openssl/crypto/asn1/evp_asn1.c	1
openssl/crypto/asn1/tasn_typ.c	9
openssl/crypto/asn1/a_octet.c	2
openssl/crypto/asn1/a_type.c	2
openssl/crypto/asn1/tasn_fre.c	5
openssl/engines/e_afalg.c	28
openssl/engines/e_afalg_err.c	3
openssl/crypto/provider_local.h	4
openssl/crypto/provider_child.c	4
openssl/providers/implementations/rands/crngt.c	2
openssl/crypto/evp/digest.c	18
openssl/crypto/evp/evp_fetch.c	16
openssl/crypto/core_namemap.c	22
openssl/crypto/engine/eng_fat.c	5
openssl/crypto/engine/eng_table.c	8
openssl/crypto/engine/tb_digest.c	7
openssl/crypto/engine/tb_rsa.c	4
openssl/crypto/engine/tb_dsa.c	4
openssl/crypto/engine/tb_dh.c	4
openssl/crypto/engine/tb_eckey.c	4
openssl/include/crypto/asn1.h	3
openssl/crypto/core_fetch.c	3
openssl/crypto/core_algorithm.c	4
openssl/include/openssl/core_dispatch.h	79
openssl/crypto/encode_decode/decoder_pkey.c	27
openssl/crypto/async/async_wait.c	3
openssl/crypto/async/arch/async_posix.h	1
openssl/crypto/rsa/rsa_ossl.c	1
openssl/crypto/dsa/dsa_ossl.c	1
openssl/crypto/ec/ec_kmeth.c	1
openssl/crypto/dh/dh_key.c	1
openssl/crypto/rand/rand_meth.c	1
openssl/crypto/sha/sha_local.h	1
openssl/include/crypto/md32_common.h	2
openssl/crypto/engine/eng_pkey.c	1
openssl/crypto/bio/bss_file.c	2
openssl/crypto/o_fopen.c	1
openssl/crypto/bio/bio_lib.c	14
openssl/crypto/pem/pem_pkey.c	5
openssl/crypto/bio/bf_readbuff.c	1
openssl/crypto/pem/pem_lib.c	15
openssl/crypto/evp/evp_key.c	3
openssl/crypto/ui/ui_lib.c	27
openssl/crypto/ui/ui_openssl.c	1
openssl/crypto/ui/ui_null.c	1
openssl/include/openssl/ui.h	2
openssl/crypto/err/err_prn.c	1
openssl/crypto/passphrase.c	9
openssl/crypto/encode_decode/decoder_meth.c	21
openssl/crypto/encode_decode/decoder_lib.c	27
openssl/crypto/evp/keymgmt_meth.c	19
openssl/crypto/provider.c	2
openssl/crypto/property/property_query.c	3
openssl/crypto/property/property_string.c	17
openssl/crypto/property/property_parse.c	25
openssl/crypto/encode_decode/encoder_local.h	6
openssl/crypto/evp/keymgmt_lib.c	13
openssl/crypto/evp/p_lib.c	19
openssl/include/crypto/evp.h	8
openssl/include/openssl/x509.h	1
openssl/crypto/x509/x_attrib.c	2
openssl/include/openssl/asn1t.h	2
openssl/crypto/asn1/tasn_utl.c	13
openssl/crypto/asn1/a_int.c	10
openssl/crypto/bio/bss_mem.c	3
openssl/crypto/bio/ossl_core_bio.c	3
openssl/crypto/ui/ui_util.c	8
openssl/crypto/evp/encode.c	7
openssl/crypto/evp/m_sigver.c	7
openssl/crypto/evp/signature.c	9
openssl/crypto/evp/exchange.c	2
openssl/crypto/evp/kem.c	2
openssl/crypto/evp/asymcipher.c	2
openssl/crypto/evp/ctrl_params_translate.c	10
openssl/crypto/params_from_text.c	3
openssl/crypto/bn/bn_conv.c	4
openssl/crypto/asn1/p8_pkey.c	4
openssl/crypto/evp/evp_pkey.c	1
openssl/crypto/asn1/x_sig.c	3
openssl/crypto/pkcs12/p12_p8d.c	2
openssl/crypto/pkcs12/p12_decr.c	2
openssl/crypto/evp/evp_pbe.c	6
openssl/crypto/evp/evp_local.h	4
openssl/crypto/asn1/d2i_pr.c	1
openssl/crypto/x509/x_pubkey.c	7
openssl/crypto/engine/eng_cnf.c	5
openssl/crypto/engine/eng_all.c	1
openssl/crypto/engine/eng_ctrl.c	7
openssl/crypto/evp/evp_cnf.c	2
openssl/crypto/conf/conf_ssl.c	3
openssl/crypto/encode_decode/encoder_meth.c	3
openssl/crypto/store/store_meth.c	3
openssl/crypto/evp/e_des3.c	11
openssl/crypto/evp/e_xcbc_d.c	1
openssl/crypto/evp/e_rc4.c	2
openssl/crypto/evp/e_rc4_hmac_md5.c	1
openssl/crypto/evp/e_idea.c	4
openssl/crypto/evp/e_seed.c	4
openssl/crypto/evp/e_sm4.c	5
openssl/crypto/evp/e_rc2.c	6
openssl/crypto/evp/e_bf.c	4
openssl/crypto/evp/e_cast.c	4
openssl/crypto/evp/e_rc5.c	4
openssl/crypto/evp/e_aes.c	38
openssl/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl/crypto/evp/e_aria.c	27
openssl/crypto/evp/e_camellia.c	21
openssl/crypto/evp/e_chacha20_poly1305.c	2
openssl/crypto/err/err_all.c	1
openssl/crypto/bn/bn_err.c	1
openssl/crypto/rsa/rsa_err.c	1
openssl/crypto/dh/dh_err.c	1
openssl/crypto/evp/evp_err.c	1
openssl/crypto/buffer/buf_err.c	1
openssl/crypto/objects/obj_err.c	1
openssl/crypto/pem/pem_err.c	1
openssl/crypto/dsa/dsa_err.c	1
openssl/crypto/x509/x509_err.c	1
openssl/crypto/asn1/asn1_err.c	1
openssl/crypto/conf/conf_err.c	1
openssl/crypto/cpt_err.c	1
openssl/crypto/comp/comp_err.c	1
openssl/crypto/ec/ec_err.c	1
openssl/crypto/bio/bio_err.c	1
openssl/crypto/pkcs7/pkcs7err.c	1
openssl/crypto/x509/v3err.c	1
openssl/crypto/pkcs12/pk12err.c	1
openssl/crypto/rand/rand_err.c	1
openssl/crypto/dso/dso_err.c	1
openssl/crypto/ts/ts_err.c	1
openssl/crypto/engine/eng_err.c	1
openssl/crypto/http/http_err.c	1
openssl/crypto/ocsp/ocsp_err.c	1
openssl/crypto/ui/ui_err.c	1
openssl/crypto/cms/cms_err.c	1
openssl/crypto/crmf/crmf_err.c	1
openssl/crypto/cmp/cmp_err.c	1
openssl/crypto/ct/ct_err.c	1
openssl/crypto/ess/ess_err.c	1
openssl/crypto/async/async_err.c	1
openssl/crypto/store/store_err.c	1
openssl/crypto/property/property_err.c	1
openssl/providers/common/provider_err.c	1
openssl/crypto/property/defn_cache.c	5
openssl/crypto/bio/bss_core.c	2
openssl/providers/implementations/rands/drbg.c	2
openssl/crypto/self_test_core.c	2
openssl/crypto/thread/internal.c	2
openssl/crypto/thread/arch/thread_posix.c	4
openssl/crypto/evp/evp_rand.c	3
openssl/crypto/store/store_init.c	1
openssl/crypto/store/store_register.c	1
openssl/crypto/store/store_local.h	1
openssl/crypto/bio/bio_sock.c	1
openssl/crypto/objects/obj_xref.c	2
openssl/crypto/objects/obj_xref.h	2
openssl/crypto/cmp/cmp_util.c	1
openssl/crypto/trace.c	2
openssl/crypto/cpuid.c	4
openssl/crypto/buffer/buffer.c	2
openssl/crypto/asn1/tasn_new.c	9
openssl/crypto/asn1/a_bitstr.c	2
openssl/crypto/x509/x509_cmp.c	1
openssl/crypto/x509/x_name.c	2
openssl/crypto/asn1/tasn_enc.c	8
openssl/crypto/asn1/asn1_local.h	3

Fuzzer: crl

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3876	67.7%
gold	[1:9]	971	16.9%
yellow	[10:29]	75	1.31%
greenyellow	[30:49]	11	0.19%
lawngreen	50+	786	13.7%
All colors	5719	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
20741	30171	13 : View List ['DSO_free', 'DSO_merge', 'DSO_convert_filename', 'DSO_new', 'ossl_safe_getenv', 'CRYPTO_THREAD_read_lock', 'DSO_bind_func', 'get_provider_store', 'CRYPTO_THREAD_unlock', 'DSO_load', 'CRYPTO_strdup', 'CRYPTO_free', 'DSO_ctrl']	24200	86971	provider_init	call site: 01590	/src/openssl/crypto/provider_core.c:886
10374	13837	5 : View List ['ENGINE_get_digest', 'ENGINE_finish', 'EVP_PKEY_CTX_ctrl', 'ENGINE_init', 'CRYPTO_zalloc']	10374	61260	evp_md_init_internal	call site: 03575	/src/openssl/crypto/evp/digest.c:226
9386	9386	2 : View List ['conf_diagnostics', 'CONF_modules_load']	12843	16308	CONF_modules_load_file_ex	call site: 00400	/src/openssl/crypto/conf/conf_mod.c:206
7508	7508	2 : View List ['EVP_DigestVerifyInit', 'EVP_DigestSignInit']	7508	25282	evp_md_init_internal	call site: 02989	/src/openssl/crypto/evp/digest.c:166
5933	5933	1 : View List ['parse_oct']	5933	5933	parse_value	call site: 04152	/src/openssl/crypto/property/property_parse.c:244
5930	5930	1 : View List ['parse_hex']	5930	5930	parse_value	call site: 04144	/src/openssl/crypto/property/property_parse.c:241
5929	5929	1 : View List ['parse_string']	5929	5929	parse_value	call site: 04134	/src/openssl/crypto/property/property_parse.c:231
5929	5929	1 : View List ['parse_number']	5929	5929	parse_value	call site: 04157	/src/openssl/crypto/property/property_parse.c:247
5926	11855	2 : View List ['ossl_provider_up_ref_parent', 'ossl_provider_free']	5926	11855	ossl_provider_up_ref	call site: 01785	/src/openssl/crypto/provider_core.c:484
5926	5926	1 : View List ['ossl_method_cache_flush_some']	11852	17831	ossl_method_store_cache_set	call site: 01709	/src/openssl/crypto/property/property.c:720
5926	5926	1 : View List ['ossl_provider_free_parent']	5926	5926	provider_deactivate	call site: 01684	/src/openssl/crypto/provider_core.c:1146
5924	11854	5 : View List ['EVP_RAND_CTX_free', 'CRYPTO_DOWN_REF.9536', 'CRYPTO_FREE_REF.9537', 'EVP_RAND_free', 'CRYPTO_free']	5924	11854	EVP_RAND_CTX_free	call site: 04981	/src/openssl/crypto/evp/evp_rand.c:378

Runtime coverage analysis

Covered functions

1353

Functions that are reachable but not covered

697

Reachable functions

1620

Percentage of reachable functions covered

56.98%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl/fuzz/driver.c	1
openssl/fuzz/crl.c	1
openssl/crypto/x509/x_crl.c	4
openssl/crypto/asn1/tasn_dec.c	14
openssl/crypto/err/err_blocks.c	4
openssl/crypto/err/err.c	30
openssl/crypto/init.c	40
openssl/crypto/err/err_local.h	6
openssl/crypto/mem.c	6
openssl/crypto/threads_pthread.c	14
openssl/crypto/err/err_save.c	1
openssl/crypto/initthread.c	21
openssl/crypto/stack/stack.c	19
openssl/crypto/comp/c_zlib.c	1
openssl/crypto/comp/c_brotli.c	1
openssl/crypto/comp/c_zstd.c	1
openssl/crypto/async/async.c	6
openssl/crypto/async/arch/async_posix.c	2
openssl/crypto/rand/rand_lib.c	11
openssl/providers/implementations/rands/seeding/rand_unix.c	4
openssl/crypto/engine/eng_init.c	4
openssl/crypto/cryptlib.c	2
openssl/crypto/engine/eng_lib.c	21
openssl/include/internal/refcount.h	4
openssl/crypto/engine/tb_pkmeth.c	7
openssl/crypto/evp/pmeth_lib.c	31
openssl/crypto/engine/tb_asnmth.c	8
openssl/crypto/asn1/ameth_lib.c	9
openssl/crypto/engine/eng_list.c	10
openssl/crypto/ex_data.c	12
openssl/crypto/context.c	16
openssl/crypto/property/property.c	29
openssl/crypto/sparse_array.c	1
openssl/crypto/provider_conf.c	14
openssl/crypto/evp/c_allc.c	1
openssl/crypto/evp/e_des.c	6
openssl/crypto/evp/names.c	9
openssl/crypto/objects/obj_dat.c	29
openssl/crypto/evp/c_alld.c	1
openssl/crypto/evp/legacy_md4.c	1
openssl/crypto/objects/o_names.c	12
openssl/crypto/objects/obj_local.h	18
openssl/crypto/lhash/lhash.c	13
openssl/crypto/evp/legacy_md5.c	1
openssl/crypto/evp/legacy_md5_sha1.c	1
openssl/crypto/evp/legacy_sha.c	13
openssl/crypto/evp/legacy_mdc2.c	1
openssl/crypto/evp/legacy_ripemd.c	1
openssl/crypto/evp/legacy_wp.c	1
openssl/crypto/sm3/legacy_sm3.c	1
openssl/crypto/evp/legacy_blake2.c	2
openssl/crypto/conf/conf_sap.c	2
openssl/crypto/conf/conf_mod.c	33
openssl/crypto/err/err_mark.c	3
openssl/crypto/getenv.c	1
openssl/crypto/o_str.c	14
openssl/crypto/x509/x509_def.c	1
openssl/crypto/bio/bio_print.c	11
openssl/include/internal/common.h	1
openssl/crypto/ctype.c	5
openssl/crypto/conf/conf_lib.c	10
openssl/crypto/conf/conf_def.c	1
openssl/include/openssl/err.h	4
openssl/crypto/conf/conf_api.c	3
openssl/include/openssl/conf.h	3
openssl/crypto/conf/conf_mall.c	1
openssl/crypto/asn1/asn_moid.c	3
openssl/crypto/bsearch.c	1
openssl/crypto/asn1/a_object.c	7
openssl/crypto/bn/bn_lib.c	26
openssl/crypto/bn/bn_local.h	1
openssl/crypto/mem_sec.c	18
openssl/crypto/bn/bn_word.c	4
openssl/crypto/bn/asm/x86_64-gcc.c	2
openssl/crypto/bn/bn_shift.c	2
openssl/crypto/asn1/asn1_lib.c	14
openssl/crypto/objects/obj_lib.c	1
openssl/crypto/asn1/asn_mstbl.c	3
openssl/crypto/x509/v3_utl.c	6
openssl/crypto/asn1/asn1_gen.c	3
openssl/crypto/asn1/a_strnid.c	6
openssl/include/openssl/asn1.h	3
openssl/crypto/engine/eng_openssl.c	20
openssl/include/internal/cryptlib.h	7
openssl/include/openssl/crypto.h	2
openssl/crypto/evp/evp_lib.c	37
openssl/crypto/provider_core.c	49
openssl/crypto/engine/eng_rdrand.c	4
openssl/crypto/engine/tb_rand.c	4
openssl/crypto/engine/eng_local.h	14
openssl/crypto/engine/eng_dyn.c	12
openssl/crypto/dso/dso_lib.c	9
openssl/include/openssl/safestack.h	4
openssl/crypto/dso/dso_dlfcn.c	1
openssl/engines/e_padlock.c	22
openssl/crypto/engine/tb_cipher.c	7
openssl/crypto/evp/cmeth_lib.c	8
openssl/crypto/evp/evp_enc.c	26
openssl/crypto/params.c	48
openssl/crypto/evp/evp_utils.c	5
openssl/crypto/asn1/evp_asn1.c	1
openssl/crypto/asn1/tasn_typ.c	17
openssl/crypto/asn1/a_octet.c	1
openssl/crypto/asn1/a_type.c	1
openssl/crypto/asn1/tasn_fre.c	5
openssl/engines/e_afalg.c	28
openssl/engines/e_afalg_err.c	3
openssl/crypto/provider_local.h	4
openssl/crypto/provider_child.c	4
openssl/providers/implementations/rands/crngt.c	2
openssl/crypto/evp/digest.c	18
openssl/crypto/evp/evp_fetch.c	16
openssl/crypto/core_namemap.c	22
openssl/crypto/engine/eng_fat.c	5
openssl/crypto/engine/eng_table.c	8
openssl/crypto/engine/tb_digest.c	7
openssl/crypto/engine/tb_rsa.c	4
openssl/crypto/engine/tb_dsa.c	4
openssl/crypto/engine/tb_dh.c	4
openssl/crypto/engine/tb_eckey.c	4
openssl/include/crypto/asn1.h	3
openssl/crypto/core_fetch.c	3
openssl/crypto/core_algorithm.c	4
openssl/include/openssl/core_dispatch.h	79
openssl/crypto/encode_decode/decoder_pkey.c	27
openssl/crypto/async/async_wait.c	3
openssl/crypto/async/arch/async_posix.h	1
openssl/crypto/rsa/rsa_ossl.c	1
openssl/crypto/dsa/dsa_ossl.c	1
openssl/crypto/ec/ec_kmeth.c	1
openssl/crypto/dh/dh_key.c	1
openssl/crypto/rand/rand_meth.c	1
openssl/crypto/sha/sha_local.h	1
openssl/include/crypto/md32_common.h	2
openssl/crypto/engine/eng_pkey.c	1
openssl/crypto/bio/bss_file.c	2
openssl/crypto/o_fopen.c	1
openssl/crypto/bio/bio_lib.c	17
openssl/crypto/pem/pem_pkey.c	5
openssl/crypto/bio/bf_readbuff.c	1
openssl/crypto/pem/pem_lib.c	15
openssl/crypto/evp/evp_key.c	3
openssl/crypto/ui/ui_lib.c	27
openssl/crypto/ui/ui_openssl.c	1
openssl/crypto/ui/ui_null.c	1
openssl/include/openssl/ui.h	2
openssl/crypto/err/err_prn.c	1
openssl/crypto/passphrase.c	9
openssl/crypto/encode_decode/decoder_meth.c	21
openssl/crypto/encode_decode/decoder_lib.c	27
openssl/crypto/evp/keymgmt_meth.c	19
openssl/crypto/provider.c	2
openssl/crypto/property/property_query.c	3
openssl/crypto/property/property_string.c	17
openssl/crypto/property/property_parse.c	25
openssl/crypto/encode_decode/encoder_local.h	6
openssl/crypto/evp/keymgmt_lib.c	13
openssl/crypto/evp/p_lib.c	19
openssl/include/crypto/evp.h	8
openssl/include/openssl/x509.h	4
openssl/crypto/x509/x_attrib.c	2
openssl/include/openssl/asn1t.h	2
openssl/crypto/asn1/tasn_utl.c	13
openssl/crypto/asn1/a_int.c	10
openssl/crypto/bio/bss_mem.c	3
openssl/crypto/bio/ossl_core_bio.c	3
openssl/crypto/ui/ui_util.c	8
openssl/crypto/evp/encode.c	7
openssl/crypto/evp/m_sigver.c	7
openssl/crypto/evp/signature.c	9
openssl/crypto/evp/exchange.c	2
openssl/crypto/evp/kem.c	2
openssl/crypto/evp/asymcipher.c	2
openssl/crypto/evp/ctrl_params_translate.c	10
openssl/crypto/params_from_text.c	3
openssl/crypto/bn/bn_conv.c	4
openssl/crypto/asn1/p8_pkey.c	4
openssl/crypto/evp/evp_pkey.c	1
openssl/crypto/asn1/x_sig.c	3
openssl/crypto/pkcs12/p12_p8d.c	2
openssl/crypto/pkcs12/p12_decr.c	2
openssl/crypto/evp/evp_pbe.c	6
openssl/crypto/evp/evp_local.h	4
openssl/crypto/asn1/d2i_pr.c	1
openssl/crypto/x509/x_pubkey.c	7
openssl/crypto/engine/eng_cnf.c	5
openssl/crypto/engine/eng_all.c	1
openssl/crypto/engine/eng_ctrl.c	7
openssl/crypto/evp/evp_cnf.c	2
openssl/crypto/conf/conf_ssl.c	3
openssl/crypto/encode_decode/encoder_meth.c	3
openssl/crypto/store/store_meth.c	3
openssl/crypto/evp/e_des3.c	11
openssl/crypto/evp/e_xcbc_d.c	1
openssl/crypto/evp/e_rc4.c	2
openssl/crypto/evp/e_rc4_hmac_md5.c	1
openssl/crypto/evp/e_idea.c	4
openssl/crypto/evp/e_seed.c	4
openssl/crypto/evp/e_sm4.c	5
openssl/crypto/evp/e_rc2.c	6
openssl/crypto/evp/e_bf.c	4
openssl/crypto/evp/e_cast.c	4
openssl/crypto/evp/e_rc5.c	4
openssl/crypto/evp/e_aes.c	38
openssl/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl/crypto/evp/e_aria.c	27
openssl/crypto/evp/e_camellia.c	21
openssl/crypto/evp/e_chacha20_poly1305.c	2
openssl/crypto/err/err_all.c	1
openssl/crypto/bn/bn_err.c	1
openssl/crypto/rsa/rsa_err.c	1
openssl/crypto/dh/dh_err.c	1
openssl/crypto/evp/evp_err.c	1
openssl/crypto/buffer/buf_err.c	1
openssl/crypto/objects/obj_err.c	1
openssl/crypto/pem/pem_err.c	1
openssl/crypto/dsa/dsa_err.c	1
openssl/crypto/x509/x509_err.c	1
openssl/crypto/asn1/asn1_err.c	1
openssl/crypto/conf/conf_err.c	1
openssl/crypto/cpt_err.c	1
openssl/crypto/comp/comp_err.c	1
openssl/crypto/ec/ec_err.c	1
openssl/crypto/bio/bio_err.c	1
openssl/crypto/pkcs7/pkcs7err.c	1
openssl/crypto/x509/v3err.c	1
openssl/crypto/pkcs12/pk12err.c	1
openssl/crypto/rand/rand_err.c	1
openssl/crypto/dso/dso_err.c	1
openssl/crypto/ts/ts_err.c	1
openssl/crypto/engine/eng_err.c	1
openssl/crypto/http/http_err.c	1
openssl/crypto/ocsp/ocsp_err.c	1
openssl/crypto/ui/ui_err.c	1
openssl/crypto/cms/cms_err.c	1
openssl/crypto/crmf/crmf_err.c	1
openssl/crypto/cmp/cmp_err.c	1
openssl/crypto/ct/ct_err.c	1
openssl/crypto/ess/ess_err.c	1
openssl/crypto/async/async_err.c	1
openssl/crypto/store/store_err.c	1
openssl/crypto/property/property_err.c	1
openssl/providers/common/provider_err.c	1
openssl/crypto/property/defn_cache.c	5
openssl/crypto/bio/bss_core.c	2
openssl/providers/implementations/rands/drbg.c	2
openssl/crypto/self_test_core.c	2
openssl/crypto/thread/internal.c	2
openssl/crypto/thread/arch/thread_posix.c	4
openssl/crypto/evp/evp_rand.c	3
openssl/crypto/store/store_init.c	1
openssl/crypto/store/store_register.c	1
openssl/crypto/store/store_local.h	1
openssl/crypto/bio/bio_sock.c	1
openssl/crypto/objects/obj_xref.c	9
openssl/crypto/objects/obj_xref.h	4
openssl/crypto/cmp/cmp_util.c	1
openssl/crypto/trace.c	2
openssl/crypto/cpuid.c	4
openssl/crypto/buffer/buffer.c	5
openssl/crypto/asn1/tasn_new.c	9
openssl/crypto/asn1/a_bitstr.c	2
openssl/crypto/bio/bss_null.c	1
openssl/crypto/x509/t_crl.c	2
openssl/crypto/x509/x509cset.c	10
openssl/crypto/x509/t_x509.c	2
openssl/crypto/bio/bio_dump.c	4
openssl/crypto/asn1/a_strex.c	8
openssl/crypto/x509/x_name.c	1
openssl/crypto/x509/x509_obj.c	1
openssl/crypto/x509/x509name.c	5
openssl/crypto/asn1/asn1_parse.c	4
openssl/crypto/asn1/tasn_enc.c	8
openssl/crypto/asn1/asn1_local.h	3
openssl/crypto/asn1/a_utf8.c	2
openssl/include/internal/unicode.h	1
openssl/crypto/asn1/a_time.c	6
openssl/crypto/o_time.c	4
openssl/crypto/x509/v3_prn.c	4
openssl/crypto/x509/x509_v3.c	3
openssl/crypto/x509/v3_lib.c	4
openssl/include/openssl/x509v3.h	2
openssl/crypto/bio/bf_prefix.c	1
openssl/crypto/asn1/a_print.c	1
openssl/crypto/asn1/f_int.c	1

Fuzzer: ct

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4870	87.4%
gold	[1:9]	383	6.87%
yellow	[10:29]	24	0.43%
greenyellow	[30:49]	8	0.14%
lawngreen	50+	282	5.06%
All colors	5567	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
6016	6016	1 : View List ['ossl_asn1_template_free']	6016	6016	ossl_asn1_item_embed_free	call site: 02503	/src/openssl/crypto/asn1/tasn_fre.c:48
5924	11854	5 : View List ['EVP_RAND_CTX_free', 'CRYPTO_DOWN_REF.9536', 'CRYPTO_FREE_REF.9537', 'EVP_RAND_free', 'CRYPTO_free']	5924	11854	EVP_RAND_CTX_free	call site: 04982	/src/openssl/crypto/evp/evp_rand.c:378
5924	5924	1 : View List ['ossl_rand_crng_ctx_free']	5924	5954	context_deinit_objs	call site: 05026	/src/openssl/crypto/context.c:310
3455	3489	4 : View List ['ERR_put_error', 'CRYPTO_realloc', 'CRYPTO_malloc', 'ossl_assert_int']	3455	3489	doapr_outch	call site: 00349	/src/openssl111/crypto/bio/b_print.c:839
3455	3465	3 : View List ['ERR_put_error', 'CRYPTO_malloc', 'CRYPTO_free']	3455	3465	i2o_SCT_signature	call site: 05490	/src/openssl111/crypto/ct/ct_oct.c:176
3455	3455	1 : View List ['ASN1_STRING_new']	3455	6928	ossl_asn1_time_from_tm	call site: 05426	/src/openssl/crypto/asn1/a_time.c:285
3455	3455	1 : View List ['ERR_put_error']	3455	3455	SCT_new	call site: 05359	/src/openssl111/crypto/ct/ct_sct.c:26
16	16	1 : View List ['CTLOG_STORE_get0_log_by_id']	18	21134	SCT_print	call site: 05384	/src/openssl111/crypto/ct/ct_prn.c:75
6	12	2 : View List ['CRYPTO_malloc', 'sk_EX_CALLBACK_value']	20	35	ossl_crypto_new_ex_data_ex	call site: 00878	/src/openssl/crypto/ex_data.c:239
6	12	3 : View List ['property_free', 'ossl_check_OPENSSL_CSTRING_sk_type.13567', 'OPENSSL_sk_pop']	6	17	ossl_property_string	call site: 02301	/src/openssl/crypto/property/property_string.c:181
6	6	1 : View List ['sk_EX_CALLBACK_value']	6	11	ossl_crypto_free_ex_index_ex	call site: 00000	/src/openssl/crypto/ex_data.c:127
3	3	1 : View List ['is_utc']	3458	6931	ossl_asn1_time_from_tm	call site: 05425	/src/openssl/crypto/asn1/a_time.c:278

Runtime coverage analysis

Covered functions

383

Functions that are reachable but not covered

1180

Reachable functions

1557

Percentage of reachable functions covered

24.21%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl/fuzz/driver.c	1
openssl/fuzz/ct.c	1
openssl/crypto/ct/ct_oct.c	8
openssl/crypto/asn1/tasn_typ.c	14
openssl/crypto/asn1/tasn_dec.c	14
openssl/crypto/err/err_blocks.c	4
openssl/crypto/err/err.c	30
openssl/crypto/init.c	40
openssl/crypto/err/err_local.h	6
openssl/crypto/mem.c	6
openssl/crypto/threads_pthread.c	14
openssl/crypto/err/err_save.c	1
openssl/crypto/initthread.c	21
openssl/crypto/stack/stack.c	19
openssl/crypto/comp/c_zlib.c	1
openssl/crypto/comp/c_brotli.c	1
openssl/crypto/comp/c_zstd.c	1
openssl/crypto/async/async.c	6
openssl/crypto/async/arch/async_posix.c	2
openssl/crypto/rand/rand_lib.c	11
openssl/providers/implementations/rands/seeding/rand_unix.c	4
openssl/crypto/engine/eng_init.c	4
openssl/crypto/cryptlib.c	2
openssl/crypto/engine/eng_lib.c	21
openssl/include/internal/refcount.h	4
openssl/crypto/engine/tb_pkmeth.c	7
openssl/crypto/evp/pmeth_lib.c	31
openssl/crypto/engine/tb_asnmth.c	8
openssl/crypto/asn1/ameth_lib.c	9
openssl/crypto/engine/eng_list.c	10
openssl/crypto/ex_data.c	12
openssl/crypto/context.c	16
openssl/crypto/property/property.c	29
openssl/crypto/sparse_array.c	1
openssl/crypto/provider_conf.c	14
openssl/crypto/evp/c_allc.c	1
openssl/crypto/evp/e_des.c	6
openssl/crypto/evp/names.c	9
openssl/crypto/objects/obj_dat.c	29
openssl/crypto/evp/c_alld.c	1
openssl/crypto/evp/legacy_md4.c	1
openssl/crypto/objects/o_names.c	12
openssl/crypto/objects/obj_local.h	18
openssl/crypto/lhash/lhash.c	13
openssl/crypto/evp/legacy_md5.c	1
openssl/crypto/evp/legacy_md5_sha1.c	1
openssl/crypto/evp/legacy_sha.c	13
openssl/crypto/evp/legacy_mdc2.c	1
openssl/crypto/evp/legacy_ripemd.c	1
openssl/crypto/evp/legacy_wp.c	1
openssl/crypto/sm3/legacy_sm3.c	1
openssl/crypto/evp/legacy_blake2.c	2
openssl/crypto/conf/conf_sap.c	2
openssl/crypto/conf/conf_mod.c	33
openssl/crypto/err/err_mark.c	3
openssl/crypto/getenv.c	1
openssl/crypto/o_str.c	14
openssl/crypto/x509/x509_def.c	1
openssl/crypto/bio/bio_print.c	11
openssl/include/internal/common.h	1
openssl/crypto/ctype.c	4
openssl/crypto/conf/conf_lib.c	10
openssl/crypto/conf/conf_def.c	1
openssl/include/openssl/err.h	4
openssl/crypto/conf/conf_api.c	3
openssl/include/openssl/conf.h	3
openssl/crypto/conf/conf_mall.c	1
openssl/crypto/asn1/asn_moid.c	3
openssl/crypto/bsearch.c	1
openssl/crypto/asn1/a_object.c	6
openssl/crypto/bn/bn_lib.c	26
openssl/crypto/bn/bn_local.h	1
openssl/crypto/mem_sec.c	18
openssl/crypto/bn/bn_word.c	4
openssl/crypto/bn/asm/x86_64-gcc.c	2
openssl/crypto/bn/bn_shift.c	2
openssl/crypto/asn1/asn1_lib.c	16
openssl/crypto/objects/obj_lib.c	1
openssl/crypto/asn1/asn_mstbl.c	3
openssl/crypto/x509/v3_utl.c	6
openssl/crypto/asn1/asn1_gen.c	3
openssl/crypto/asn1/a_strnid.c	6
openssl/include/openssl/asn1.h	3
openssl/crypto/engine/eng_openssl.c	20
openssl/include/internal/cryptlib.h	7
openssl/include/openssl/crypto.h	2
openssl/crypto/evp/evp_lib.c	37
openssl/crypto/provider_core.c	49
openssl/crypto/engine/eng_rdrand.c	4
openssl/crypto/engine/tb_rand.c	4
openssl/crypto/engine/eng_local.h	14
openssl/crypto/engine/eng_dyn.c	12
openssl/crypto/dso/dso_lib.c	9
openssl/include/openssl/safestack.h	4
openssl/crypto/dso/dso_dlfcn.c	1
openssl/engines/e_padlock.c	22
openssl/crypto/engine/tb_cipher.c	7
openssl/crypto/evp/cmeth_lib.c	8
openssl/crypto/evp/evp_enc.c	26
openssl/crypto/params.c	48
openssl/crypto/evp/evp_utils.c	5
openssl/crypto/asn1/evp_asn1.c	1
openssl/crypto/asn1/a_octet.c	1
openssl/crypto/asn1/a_type.c	1
openssl/crypto/asn1/tasn_fre.c	5
openssl/engines/e_afalg.c	28
openssl/engines/e_afalg_err.c	3
openssl/crypto/provider_local.h	4
openssl/crypto/provider_child.c	4
openssl/providers/implementations/rands/crngt.c	2
openssl/crypto/evp/digest.c	18
openssl/crypto/evp/evp_fetch.c	16
openssl/crypto/core_namemap.c	22
openssl/crypto/engine/eng_fat.c	5
openssl/crypto/engine/eng_table.c	8
openssl/crypto/engine/tb_digest.c	7
openssl/crypto/engine/tb_rsa.c	4
openssl/crypto/engine/tb_dsa.c	4
openssl/crypto/engine/tb_dh.c	4
openssl/crypto/engine/tb_eckey.c	4
openssl/include/crypto/asn1.h	3
openssl/crypto/core_fetch.c	3
openssl/crypto/core_algorithm.c	4
openssl/include/openssl/core_dispatch.h	79
openssl/crypto/encode_decode/decoder_pkey.c	27
openssl/crypto/async/async_wait.c	3
openssl/crypto/async/arch/async_posix.h	1
openssl/crypto/rsa/rsa_ossl.c	1
openssl/crypto/dsa/dsa_ossl.c	1
openssl/crypto/ec/ec_kmeth.c	1
openssl/crypto/dh/dh_key.c	1
openssl/crypto/rand/rand_meth.c	1
openssl/crypto/sha/sha_local.h	1
openssl/include/crypto/md32_common.h	2
openssl/crypto/engine/eng_pkey.c	1
openssl/crypto/bio/bss_file.c	2
openssl/crypto/o_fopen.c	1
openssl/crypto/bio/bio_lib.c	16
openssl/crypto/pem/pem_pkey.c	5
openssl/crypto/bio/bf_readbuff.c	1
openssl/crypto/pem/pem_lib.c	15
openssl/crypto/evp/evp_key.c	3
openssl/crypto/ui/ui_lib.c	27
openssl/crypto/ui/ui_openssl.c	1
openssl/crypto/ui/ui_null.c	1
openssl/include/openssl/ui.h	2
openssl/crypto/err/err_prn.c	1
openssl/crypto/passphrase.c	9
openssl/crypto/encode_decode/decoder_meth.c	21
openssl/crypto/encode_decode/decoder_lib.c	27
openssl/crypto/evp/keymgmt_meth.c	19
openssl/crypto/provider.c	2
openssl/crypto/property/property_query.c	3
openssl/crypto/property/property_string.c	17
openssl/crypto/property/property_parse.c	25
openssl/crypto/encode_decode/encoder_local.h	6
openssl/crypto/evp/keymgmt_lib.c	13
openssl/crypto/evp/p_lib.c	19
openssl/include/crypto/evp.h	8
openssl/include/openssl/x509.h	1
openssl/crypto/x509/x_attrib.c	2
openssl/include/openssl/asn1t.h	2
openssl/crypto/asn1/tasn_utl.c	13
openssl/crypto/asn1/a_int.c	10
openssl/crypto/bio/bss_mem.c	3
openssl/crypto/bio/ossl_core_bio.c	3
openssl/crypto/ui/ui_util.c	8
openssl/crypto/evp/encode.c	7
openssl/crypto/evp/m_sigver.c	7
openssl/crypto/evp/signature.c	9
openssl/crypto/evp/exchange.c	2
openssl/crypto/evp/kem.c	2
openssl/crypto/evp/asymcipher.c	2
openssl/crypto/evp/ctrl_params_translate.c	10
openssl/crypto/params_from_text.c	3
openssl/crypto/bn/bn_conv.c	4
openssl/crypto/asn1/p8_pkey.c	4
openssl/crypto/evp/evp_pkey.c	1
openssl/crypto/asn1/x_sig.c	3
openssl/crypto/pkcs12/p12_p8d.c	2
openssl/crypto/pkcs12/p12_decr.c	2
openssl/crypto/evp/evp_pbe.c	6
openssl/crypto/evp/evp_local.h	4
openssl/crypto/asn1/d2i_pr.c	1
openssl/crypto/x509/x_pubkey.c	7
openssl/crypto/engine/eng_cnf.c	5
openssl/crypto/engine/eng_all.c	1
openssl/crypto/engine/eng_ctrl.c	7
openssl/crypto/evp/evp_cnf.c	2
openssl/crypto/conf/conf_ssl.c	3
openssl/crypto/encode_decode/encoder_meth.c	3
openssl/crypto/store/store_meth.c	3
openssl/crypto/evp/e_des3.c	11
openssl/crypto/evp/e_xcbc_d.c	1
openssl/crypto/evp/e_rc4.c	2
openssl/crypto/evp/e_rc4_hmac_md5.c	1
openssl/crypto/evp/e_idea.c	4
openssl/crypto/evp/e_seed.c	4
openssl/crypto/evp/e_sm4.c	5
openssl/crypto/evp/e_rc2.c	6
openssl/crypto/evp/e_bf.c	4
openssl/crypto/evp/e_cast.c	4
openssl/crypto/evp/e_rc5.c	4
openssl/crypto/evp/e_aes.c	38
openssl/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl/crypto/evp/e_aria.c	27
openssl/crypto/evp/e_camellia.c	21
openssl/crypto/evp/e_chacha20_poly1305.c	2
openssl/crypto/err/err_all.c	1
openssl/crypto/bn/bn_err.c	1
openssl/crypto/rsa/rsa_err.c	1
openssl/crypto/dh/dh_err.c	1
openssl/crypto/evp/evp_err.c	1
openssl/crypto/buffer/buf_err.c	1
openssl/crypto/objects/obj_err.c	1
openssl/crypto/pem/pem_err.c	1
openssl/crypto/dsa/dsa_err.c	1
openssl/crypto/x509/x509_err.c	1
openssl/crypto/asn1/asn1_err.c	1
openssl/crypto/conf/conf_err.c	1
openssl/crypto/cpt_err.c	1
openssl/crypto/comp/comp_err.c	1
openssl/crypto/ec/ec_err.c	1
openssl/crypto/bio/bio_err.c	1
openssl/crypto/pkcs7/pkcs7err.c	1
openssl/crypto/x509/v3err.c	1
openssl/crypto/pkcs12/pk12err.c	1
openssl/crypto/rand/rand_err.c	1
openssl/crypto/dso/dso_err.c	1
openssl/crypto/ts/ts_err.c	1
openssl/crypto/engine/eng_err.c	1
openssl/crypto/http/http_err.c	1
openssl/crypto/ocsp/ocsp_err.c	1
openssl/crypto/ui/ui_err.c	1
openssl/crypto/cms/cms_err.c	1
openssl/crypto/crmf/crmf_err.c	1
openssl/crypto/cmp/cmp_err.c	1
openssl/crypto/ct/ct_err.c	1
openssl/crypto/ess/ess_err.c	1
openssl/crypto/async/async_err.c	1
openssl/crypto/store/store_err.c	1
openssl/crypto/property/property_err.c	1
openssl/providers/common/provider_err.c	1
openssl/crypto/property/defn_cache.c	5
openssl/crypto/bio/bss_core.c	2
openssl/providers/implementations/rands/drbg.c	2
openssl/crypto/self_test_core.c	2
openssl/crypto/thread/internal.c	2
openssl/crypto/thread/arch/thread_posix.c	4
openssl/crypto/evp/evp_rand.c	3
openssl/crypto/store/store_init.c	1
openssl/crypto/store/store_register.c	1
openssl/crypto/store/store_local.h	1
openssl/crypto/bio/bio_sock.c	1
openssl/crypto/objects/obj_xref.c	2
openssl/crypto/objects/obj_xref.h	2
openssl/crypto/cmp/cmp_util.c	1
openssl/crypto/trace.c	2
openssl/crypto/cpuid.c	4
openssl/crypto/buffer/buffer.c	2
openssl/crypto/asn1/tasn_new.c	9
openssl/crypto/asn1/a_bitstr.c	2
openssl/include/openssl/ct.h	3
openssl/crypto/ct/ct_sct.c	7
openssl/crypto/bio/bss_null.c	1
openssl/crypto/ct/ct_prn.c	4
openssl/crypto/ct/ct_log.c	2
openssl/crypto/bio/bio_dump.c	1
openssl/crypto/asn1/a_gentm.c	5
openssl/crypto/o_time.c	5
openssl/crypto/asn1/a_time.c	8
openssl/crypto/asn1/tasn_enc.c	8
openssl/crypto/asn1/asn1_local.h	3

Fuzzer: server

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4051	54.7%
gold	[1:9]	1192	16.1%
yellow	[10:29]	117	1.58%
greenyellow	[30:49]	51	0.68%
lawngreen	50+	1991	26.8%
All colors	7402	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
34547	55366	6 : View List ['BUF_MEM_grow_clean', 'ERR_put_error', 'ASN1_get_object', 'BIO_read', 'ERR_clear_error', 'ERR_peek_error']	34547	55455	asn1_d2i_read_bio	call site: 06007	/src/openssl111/crypto/asn1/a_d2i_fp.c:145
28780	34738	11 : View List ['ossl_ffc_params_set_gindex', 'BN_GENCB_set', 'ossl_dh_generate_ffc_parameters', 'ossl_ffc_set_digest', 'ossl_ffc_params_set_h', 'ossl_ffc_params_set_seed', 'ossl_dh_new_ex', 'ossl_ffc_params_copy', 'DH_generate_parameters_ex', 'ossl_ffc_params_set_pcounter', 'BN_GENCB_new']	28784	38219	dh_gen	call site: 00000	/src/openssl/providers/implementations/keymgmt/dh_kmgmt.c:710
20741	30171	13 : View List ['DSO_free', 'DSO_merge', 'DSO_convert_filename', 'DSO_new', 'ossl_safe_getenv', 'CRYPTO_THREAD_read_lock', 'DSO_bind_func', 'get_provider_store', 'CRYPTO_THREAD_unlock', 'DSO_load', 'CRYPTO_strdup', 'CRYPTO_free', 'DSO_ctrl']	24200	86971	provider_init	call site: 01588	/src/openssl/crypto/provider_core.c:886
18426	39765	7 : View List ['ossl_rsa_pss_decode', 'ERR_set_error', 'ossl_rsa_sync_to_pss_params_30', 'ERR_new', 'ossl_rsa_set0_pss_params', 'ERR_set_debug', 'RSA_PSS_PARAMS_free']	18426	39765	ossl_rsa_param_decode	call site: 00000	/src/openssl/crypto/rsa/rsa_backend.c:540
17315	17315	1 : View List ['EVP_get_cipherbyname']	17315	17315	ssl_cipher_get_evp	call site: 00000	/src/openssl111/ssl/ssl_ciph.c:556
13830	13830	3 : View List ['ENGINE_free', 'ENGINE_by_id', 'ENGINE_init']	13830	13830	load_common	call site: 00000	/src/openssl/providers/common/provider_util.c:70
13757	95733	22 : View List ['EC_GROUP_set_seed', 'BN_CTX_new_ex', 'EC_POINT_new', 'ec_group_explicit_to_named', 'OPENSSL_strcasecmp', 'EC_GROUP_get_degree', 'BN_CTX_free', 'EC_GROUP_set_generator', 'BN_CTX_get', 'EC_POINT_free', 'EC_GROUP_new_curve_GF2m', 'EC_POINT_oct2point', 'OSSL_PARAM_get_BN', 'BN_is_zero', 'BN_is_negative', 'EC_GROUP_set_point_conversion_form', 'BN_CTX_start', 'BN_num_bits', 'EC_GROUP_set_asn1_flag', 'BN_CTX_end', 'EC_GROUP_new_curve_GFp', 'ossl_ec_encoding_param2id']	13757	451611	EC_GROUP_new_from_params	call site: 00000	/src/openssl/crypto/ec/ec_lib.c:1557
11996	12000	7 : View List ['ossl_rsa_pss_params_30_set_defaults', 'ossl_rsa_pss_params_30_set_saltlen', 'ossl_rsa_pss_get_param_unverified', 'ossl_rsa_pss_params_30_set_maskgenhashalg', 'EVP_MD_get_type', 'ossl_rsa_pss_params_30_todata', 'ossl_rsa_pss_params_30_set_hashalg']	11996	18089	rsa_int_export_to	call site: 00000	/src/openssl/crypto/rsa/rsa_ameth.c:810
11848	11848	2 : View List ['sk_INFOPAIR_new_null', 'ossl_provider_info_add_parameter']	11848	21247	ossl_provider_new	call site: 04470	/src/openssl/crypto/provider_core.c:558
10501	13975	3 : View List ['ASN1_INTEGER_get', 'PROXY_CERT_INFO_EXTENSION_free', 'X509_get_ext_by_NID']	10501	114107	ossl_x509v3_cache_extensions	call site: 06431	/src/openssl/crypto/x509/v3_purp.c:457
10061	10067	4 : View List ['EC_GROUP_check_named_curve', 'EC_GROUP_check', 'EC_KEY_get0_group', 'EC_KEY_get_flags']	22428	35023	ec_validate	call site: 00000	/src/openssl/providers/implementations/keymgmt/ec_kmgmt.c:952
9914	9914	2 : View List ['ec_GF2m_simple_oct2point', 'ec_GFp_simple_oct2point']	9914	9914	EC_POINT_oct2point	call site: 00000	/src/openssl111/crypto/ec/ec_oct.c:113

Runtime coverage analysis

Covered functions

3908

Functions that are reachable but not covered

1029

Reachable functions

2707

Percentage of reachable functions covered

61.99%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl/fuzz/driver.c	1
openssl/fuzz/server.c	1
openssl/ssl/methods.c	1
openssl/ssl/ssl_lib.c	45
openssl/crypto/err/err_blocks.c	4
openssl/crypto/err/err.c	30
openssl/crypto/init.c	41
openssl/crypto/err/err_local.h	6
openssl/crypto/mem.c	6
openssl/crypto/threads_pthread.c	14
openssl/crypto/err/err_save.c	4
openssl/crypto/initthread.c	21
openssl/crypto/stack/stack.c	22
openssl/crypto/comp/c_zlib.c	2
openssl/crypto/comp/c_brotli.c	1
openssl/crypto/comp/c_zstd.c	1
openssl/crypto/async/async.c	17
openssl/crypto/async/arch/async_posix.c	5
openssl/crypto/rand/rand_lib.c	20
openssl/providers/implementations/rands/seeding/rand_unix.c	4
openssl/crypto/engine/eng_init.c	4
openssl/crypto/cryptlib.c	2
openssl/crypto/engine/eng_lib.c	21
openssl/include/internal/refcount.h	5
openssl/crypto/engine/tb_pkmeth.c	7
openssl/crypto/evp/pmeth_lib.c	31
openssl/crypto/engine/tb_asnmth.c	8
openssl/crypto/asn1/ameth_lib.c	9
openssl/crypto/engine/eng_list.c	10
openssl/crypto/ex_data.c	12
openssl/crypto/context.c	18
openssl/crypto/property/property.c	29
openssl/crypto/sparse_array.c	1
openssl/crypto/provider_conf.c	14
openssl/crypto/evp/c_allc.c	1
openssl/crypto/evp/e_des.c	6
openssl/crypto/evp/names.c	9
openssl/crypto/objects/obj_dat.c	30
openssl/crypto/evp/c_alld.c	1
openssl/crypto/evp/legacy_md4.c	1
openssl/crypto/objects/o_names.c	12
openssl/crypto/objects/obj_local.h	18
openssl/crypto/lhash/lhash.c	13
openssl/crypto/evp/legacy_md5.c	1
openssl/crypto/evp/legacy_md5_sha1.c	1
openssl/crypto/evp/legacy_sha.c	13
openssl/crypto/evp/legacy_mdc2.c	1
openssl/crypto/evp/legacy_ripemd.c	1
openssl/crypto/evp/legacy_wp.c	1
openssl/crypto/sm3/legacy_sm3.c	1
openssl/crypto/evp/legacy_blake2.c	2
openssl/crypto/conf/conf_sap.c	2
openssl/crypto/conf/conf_mod.c	33
openssl/crypto/err/err_mark.c	4
openssl/crypto/getenv.c	1
openssl/crypto/o_str.c	14
openssl/crypto/x509/x509_def.c	1
openssl/crypto/bio/bio_print.c	11
openssl/include/internal/common.h	1
openssl/crypto/ctype.c	3
openssl/crypto/conf/conf_lib.c	10
openssl/crypto/conf/conf_def.c	1
openssl/include/openssl/err.h	4
openssl/crypto/conf/conf_api.c	3
openssl/include/openssl/conf.h	3
openssl/crypto/conf/conf_mall.c	1
openssl/crypto/asn1/asn_moid.c	3
openssl/crypto/bsearch.c	1
openssl/crypto/asn1/a_object.c	6
openssl/crypto/bn/bn_lib.c	27
openssl/crypto/bn/bn_local.h	1
openssl/crypto/mem_sec.c	18
openssl/crypto/bn/bn_word.c	4
openssl/crypto/bn/asm/x86_64-gcc.c	2
openssl/crypto/bn/bn_shift.c	2
openssl/crypto/asn1/asn1_lib.c	15
openssl/crypto/objects/obj_lib.c	2
openssl/crypto/asn1/asn_mstbl.c	3
openssl/crypto/x509/v3_utl.c	6
openssl/crypto/asn1/asn1_gen.c	3
openssl/crypto/asn1/tasn_dec.c	14
openssl/crypto/asn1/a_strnid.c	6
openssl/include/openssl/asn1.h	7
openssl/crypto/engine/eng_openssl.c	20
openssl/include/internal/cryptlib.h	7
openssl/include/openssl/crypto.h	2
openssl/crypto/evp/evp_lib.c	39
openssl/crypto/provider_core.c	49
openssl/crypto/engine/eng_rdrand.c	4
openssl/crypto/engine/tb_rand.c	6
openssl/crypto/engine/eng_local.h	14
openssl/crypto/engine/eng_dyn.c	12
openssl/crypto/dso/dso_lib.c	9
openssl/include/openssl/safestack.h	4
openssl/crypto/dso/dso_dlfcn.c	1
openssl/engines/e_padlock.c	22
openssl/crypto/engine/tb_cipher.c	7
openssl/crypto/evp/cmeth_lib.c	8
openssl/crypto/evp/evp_enc.c	26
openssl/crypto/params.c	51
openssl/crypto/evp/evp_utils.c	5
openssl/crypto/asn1/evp_asn1.c	1
openssl/crypto/asn1/tasn_typ.c	11
openssl/crypto/asn1/a_octet.c	2
openssl/crypto/asn1/a_type.c	1
openssl/crypto/asn1/tasn_fre.c	5
openssl/engines/e_afalg.c	28
openssl/engines/e_afalg_err.c	3
openssl/crypto/provider_local.h	4
openssl/crypto/provider_child.c	4
openssl/providers/implementations/rands/crngt.c	2
openssl/crypto/evp/digest.c	19
openssl/crypto/evp/evp_fetch.c	16
openssl/crypto/core_namemap.c	22
openssl/crypto/engine/eng_fat.c	5
openssl/crypto/engine/eng_table.c	8
openssl/crypto/engine/tb_digest.c	7
openssl/crypto/engine/tb_rsa.c	4
openssl/crypto/engine/tb_dsa.c	4
openssl/crypto/engine/tb_dh.c	4
openssl/crypto/engine/tb_eckey.c	4
openssl/include/crypto/asn1.h	3
openssl/crypto/core_fetch.c	3
openssl/crypto/core_algorithm.c	4
openssl/include/openssl/core_dispatch.h	103
openssl/crypto/encode_decode/decoder_pkey.c	27
openssl/crypto/async/async_wait.c	5
openssl/crypto/async/arch/async_posix.h	1
openssl/crypto/rsa/rsa_ossl.c	2
openssl/crypto/dsa/dsa_ossl.c	2
openssl/crypto/ec/ec_kmeth.c	2
openssl/crypto/dh/dh_key.c	2
openssl/crypto/rand/rand_meth.c	1
openssl/crypto/sha/sha_local.h	1
openssl/include/crypto/md32_common.h	2
openssl/crypto/engine/eng_pkey.c	1
openssl/crypto/bio/bss_file.c	3
openssl/crypto/o_fopen.c	1
openssl/crypto/bio/bio_lib.c	23
openssl/crypto/pem/pem_pkey.c	5
openssl/crypto/bio/bf_readbuff.c	1
openssl/crypto/pem/pem_lib.c	15
openssl/crypto/evp/evp_key.c	3
openssl/crypto/ui/ui_lib.c	27
openssl/crypto/ui/ui_openssl.c	1
openssl/crypto/ui/ui_null.c	1
openssl/include/openssl/ui.h	2
openssl/crypto/err/err_prn.c	2
openssl/crypto/passphrase.c	9
openssl/crypto/encode_decode/decoder_meth.c	21
openssl/crypto/encode_decode/decoder_lib.c	28
openssl/crypto/evp/keymgmt_meth.c	22
openssl/crypto/provider.c	4
openssl/crypto/property/property_query.c	3
openssl/crypto/property/property_string.c	17
openssl/crypto/property/property_parse.c	25
openssl/crypto/encode_decode/encoder_local.h	6
openssl/crypto/evp/keymgmt_lib.c	16
openssl/crypto/evp/p_lib.c	32
openssl/include/crypto/evp.h	8
openssl/include/openssl/x509.h	6
openssl/crypto/x509/x_attrib.c	2
openssl/include/openssl/asn1t.h	2
openssl/crypto/asn1/tasn_utl.c	13
openssl/crypto/asn1/a_int.c	11
openssl/crypto/bio/bss_mem.c	3
openssl/crypto/bio/ossl_core_bio.c	3
openssl/crypto/ui/ui_util.c	8
openssl/crypto/evp/encode.c	7
openssl/crypto/evp/m_sigver.c	7
openssl/crypto/evp/signature.c	9
openssl/crypto/evp/exchange.c	5
openssl/crypto/evp/kem.c	2
openssl/crypto/evp/asymcipher.c	2
openssl/crypto/evp/ctrl_params_translate.c	10
openssl/crypto/params_from_text.c	3
openssl/crypto/bn/bn_conv.c	4
openssl/crypto/asn1/p8_pkey.c	4
openssl/crypto/buffer/buffer.c	4
openssl/crypto/asn1/tasn_new.c	9
openssl/crypto/asn1/a_bitstr.c	2
openssl/crypto/evp/evp_pkey.c	1
openssl/crypto/asn1/x_sig.c	3
openssl/crypto/pkcs12/p12_p8d.c	2
openssl/crypto/pkcs12/p12_decr.c	2
openssl/crypto/evp/evp_pbe.c	6
openssl/crypto/evp/evp_local.h	4
openssl/crypto/asn1/d2i_pr.c	4
openssl/crypto/x509/x_pubkey.c	7
openssl/crypto/engine/eng_cnf.c	5
openssl/crypto/engine/eng_all.c	1
openssl/crypto/engine/eng_ctrl.c	7
openssl/crypto/evp/evp_cnf.c	2
openssl/crypto/conf/conf_ssl.c	6
openssl/crypto/encode_decode/encoder_meth.c	3
openssl/crypto/store/store_meth.c	3
openssl/crypto/evp/e_des3.c	11
openssl/crypto/evp/e_xcbc_d.c	1
openssl/crypto/evp/e_rc4.c	2
openssl/crypto/evp/e_rc4_hmac_md5.c	1
openssl/crypto/evp/e_idea.c	4
openssl/crypto/evp/e_seed.c	4
openssl/crypto/evp/e_sm4.c	5
openssl/crypto/evp/e_rc2.c	6
openssl/crypto/evp/e_bf.c	4
openssl/crypto/evp/e_cast.c	4
openssl/crypto/evp/e_rc5.c	4
openssl/crypto/evp/e_aes.c	38
openssl/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl/crypto/evp/e_aria.c	27
openssl/crypto/evp/e_camellia.c	21
openssl/crypto/evp/e_chacha20_poly1305.c	2
openssl/crypto/err/err_all.c	1
openssl/crypto/bn/bn_err.c	1
openssl/crypto/rsa/rsa_err.c	1
openssl/crypto/dh/dh_err.c	1
openssl/crypto/evp/evp_err.c	1
openssl/crypto/buffer/buf_err.c	1
openssl/crypto/objects/obj_err.c	1
openssl/crypto/pem/pem_err.c	1
openssl/crypto/dsa/dsa_err.c	1
openssl/crypto/x509/x509_err.c	1
openssl/crypto/asn1/asn1_err.c	1
openssl/crypto/conf/conf_err.c	1
openssl/crypto/cpt_err.c	1
openssl/crypto/comp/comp_err.c	1
openssl/crypto/ec/ec_err.c	1
openssl/crypto/bio/bio_err.c	1
openssl/crypto/pkcs7/pkcs7err.c	1
openssl/crypto/x509/v3err.c	1
openssl/crypto/pkcs12/pk12err.c	1
openssl/crypto/rand/rand_err.c	1
openssl/crypto/dso/dso_err.c	1
openssl/crypto/ts/ts_err.c	1
openssl/crypto/engine/eng_err.c	1
openssl/crypto/http/http_err.c	1
openssl/crypto/ocsp/ocsp_err.c	1
openssl/crypto/ui/ui_err.c	1
openssl/crypto/cms/cms_err.c	1
openssl/crypto/crmf/crmf_err.c	1
openssl/crypto/cmp/cmp_err.c	1
openssl/crypto/ct/ct_err.c	1
openssl/crypto/ess/ess_err.c	1
openssl/crypto/async/async_err.c	1
openssl/crypto/store/store_err.c	1
openssl/crypto/property/property_err.c	1
openssl/providers/common/provider_err.c	1
openssl/crypto/property/defn_cache.c	5
openssl/crypto/bio/bss_core.c	2
openssl/providers/implementations/rands/drbg.c	2
openssl/crypto/self_test_core.c	2
openssl/crypto/thread/internal.c	2
openssl/crypto/thread/arch/thread_posix.c	9
openssl/crypto/evp/evp_rand.c	20
openssl/crypto/store/store_init.c	1
openssl/crypto/store/store_register.c	1
openssl/crypto/store/store_local.h	1
openssl/crypto/bio/bio_sock.c	1
openssl/crypto/objects/obj_xref.c	12
openssl/crypto/objects/obj_xref.h	7
openssl/crypto/cmp/cmp_util.c	1
openssl/crypto/trace.c	2
openssl/crypto/cpuid.c	4
openssl/ssl/ssl_init.c	8
openssl/ssl/ssl_ciph.c	22
openssl/include/openssl/ssl.h	5
openssl/crypto/comp/comp_lib.c	2
openssl/ssl/s3_lib.c	2
openssl/ssl/ssl_err.c	1
openssl/ssl/ssl_cert.c	14
openssl/ssl/quic/../ssl_local.h	9
openssl/crypto/x509/x509_lu.c	7
openssl/include/openssl/x509_vfy.h	4
openssl/crypto/x509/x509_cmp.c	9
openssl/crypto/x509/x_name.c	7
openssl/crypto/asn1/tasn_enc.c	8
openssl/crypto/asn1/asn1_local.h	3
openssl/crypto/x509/x509_vpm.c	3
openssl/crypto/ct/ct_log.c	3
openssl/include/openssl/ct.h	1
openssl/ssl/tls_depr.c	3
openssl/ssl/t1_lib.c	17
openssl/ssl/tls_srp.c	2
openssl/ssl/ssl_mcnf.c	2
openssl/ssl/ssl_conf.c	13
openssl/ssl/ssl_rsa.c	7
openssl/crypto/x509/x_all.c	2
openssl/crypto/asn1/a_d2i_fp.c	1
openssl/ssl/ssl_sess.c	9
openssl/include/internal/time.h	11
openssl/crypto/x509/x_x509.c	3
openssl/crypto/x509/t_x509.c	1
openssl/crypto/x509/x_crl.c	2
openssl/ssl/statem/extensions_cust.c	4
openssl/ssl/statem/statem_lib.c	1
openssl/crypto/rsa/rsa_asn1.c	2
openssl/crypto/ec/ec_key.c	4
openssl/crypto/ec/ec_lib.c	4
openssl/crypto/rsa/rsa_backend.c	1
openssl/crypto/rsa/rsa_lib.c	1
openssl/crypto/ec/ec_backend.c	1
openssl/crypto/dsa/dsa_backend.c	1
openssl/crypto/dsa/dsa_lib.c	2
openssl/crypto/dh/dh_backend.c	1
openssl/crypto/dh/dh_lib.c	1
openssl/crypto/x509/v3_purp.c	12
openssl/crypto/asn1/a_digest.c	1
openssl/crypto/x509/x509_set.c	6
openssl/crypto/x509/x509_ext.c	4
openssl/crypto/x509/v3_lib.c	6
openssl/crypto/x509/x509_v3.c	7
openssl/include/openssl/x509v3.h	6
openssl/crypto/x509/v3_bcons.c	2
openssl/crypto/x509/v3_pcia.c	2
openssl/crypto/x509/v3_crld.c	1
openssl/crypto/asn1/a_dup.c	1
openssl/crypto/x509/x509name.c	1
openssl/crypto/pem/pem_all.c	4
openssl/crypto/evp/p_legacy.c	2
openssl/crypto/ec/ecp_nistz256.c	1
openssl/crypto/ec/ecp_nistp224.c	1
openssl/crypto/ec/ecp_nistp256.c	1
openssl/crypto/ec/ecp_nistp384.c	1
openssl/crypto/ec/ecp_nistp521.c	1
openssl/crypto/ec/ec_mult.c	1
openssl/crypto/bn/bn_mont.c	1
openssl/crypto/pem/pem_x509.c	1
openssl/crypto/pem/pem_oth.c	1
openssl/crypto/ffc/ffc_params.c	2
openssl/ssl/quic/quic_impl.c	32
openssl/ssl/quic/quic_channel.c	25
openssl/ssl/quic/quic_reactor.c	12
openssl/ssl/quic/quic_record_tx.c	3
openssl/ssl/quic/quic_demux.c	2
openssl/ssl/statem/statem.c	7
openssl/ssl/record/rec_layer_s3.c	6
openssl/ssl/s3_msg.c	1
openssl/ssl/tls13_enc.c	2
openssl/ssl/t1_enc.c	1
openssl/crypto/bio/bss_dgram_pair.c	1
openssl/ssl/pqueue.c	1
openssl/crypto/bio/bio_addr.c	2
openssl/ssl/quic/quic_txp.c	3
openssl/ssl/quic/quic_record_util.c	11
openssl/crypto/evp/kdf_meth.c	7
openssl/crypto/evp/kdf_lib.c	3
openssl/ssl/quic/quic_record_rx.c	2
openssl/ssl/quic/quic_record_shared.c	7
openssl/ssl/quic/quic_wire_pkt.c	2
openssl/include/internal/quic_demux.h	3
openssl/ssl/quic/quic_tls.c	4
openssl/ssl/quic/quic_rstream.c	1
openssl/ssl/quic/quic_sstream.c	1
openssl/crypto/bio/bss_null.c	1
openssl/crypto/async/async_local.h	4
openssl/ssl/quic/quic_wire.c	2
openssl/crypto/time.c	1
openssl/ssl/quic/quic_ackm.c	1
openssl/ssl/quic/quic_statm.c	1
openssl/ssl/quic/quic_thread_assist.c	2
openssl/crypto/thread/arch.c	1

Fuzzer: cmp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5709	63.6%
gold	[1:9]	1100	12.2%
yellow	[10:29]	169	1.88%
greenyellow	[30:49]	73	0.81%
lawngreen	50+	1916	21.3%
All colors	8967	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
47407	47409	8 : View List ['sk_BIGNUM_const_push', 'RSA_get0_q', 'RSA_get0_iqmp', 'RSA_get_multi_prime_extra_count', 'sk_RSA_PRIME_INFO_value.14409', 'RSA_get0_p', 'RSA_get0_dmq1', 'RSA_get0_dmp1']	47407	47409	ossl_rsa_get0_all_params	call site: 00000	/src/openssl/crypto/rsa/rsa_lib.c:856
34076	58775	11 : View List ['ASN1_INTEGER_set', 'ERR_set_debug', 'ERR_new', 'OSSL_CRMF_POPO_new', 'ASN1_NULL_new', 'OSSL_CRMF_POPOSIGNINGKEY_new', 'OSSL_CRMF_POPOPRIVKEY_new', 'ERR_set_error', 'create_popo_signature', 'OSSL_CRMF_POPOSIGNINGKEY_free', 'ASN1_INTEGER_new']	34076	69997	OSSL_CRMF_MSG_create_popo	call site: 06268	/src/openssl30/crypto/crmf/crmf_lib.c:406
22826	40600	6 : View List ['OSSL_CMP_CTX_set_option', 'ERR_new', 'ERR_set_error', 'ossl_cmp_hdr_has_implicitConfirm', 'ossl_cmp_certrep_new', 'ERR_set_debug']	22826	49800	process_cert_request	call site: 08768	/src/openssl30/crypto/cmp/cmp_server.c:223
20741	30171	13 : View List ['DSO_free', 'DSO_merge', 'DSO_convert_filename', 'DSO_new', 'ossl_safe_getenv', 'CRYPTO_THREAD_read_lock', 'DSO_bind_func', 'get_provider_store', 'CRYPTO_THREAD_unlock', 'DSO_load', 'CRYPTO_strdup', 'CRYPTO_free', 'DSO_ctrl']	24200	86971	provider_init	call site: 01608	/src/openssl/crypto/provider_core.c:886
13830	13830	3 : View List ['ENGINE_free', 'ENGINE_by_id', 'ENGINE_init']	13830	13830	load_common	call site: 00000	/src/openssl/providers/common/provider_util.c:70
11909	17885	10 : View List ['ossl_assert_int.33564', 'evp_keymgmt_util_clear_operation_cache', 'evp_keymgmt_util_cache_keydata', 'CRYPTO_THREAD_read_lock', 'evp_keymgmt_util_find_operation_cache', 'evp_keymgmt_freedata', 'match_type', 'CRYPTO_THREAD_unlock', 'evp_keymgmt_util_export', 'CRYPTO_THREAD_write_lock']	11909	17885	evp_keymgmt_util_export_to_provider	call site: 03181	/src/openssl/crypto/evp/keymgmt_lib.c:117
11887	30146	5 : View List ['ecdsa_setup_md', 'OSSL_PARAM_get_size_t', 'OSSL_PARAM_locate_const', 'OSSL_PARAM_get_utf8_string', 'OSSL_PARAM_get_uint']	11887	30146	ecdsa_set_ctx_params	call site: 00000	/src/openssl/providers/implementations/signature/ecdsa_sig.c:499
11848	11848	2 : View List ['sk_INFOPAIR_new_null', 'ossl_provider_info_add_parameter']	11848	21247	ossl_provider_new	call site: 04481	/src/openssl/crypto/provider_core.c:558
9914	9914	2 : View List ['ec_GF2m_simple_oct2point', 'ec_GFp_simple_oct2point']	9914	9914	EC_POINT_oct2point	call site: 00000	/src/openssl111/crypto/ec/ec_oct.c:113
9386	9386	2 : View List ['conf_diagnostics', 'CONF_modules_load']	9386	16308	CONF_modules_load_file_ex	call site: 00418	/src/openssl/crypto/conf/conf_mod.c:206
8805	8805	2 : View List ['ec_GF2m_simple_set_compressed_coordinates', 'ec_GFp_simple_set_compressed_coordinates']	8805	8805	EC_POINT_set_compressed_coordinates	call site: 00000	/src/openssl111/crypto/ec/ec_oct.c:32
8551	8551	1 : View List ['X509_self_signed']	8551	29797	X509_add_cert	call site: 07589	/src/openssl/crypto/x509/x509_cmp.c:211

Runtime coverage analysis

Covered functions

2701

Functions that are reachable but not covered

1403

Reachable functions

2987

Percentage of reachable functions covered

53.03%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl/fuzz/driver.c	1
openssl/fuzz/cmp.c	6
openssl/crypto/bio/bss_mem.c	3
openssl/crypto/bio/bio_lib.c	19
openssl/crypto/mem.c	7
openssl/crypto/err/err_blocks.c	4
openssl/crypto/err/err.c	32
openssl/crypto/init.c	40
openssl/crypto/err/err_local.h	6
openssl/crypto/threads_pthread.c	14
openssl/crypto/cpuid.c	4
openssl/crypto/ctype.c	5
openssl/crypto/initthread.c	21
openssl/crypto/stack/stack.c	22
openssl/crypto/err/err_save.c	1
openssl/crypto/comp/c_zlib.c	1
openssl/crypto/comp/c_brotli.c	1
openssl/crypto/comp/c_zstd.c	1
openssl/crypto/async/async.c	6
openssl/crypto/async/arch/async_posix.c	2
openssl/crypto/rand/rand_lib.c	18
openssl/providers/implementations/rands/seeding/rand_unix.c	4
openssl/crypto/engine/eng_init.c	4
openssl/crypto/cryptlib.c	2
openssl/crypto/engine/eng_lib.c	21
openssl/include/internal/refcount.h	5
openssl/crypto/engine/tb_pkmeth.c	7
openssl/crypto/evp/pmeth_lib.c	34
openssl/crypto/engine/tb_asnmth.c	8
openssl/crypto/asn1/ameth_lib.c	9
openssl/crypto/engine/eng_list.c	10
openssl/crypto/ex_data.c	12
openssl/crypto/context.c	16
openssl/crypto/property/property.c	29
openssl/crypto/sparse_array.c	1
openssl/crypto/provider_conf.c	14
openssl/crypto/evp/c_allc.c	1
openssl/crypto/evp/e_des.c	6
openssl/crypto/evp/names.c	9
openssl/crypto/objects/obj_dat.c	30
openssl/crypto/evp/c_alld.c	1
openssl/crypto/evp/legacy_md4.c	1
openssl/crypto/objects/o_names.c	12
openssl/crypto/objects/obj_local.h	18
openssl/crypto/lhash/lhash.c	13
openssl/crypto/evp/legacy_md5.c	1
openssl/crypto/evp/legacy_md5_sha1.c	1
openssl/crypto/evp/legacy_sha.c	13
openssl/crypto/evp/legacy_mdc2.c	1
openssl/crypto/evp/legacy_ripemd.c	1
openssl/crypto/evp/legacy_wp.c	1
openssl/crypto/sm3/legacy_sm3.c	1
openssl/crypto/evp/legacy_blake2.c	2
openssl/crypto/conf/conf_sap.c	2
openssl/crypto/conf/conf_mod.c	33
openssl/crypto/err/err_mark.c	3
openssl/crypto/getenv.c	1
openssl/crypto/o_str.c	15
openssl/crypto/x509/x509_def.c	1
openssl/crypto/bio/bio_print.c	11
openssl/include/internal/common.h	1
openssl/crypto/conf/conf_lib.c	10
openssl/crypto/conf/conf_def.c	1
openssl/include/openssl/err.h	4
openssl/crypto/conf/conf_api.c	3
openssl/include/openssl/conf.h	3
openssl/crypto/conf/conf_mall.c	1
openssl/crypto/asn1/asn_moid.c	3
openssl/crypto/bsearch.c	1
openssl/crypto/asn1/a_object.c	7
openssl/crypto/bn/bn_lib.c	27
openssl/crypto/bn/bn_local.h	1
openssl/crypto/mem_sec.c	18
openssl/crypto/bn/bn_word.c	4
openssl/crypto/bn/asm/x86_64-gcc.c	2
openssl/crypto/bn/bn_shift.c	2
openssl/crypto/asn1/asn1_lib.c	19
openssl/crypto/objects/obj_lib.c	2
openssl/crypto/asn1/asn_mstbl.c	3
openssl/crypto/x509/v3_utl.c	8
openssl/crypto/asn1/asn1_gen.c	3
openssl/crypto/asn1/tasn_dec.c	14
openssl/crypto/asn1/a_strnid.c	6
openssl/include/openssl/asn1.h	8
openssl/crypto/engine/eng_openssl.c	20
openssl/include/internal/cryptlib.h	7
openssl/include/openssl/crypto.h	2
openssl/crypto/evp/evp_lib.c	42
openssl/crypto/provider_core.c	49
openssl/crypto/engine/eng_rdrand.c	4
openssl/crypto/engine/tb_rand.c	6
openssl/crypto/engine/eng_local.h	14
openssl/crypto/engine/eng_dyn.c	12
openssl/crypto/dso/dso_lib.c	9
openssl/include/openssl/safestack.h	4
openssl/crypto/dso/dso_dlfcn.c	1
openssl/engines/e_padlock.c	22
openssl/crypto/engine/tb_cipher.c	7
openssl/crypto/evp/cmeth_lib.c	8
openssl/crypto/evp/evp_enc.c	29
openssl/crypto/params.c	49
openssl/crypto/evp/evp_utils.c	5
openssl/crypto/asn1/evp_asn1.c	2
openssl/crypto/asn1/tasn_typ.c	23
openssl/crypto/asn1/a_octet.c	3
openssl/crypto/asn1/a_type.c	3
openssl/crypto/asn1/tasn_fre.c	5
openssl/engines/e_afalg.c	28
openssl/engines/e_afalg_err.c	3
openssl/crypto/provider_local.h	4
openssl/crypto/provider_child.c	4
openssl/providers/implementations/rands/crngt.c	2
openssl/crypto/evp/digest.c	21
openssl/crypto/evp/evp_fetch.c	16
openssl/crypto/core_namemap.c	22
openssl/crypto/engine/eng_fat.c	5
openssl/crypto/engine/eng_table.c	8
openssl/crypto/engine/tb_digest.c	7
openssl/crypto/engine/tb_rsa.c	4
openssl/crypto/engine/tb_dsa.c	4
openssl/crypto/engine/tb_dh.c	4
openssl/crypto/engine/tb_eckey.c	4
openssl/include/crypto/asn1.h	3
openssl/crypto/core_fetch.c	3
openssl/crypto/core_algorithm.c	4
openssl/include/openssl/core_dispatch.h	112
openssl/crypto/encode_decode/decoder_pkey.c	27
openssl/crypto/async/async_wait.c	3
openssl/crypto/async/arch/async_posix.h	1
openssl/crypto/rsa/rsa_ossl.c	1
openssl/crypto/dsa/dsa_ossl.c	1
openssl/crypto/ec/ec_kmeth.c	1
openssl/crypto/dh/dh_key.c	1
openssl/crypto/rand/rand_meth.c	1
openssl/crypto/sha/sha_local.h	1
openssl/include/crypto/md32_common.h	2
openssl/crypto/engine/eng_pkey.c	1
openssl/crypto/bio/bss_file.c	3
openssl/crypto/o_fopen.c	1
openssl/crypto/pem/pem_pkey.c	5
openssl/crypto/bio/bf_readbuff.c	1
openssl/crypto/pem/pem_lib.c	15
openssl/crypto/evp/evp_key.c	3
openssl/crypto/ui/ui_lib.c	27
openssl/crypto/ui/ui_openssl.c	1
openssl/crypto/ui/ui_null.c	1
openssl/include/openssl/ui.h	2
openssl/crypto/err/err_prn.c	5
openssl/crypto/passphrase.c	10
openssl/crypto/encode_decode/decoder_meth.c	21
openssl/crypto/encode_decode/decoder_lib.c	27
openssl/crypto/evp/keymgmt_meth.c	20
openssl/crypto/provider.c	2
openssl/crypto/property/property_query.c	3
openssl/crypto/property/property_string.c	17
openssl/crypto/property/property_parse.c	25
openssl/crypto/encode_decode/encoder_local.h	11
openssl/crypto/evp/keymgmt_lib.c	14
openssl/crypto/evp/p_lib.c	33
openssl/include/crypto/evp.h	8
openssl/include/openssl/x509.h	10
openssl/crypto/x509/x_attrib.c	2
openssl/include/openssl/asn1t.h	2
openssl/crypto/asn1/tasn_utl.c	13
openssl/crypto/asn1/a_int.c	20
openssl/crypto/bio/ossl_core_bio.c	3
openssl/crypto/ui/ui_util.c	8
openssl/crypto/evp/encode.c	7
openssl/crypto/evp/m_sigver.c	11
openssl/crypto/evp/signature.c	12
openssl/crypto/evp/exchange.c	3
openssl/crypto/evp/kem.c	3
openssl/crypto/evp/asymcipher.c	11
openssl/crypto/evp/ctrl_params_translate.c	13
openssl/crypto/params_from_text.c	3
openssl/crypto/bn/bn_conv.c	5
openssl/crypto/asn1/p8_pkey.c	4
openssl/crypto/buffer/buffer.c	5
openssl/crypto/asn1/tasn_new.c	10
openssl/crypto/asn1/a_bitstr.c	5
openssl/crypto/evp/evp_pkey.c	1
openssl/crypto/asn1/x_sig.c	3
openssl/crypto/pkcs12/p12_p8d.c	2
openssl/crypto/pkcs12/p12_decr.c	2
openssl/crypto/evp/evp_pbe.c	7
openssl/crypto/evp/evp_local.h	4
openssl/crypto/asn1/d2i_pr.c	1
openssl/crypto/x509/x_pubkey.c	14
openssl/crypto/engine/eng_cnf.c	5
openssl/crypto/engine/eng_all.c	1
openssl/crypto/engine/eng_ctrl.c	7
openssl/crypto/evp/evp_cnf.c	2
openssl/crypto/conf/conf_ssl.c	3
openssl/crypto/encode_decode/encoder_meth.c	18
openssl/crypto/store/store_meth.c	3
openssl/crypto/evp/e_des3.c	11
openssl/crypto/evp/e_xcbc_d.c	1
openssl/crypto/evp/e_rc4.c	2
openssl/crypto/evp/e_rc4_hmac_md5.c	1
openssl/crypto/evp/e_idea.c	4
openssl/crypto/evp/e_seed.c	4
openssl/crypto/evp/e_sm4.c	5
openssl/crypto/evp/e_rc2.c	6
openssl/crypto/evp/e_bf.c	4
openssl/crypto/evp/e_cast.c	4
openssl/crypto/evp/e_rc5.c	4
openssl/crypto/evp/e_aes.c	38
openssl/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl/crypto/evp/e_aria.c	27
openssl/crypto/evp/e_camellia.c	21
openssl/crypto/evp/e_chacha20_poly1305.c	2
openssl/crypto/err/err_all.c	1
openssl/crypto/bn/bn_err.c	1
openssl/crypto/rsa/rsa_err.c	1
openssl/crypto/dh/dh_err.c	1
openssl/crypto/evp/evp_err.c	1
openssl/crypto/buffer/buf_err.c	1
openssl/crypto/objects/obj_err.c	1
openssl/crypto/pem/pem_err.c	1
openssl/crypto/dsa/dsa_err.c	1
openssl/crypto/x509/x509_err.c	1
openssl/crypto/asn1/asn1_err.c	1
openssl/crypto/conf/conf_err.c	1
openssl/crypto/cpt_err.c	1
openssl/crypto/comp/comp_err.c	1
openssl/crypto/ec/ec_err.c	1
openssl/crypto/bio/bio_err.c	1
openssl/crypto/pkcs7/pkcs7err.c	1
openssl/crypto/x509/v3err.c	1
openssl/crypto/pkcs12/pk12err.c	1
openssl/crypto/rand/rand_err.c	1
openssl/crypto/dso/dso_err.c	1
openssl/crypto/ts/ts_err.c	1
openssl/crypto/engine/eng_err.c	1
openssl/crypto/http/http_err.c	1
openssl/crypto/ocsp/ocsp_err.c	1
openssl/crypto/ui/ui_err.c	1
openssl/crypto/cms/cms_err.c	1
openssl/crypto/crmf/crmf_err.c	1
openssl/crypto/cmp/cmp_err.c	1
openssl/crypto/ct/ct_err.c	1
openssl/crypto/ess/ess_err.c	1
openssl/crypto/async/async_err.c	1
openssl/crypto/store/store_err.c	1
openssl/crypto/property/property_err.c	1
openssl/providers/common/provider_err.c	1
openssl/crypto/property/defn_cache.c	5
openssl/crypto/bio/bss_core.c	2
openssl/providers/implementations/rands/drbg.c	2
openssl/crypto/self_test_core.c	2
openssl/crypto/thread/internal.c	2
openssl/crypto/thread/arch/thread_posix.c	4
openssl/crypto/evp/evp_rand.c	20
openssl/crypto/store/store_init.c	1
openssl/crypto/store/store_register.c	1
openssl/crypto/store/store_local.h	1
openssl/crypto/bio/bio_sock.c	1
openssl/crypto/objects/obj_xref.c	12
openssl/crypto/objects/obj_xref.h	4
openssl/crypto/cmp/cmp_util.c	8
openssl/crypto/trace.c	2
openssl/crypto/cmp/cmp_msg.c	37
openssl/crypto/cmp/cmp_asn.c	32
openssl/crypto/asn1/a_d2i_fp.c	2
openssl/crypto/bio/bss_null.c	1
openssl/crypto/cmp/cmp_server.c	12
openssl/crypto/cmp/cmp_ctx.c	27
openssl/crypto/http/http_client.c	2
openssl/crypto/x509/x_x509.c	11
openssl/crypto/x509/x_name.c	10
openssl/crypto/x509/x509_lu.c	19
openssl/include/openssl/x509_vfy.h	9
openssl/crypto/x509/x_crl.c	4
openssl/crypto/x509/x509_vpm.c	14
openssl/crypto/x509/t_x509.c	6
openssl/include/openssl/cmp.h	8
openssl/include/openssl/x509v3.h	14
openssl/crypto/x509/v3_genn.c	6
openssl/crypto/x509/x_exten.c	5
openssl/crypto/x509/v3_cpols.c	4
openssl/crypto/x509/x_req.c	4
openssl/crypto/asn1/a_i2d_fp.c	1
openssl/crypto/asn1/tasn_enc.c	8
openssl/crypto/asn1/asn1_local.h	3
openssl/crypto/asn1/tasn_prn.c	9
openssl/crypto/asn1/asn1_parse.c	4
openssl/crypto/asn1/a_utctm.c	2
openssl/crypto/asn1/a_time.c	14
openssl/crypto/o_time.c	6
openssl/crypto/asn1/a_gentm.c	3
openssl/crypto/bio/bio_dump.c	4
openssl/crypto/bio/bf_prefix.c	1
openssl/crypto/asn1/a_strex.c	9
openssl/crypto/asn1/a_utf8.c	2
openssl/include/internal/unicode.h	1
openssl/crypto/x509/x509_set.c	12
openssl/crypto/asn1/a_dup.c	1
openssl/crypto/cmp/cmp_client.c	13
openssl/crypto/cmp/cmp_hdr.c	17
openssl/crypto/x509/x509_cmp.c	18
openssl/crypto/x509/x509_req.c	5
openssl/crypto/x509/v3_skid.c	1
openssl/crypto/crmf/crmf_asn.c	29
openssl/crypto/cmp/cmp_local.h	12
openssl/crypto/x509/x509name.c	6
openssl/crypto/x509/x509_v3.c	13
openssl/crypto/crmf/crmf_lib.c	18
openssl/crypto/x509/x509_att.c	4
openssl/crypto/x509/v3_lib.c	6
openssl/crypto/x509/v3_conf.c	2
openssl/crypto/crmf/crmf_local.h	3
openssl/crypto/asn1/a_sign.c	2
openssl/crypto/asn1/x_algor.c	11
openssl/include/openssl/crmf.h	4
openssl/crypto/cmp/cmp_protect.c	5
openssl/crypto/crmf/crmf_pbm.c	2
openssl/crypto/x509/v3_purp.c	18
openssl/crypto/x509/x_all.c	4
openssl/crypto/asn1/a_digest.c	1
openssl/crypto/x509/x509_ext.c	6
openssl/crypto/x509/v3_bcons.c	2
openssl/crypto/x509/v3_pcia.c	2
openssl/crypto/x509/v3_crld.c	1
openssl/crypto/evp/mac_lib.c	10
openssl/crypto/evp/mac_meth.c	9
openssl/crypto/x509/x509_vfy.c	60
openssl/crypto/x509/pcy_tree.c	14
openssl/crypto/x509/pcy_node.c	7
openssl/crypto/x509/pcy_local.h	8
openssl/crypto/x509/pcy_data.c	2
openssl/crypto/asn1/a_verify.c	2
openssl/crypto/rsa/rsa_ameth.c	3
openssl/crypto/rsa/rsa_backend.c	2
openssl/crypto/rsa/rsa_asn1.c	2
openssl/crypto/asn1/asn_pack.c	1
openssl/crypto/rsa/rsa_pss.c	3
openssl/crypto/rsa/rsa_lib.c	4
openssl/crypto/x509/x509cset.c	4
openssl/crypto/x509/pcy_cache.c	6
openssl/crypto/x509/pcy_map.c	1
openssl/crypto/x509/v3_pmaps.c	2
openssl/crypto/x509/v3_pcons.c	2
openssl/crypto/x509/pcy_lib.c	1
openssl/include/internal/dane.h	2
openssl/crypto/encode_decode/encoder_pkey.c	7
openssl/crypto/encode_decode/encoder_lib.c	19
openssl/crypto/x509/x509_trust.c	5
openssl/crypto/cmp/cmp_vfy.c	18
openssl/crypto/x509/x509_obj.c	1
openssl/crypto/x509/v3_prn.c	4
openssl/crypto/asn1/a_print.c	1
openssl/crypto/x509/x_x509a.c	5
openssl/crypto/cmp/cmp_status.c	7
openssl/crypto/sleep.c	1

Fuzzer: bndiv_30

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4628	89.0%
gold	[1:9]	339	6.52%
yellow	[10:29]	35	0.67%
greenyellow	[30:49]	5	0.09%
lawngreen	50+	191	3.67%
All colors	5198	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
17774	17774	3 : View List ['ERR_set_error', 'ERR_new', 'ERR_set_debug']	17774	17774	do_init_module_list_lock	call site: 03884	/src/openssl/crypto/conf/conf_mod.c:102
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_usub	call site: 05165	/src/openssl111/crypto/bn/bn_add.c:138
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_CTX_get	call site: 05047	/src/openssl111/crypto/bn/bn_ctx.c:221
3455	3455	1 : View List ['ERR_put_error']	3455	3455	BN_div	call site: 05040	/src/openssl111/crypto/bn/bn_div.c:224
3453	3453	1 : View List ['BN_set_word']	3453	3453	BN_add	call site: 05165	/src/openssl111/crypto/bn/bn_add.c:29
3453	3453	1 : View List ['BN_set_word']	3453	3453	bn_rshift_fixed_top	call site: 05066	/src/openssl111/crypto/bn/bn_shift.c:186
3452	3452	1 : View List ['sk_ENGINE_CLEANUP_ITEM_new_null']	3452	3452	int_cleanup_check	call site: 00979	/src/openssl111/crypto/engine/eng_lib.c:118
6	6	1 : View List ['bn_mul_comba4']	6	18	bn_mul_recursive	call site: 05128	/src/openssl111/crypto/bn/bn_mul.c:244
0	39	1 : View List ['property_string_data_free']	0	39	property_string_data_new	call site: 00000	/src/openssl30/crypto/property/property_string.c:103
0	8	1 : View List ['CRYPTO_free']	0	8	OPENSSL_LH_new	call site: 00490	/src/openssl111/crypto/lhash/lhash.c:59
0	0	None	106692	118564	context_init	call site: 00173	/src/openssl/crypto/context.c:93
0	0	None	5941	12957	ossl_err_get_state_int	call site: 00009	/src/openssl/crypto/err/err.c:677

Runtime coverage analysis

Covered functions

267

Functions that are reachable but not covered

1086

Reachable functions

1340

Percentage of reachable functions covered

18.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl30/fuzz/driver.c	1
openssl30/fuzz/bndiv.c	1
openssl30/crypto/bn/bn_lib.c	30
openssl30/crypto/mem.c	7
openssl30/crypto/err/err_blocks.c	2
openssl30/crypto/err/err.c	31
openssl30/crypto/init.c	39
openssl30/crypto/err/err_local.h	5
openssl30/crypto/threads_pthread.c	13
openssl30/crypto/cpuid.c	4
openssl30/crypto/ctype.c	3
openssl30/crypto/initthread.c	21
openssl30/crypto/stack/stack.c	16
openssl30/crypto/comp/c_zlib.c	1
openssl30/crypto/async/async.c	6
openssl30/crypto/rand/rand_lib.c	10
openssl30/providers/implementations/rands/seeding/rand_unix.c	4
openssl30/crypto/engine/eng_init.c	4
openssl30/crypto/cryptlib.c	2
openssl30/crypto/engine/eng_lib.c	21
openssl30/include/internal/refcount.h	2
openssl30/crypto/engine/tb_pkmeth.c	7
openssl30/crypto/evp/pmeth_lib.c	31
openssl30/crypto/engine/tb_asnmth.c	9
openssl30/crypto/asn1/ameth_lib.c	9
openssl30/crypto/engine/eng_list.c	10
openssl30/crypto/ex_data.c	14
openssl30/crypto/context.c	17
openssl30/include/internal/cryptlib.h	8
openssl30/include/openssl/crypto.h	2
openssl30/crypto/property/property_parse.c	25
openssl30/crypto/property/property_string.c	12
openssl30/crypto/lhash/lhash.c	12
openssl30/crypto/evp/evp_rand.c	3
openssl30/crypto/provider_core.c	43
openssl30/crypto/err/err_all.c	1
openssl30/include/openssl/err.h	4
openssl30/crypto/bn/bn_err.c	1
openssl30/crypto/rsa/rsa_err.c	1
openssl30/crypto/dh/dh_err.c	1
openssl30/crypto/evp/evp_err.c	1
openssl30/crypto/buffer/buf_err.c	1
openssl30/crypto/objects/obj_err.c	1
openssl30/crypto/pem/pem_err.c	1
openssl30/crypto/dsa/dsa_err.c	1
openssl30/crypto/x509/x509_err.c	1
openssl30/crypto/asn1/asn1_err.c	1
openssl30/crypto/conf/conf_err.c	1
openssl30/crypto/cpt_err.c	1
openssl30/crypto/comp/comp_err.c	1
openssl30/crypto/ec/ec_err.c	1
openssl30/crypto/bio/bio_err.c	1
openssl30/crypto/pkcs7/pkcs7err.c	1
openssl30/crypto/x509/v3err.c	1
openssl30/crypto/pkcs12/pk12err.c	1
openssl30/crypto/rand/rand_err.c	1
openssl30/crypto/dso/dso_err.c	1
openssl30/crypto/ts/ts_err.c	1
openssl30/crypto/engine/eng_err.c	1
openssl30/crypto/http/http_err.c	1
openssl30/crypto/ocsp/ocsp_err.c	1
openssl30/crypto/ui/ui_err.c	1
openssl30/crypto/cms/cms_err.c	1
openssl30/crypto/crmf/crmf_err.c	1
openssl30/crypto/cmp/cmp_err.c	1
openssl30/crypto/ct/ct_err.c	1
openssl30/crypto/ess/ess_err.c	1
openssl30/crypto/async/async_err.c	1
openssl30/crypto/store/store_err.c	1
openssl30/crypto/property/property_err.c	1
openssl30/providers/common/provider_err.c	1
openssl30/crypto/evp/c_allc.c	1
openssl30/crypto/evp/e_des.c	6
openssl30/crypto/evp/names.c	9
openssl30/crypto/objects/obj_dat.c	23
openssl30/crypto/evp/c_alld.c	1
openssl30/crypto/evp/legacy_md4.c	1
openssl30/crypto/objects/obj_local.h	18
openssl30/crypto/objects/o_names.c	12
openssl30/crypto/conf/conf_sap.c	2
openssl30/crypto/conf/conf_mod.c	33
openssl30/crypto/engine/eng_openssl.c	20
openssl30/crypto/evp/evp_lib.c	37
openssl30/crypto/dso/dso_lib.c	9
openssl30/crypto/provider_local.h	4
openssl30/crypto/provider_child.c	2
openssl30/crypto/evp/cmeth_lib.c	8
openssl30/crypto/evp/evp_enc.c	24
openssl30/crypto/rsa/rsa_ossl.c	1
openssl30/crypto/engine/tb_rsa.c	4
openssl30/crypto/dsa/dsa_ossl.c	1
openssl30/crypto/engine/tb_dsa.c	4
openssl30/crypto/ec/ec_kmeth.c	1
openssl30/crypto/engine/tb_eckey.c	4
openssl30/crypto/dh/dh_key.c	1
openssl30/crypto/engine/tb_dh.c	4
openssl30/crypto/rand/rand_meth.c	1
openssl30/crypto/engine/tb_rand.c	4
openssl30/crypto/engine/tb_cipher.c	7
openssl30/crypto/params.c	47
openssl30/crypto/evp/evp_utils.c	5
openssl30/crypto/engine/tb_digest.c	7
openssl30/crypto/evp/digest.c	17
openssl30/crypto/sha/sha_local.h	1
openssl30/include/crypto/md32_common.h	2
openssl30/crypto/engine/eng_pkey.c	1
openssl30/crypto/bio/bss_file.c	2
openssl30/crypto/o_fopen.c	1
openssl30/crypto/bio/bio_lib.c	16
openssl30/crypto/pem/pem_pkey.c	5
openssl30/crypto/bio/bf_readbuff.c	1
openssl30/crypto/pem/pem_lib.c	15
openssl30/crypto/evp/evp_key.c	3
openssl30/crypto/ui/ui_lib.c	27
openssl30/crypto/ui/ui_openssl.c	1
openssl30/crypto/ui/ui_null.c	1
openssl30/include/openssl/ui.h	2
openssl30/crypto/err/err_prn.c	1
openssl30/crypto/o_str.c	12
openssl30/crypto/bio/bio_print.c	9
openssl30/crypto/passphrase.c	9
openssl30/crypto/encode_decode/decoder_pkey.c	13
openssl30/crypto/encode_decode/decoder_meth.c	16
openssl30/crypto/encode_decode/decoder_lib.c	23
openssl30/crypto/evp/keymgmt_meth.c	21
openssl30/crypto/evp/evp_fetch.c	16
openssl30/crypto/core_namemap.c	19
openssl30/crypto/engine/eng_rdrand.c	4
openssl30/crypto/engine/eng_local.h	14
openssl30/crypto/engine/eng_dyn.c	12
openssl30/include/openssl/safestack.h	4
openssl30/crypto/dso/dso_dlfcn.c	1
openssl30/engines/e_padlock.c	22
openssl30/crypto/asn1/evp_asn1.c	1
openssl30/crypto/asn1/tasn_typ.c	9
openssl30/crypto/asn1/asn1_lib.c	11
openssl30/crypto/asn1/a_octet.c	1
openssl30/crypto/asn1/a_type.c	1
openssl30/crypto/asn1/tasn_fre.c	5
openssl30/crypto/asn1/a_object.c	6
openssl30/engines/e_afalg.c	27
openssl30/engines/e_afalg_err.c	3
openssl30/crypto/engine/eng_fat.c	5
openssl30/crypto/engine/eng_table.c	8
openssl30/crypto/async/async_wait.c	3
openssl30/crypto/async/arch/async_posix.h	1
openssl30/crypto/bsearch.c	1
openssl30/crypto/bn/bn_word.c	4
openssl30/crypto/bn/bn_local.h	1
openssl30/crypto/mem_sec.c	18
openssl30/crypto/bn/bn_shift.c	3
openssl30/crypto/bn/bn_conv.c	4
openssl30/include/internal/constant_time.h	4
openssl30/crypto/bn/asm/x86_64-gcc.c	7
openssl30/include/crypto/asn1.h	3
openssl30/crypto/property/property.c	25
openssl30/crypto/sparse_array.c	1
openssl30/crypto/core_fetch.c	3
openssl30/crypto/core_algorithm.c	4
openssl30/crypto/getenv.c	1
openssl30/include/openssl/core_dispatch.h	81
openssl30/crypto/provider.c	2
openssl30/crypto/property/property_query.c	3
openssl30/crypto/encode_decode/encoder_local.h	5
openssl30/crypto/evp/keymgmt_lib.c	14
openssl30/crypto/evp/p_lib.c	19
openssl30/include/crypto/evp.h	8
openssl30/include/openssl/x509.h	1
openssl30/crypto/x509/x_attrib.c	2
openssl30/include/openssl/asn1t.h	2
openssl30/crypto/asn1/tasn_utl.c	9
openssl30/crypto/asn1/a_int.c	8
openssl30/crypto/bio/bss_mem.c	3
openssl30/crypto/bio/ossl_core_bio.c	3
openssl30/crypto/ui/ui_util.c	8
openssl30/crypto/evp/encode.c	7
openssl30/crypto/evp/legacy_md5.c	1
openssl30/crypto/evp/m_sigver.c	7
openssl30/crypto/evp/signature.c	9
openssl30/crypto/evp/exchange.c	2
openssl30/crypto/evp/kem.c	2
openssl30/crypto/evp/asymcipher.c	2
openssl30/crypto/evp/ctrl_params_translate.c	10
openssl30/crypto/params_from_text.c	3
openssl30/crypto/asn1/p8_pkey.c	4
openssl30/crypto/asn1/tasn_dec.c	14
openssl30/crypto/buffer/buffer.c	2
openssl30/crypto/asn1/tasn_new.c	9
openssl30/crypto/asn1/a_bitstr.c	1
openssl30/crypto/evp/evp_pkey.c	1
openssl30/crypto/asn1/x_sig.c	3
openssl30/crypto/pkcs12/p12_p8d.c	2
openssl30/crypto/pkcs12/p12_decr.c	2
openssl30/crypto/evp/evp_pbe.c	6
openssl30/crypto/evp/evp_local.h	3
openssl30/crypto/asn1/d2i_pr.c	1
openssl30/crypto/x509/x_pubkey.c	7
openssl30/crypto/x509/x509_def.c	1
openssl30/crypto/conf/conf_lib.c	10
openssl30/crypto/conf/conf_def.c	1
openssl30/crypto/conf/conf_api.c	3
openssl30/include/openssl/conf.h	3
openssl30/crypto/conf/conf_mall.c	1
openssl30/crypto/asn1/asn_moid.c	3
openssl30/crypto/objects/obj_lib.c	1
openssl30/crypto/asn1/asn_mstbl.c	3
openssl30/crypto/x509/v3_utl.c	6
openssl30/crypto/asn1/asn1_gen.c	3
openssl30/crypto/asn1/a_strnid.c	6
openssl30/include/openssl/asn1.h	3
openssl30/crypto/engine/eng_cnf.c	5
openssl30/crypto/engine/eng_all.c	1
openssl30/crypto/engine/eng_ctrl.c	7
openssl30/crypto/evp/evp_cnf.c	2
openssl30/crypto/conf/conf_ssl.c	3
openssl30/crypto/provider_conf.c	10
openssl30/crypto/encode_decode/encoder_meth.c	3
openssl30/crypto/store/store_meth.c	3
openssl30/crypto/evp/legacy_md5_sha1.c	1
openssl30/crypto/evp/legacy_sha.c	13
openssl30/crypto/evp/legacy_mdc2.c	1
openssl30/crypto/evp/legacy_ripemd.c	1
openssl30/crypto/evp/legacy_wp.c	1
openssl30/crypto/sm3/legacy_sm3.c	1
openssl30/crypto/evp/legacy_blake2.c	2
openssl30/crypto/evp/e_des3.c	11
openssl30/crypto/evp/e_xcbc_d.c	1
openssl30/crypto/evp/e_rc4.c	2
openssl30/crypto/evp/e_rc4_hmac_md5.c	1
openssl30/crypto/evp/e_idea.c	4
openssl30/crypto/evp/e_seed.c	4
openssl30/crypto/evp/e_sm4.c	5
openssl30/crypto/evp/e_rc2.c	6
openssl30/crypto/evp/e_bf.c	4
openssl30/crypto/evp/e_cast.c	4
openssl30/crypto/evp/e_rc5.c	4
openssl30/crypto/evp/e_aes.c	38
openssl30/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl30/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl30/crypto/evp/e_aria.c	27
openssl30/crypto/evp/e_camellia.c	21
openssl30/crypto/evp/e_chacha20_poly1305.c	2
openssl30/crypto/store/store_init.c	1
openssl30/crypto/store/store_register.c	1
openssl30/crypto/store/store_local.h	1
openssl30/crypto/bio/bio_sock.c	1
openssl30/crypto/objects/obj_xref.c	2
openssl30/crypto/objects/obj_xref.h	2
openssl30/crypto/cmp/cmp_util.c	1
openssl30/crypto/trace.c	2
openssl30/crypto/bn/bn_div.c	3
openssl30/crypto/bn/bn_ctx.c	7
openssl30/crypto/bn/bn_mul.c	6
openssl30/crypto/bn/bn_add.c	3
openssl30/crypto/bn/bn_print.c	2

Fuzzer: crl_30

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3656	67.7%
gold	[1:9]	877	16.2%
yellow	[10:29]	74	1.37%
greenyellow	[30:49]	12	0.22%
lawngreen	50+	779	14.4%
All colors	5398	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
9386	9386	2 : View List ['conf_diagnostics', 'CONF_modules_load']	12843	16308	CONF_modules_load_file_ex	call site: 03646	/src/openssl/crypto/conf/conf_mod.c:206
5933	5933	1 : View List ['ossl_property_merge']	5933	6001	ossl_method_store_fetch	call site: 00000	/src/openssl/crypto/property/property.c:526
5933	5933	1 : View List ['parse_oct']	5933	5933	parse_value	call site: 04052	/src/openssl/crypto/property/property_parse.c:244
5930	5930	1 : View List ['parse_hex']	5930	5930	parse_value	call site: 04043	/src/openssl/crypto/property/property_parse.c:241
5929	5929	1 : View List ['parse_string']	5929	5929	parse_value	call site: 04033	/src/openssl/crypto/property/property_parse.c:231
5929	5929	1 : View List ['parse_number']	5929	5929	parse_value	call site: 04057	/src/openssl/crypto/property/property_parse.c:247
5926	5926	1 : View List ['ossl_method_cache_flush_some']	11852	17831	ossl_method_store_cache_set	call site: 01922	/src/openssl/crypto/property/property.c:720
5924	5924	1 : View List ['lh_QUERY_delete']	5924	5941	ossl_method_store_cache_set	call site: 01924	/src/openssl/crypto/property/property.c:726
3464	3468	3 : View List ['ERR_put_error', 'sk_X509_NAME_ENTRY_free', 'CRYPTO_free']	3464	3468	x509_name_ex_new	call site: 00000	/src/openssl111/crypto/x509/x_name.c:98
3457	3457	1 : View List ['ERR_clear_last_mark']	3457	3457	CONF_modules_load_file_ex	call site: 04361	/src/openssl/crypto/conf/conf_mod.c:225
3455	3465	2 : View List ['ERR_put_error', 'ASN1_OBJECT_free']	3455	3465	OBJ_dup	call site: 03782	/src/openssl111/crypto/objects/obj_lib.c:47
3455	3459	2 : View List ['ERR_put_error', 'CRYPTO_free']	3455	3459	BIO_meth_new	call site: 00000	/src/openssl111/crypto/bio/bio_meth.c:40

Runtime coverage analysis

Covered functions

1313

Functions that are reachable but not covered

661

Reachable functions

1493

Percentage of reachable functions covered

55.73%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl30/fuzz/driver.c	1
openssl30/fuzz/crl.c	1
openssl30/crypto/x509/x_crl.c	4
openssl30/crypto/asn1/tasn_dec.c	14
openssl30/crypto/err/err_blocks.c	2
openssl30/crypto/err/err.c	31
openssl30/crypto/init.c	39
openssl30/crypto/err/err_local.h	5
openssl30/crypto/mem.c	7
openssl30/crypto/threads_pthread.c	13
openssl30/crypto/cpuid.c	4
openssl30/crypto/ctype.c	5
openssl30/crypto/initthread.c	21
openssl30/crypto/stack/stack.c	16
openssl30/crypto/comp/c_zlib.c	1
openssl30/crypto/async/async.c	6
openssl30/crypto/rand/rand_lib.c	10
openssl30/providers/implementations/rands/seeding/rand_unix.c	4
openssl30/crypto/engine/eng_init.c	4
openssl30/crypto/cryptlib.c	2
openssl30/crypto/engine/eng_lib.c	21
openssl30/include/internal/refcount.h	2
openssl30/crypto/engine/tb_pkmeth.c	7
openssl30/crypto/evp/pmeth_lib.c	31
openssl30/crypto/engine/tb_asnmth.c	9
openssl30/crypto/asn1/ameth_lib.c	9
openssl30/crypto/engine/eng_list.c	10
openssl30/crypto/ex_data.c	14
openssl30/crypto/context.c	17
openssl30/include/internal/cryptlib.h	8
openssl30/include/openssl/crypto.h	2
openssl30/crypto/property/property_parse.c	25
openssl30/crypto/property/property_string.c	12
openssl30/crypto/lhash/lhash.c	12
openssl30/crypto/evp/evp_rand.c	3
openssl30/crypto/provider_core.c	43
openssl30/crypto/err/err_all.c	1
openssl30/include/openssl/err.h	4
openssl30/crypto/bn/bn_err.c	1
openssl30/crypto/rsa/rsa_err.c	1
openssl30/crypto/dh/dh_err.c	1
openssl30/crypto/evp/evp_err.c	1
openssl30/crypto/buffer/buf_err.c	1
openssl30/crypto/objects/obj_err.c	1
openssl30/crypto/pem/pem_err.c	1
openssl30/crypto/dsa/dsa_err.c	1
openssl30/crypto/x509/x509_err.c	1
openssl30/crypto/asn1/asn1_err.c	1
openssl30/crypto/conf/conf_err.c	1
openssl30/crypto/cpt_err.c	1
openssl30/crypto/comp/comp_err.c	1
openssl30/crypto/ec/ec_err.c	1
openssl30/crypto/bio/bio_err.c	1
openssl30/crypto/pkcs7/pkcs7err.c	1
openssl30/crypto/x509/v3err.c	1
openssl30/crypto/pkcs12/pk12err.c	1
openssl30/crypto/rand/rand_err.c	1
openssl30/crypto/dso/dso_err.c	1
openssl30/crypto/ts/ts_err.c	1
openssl30/crypto/engine/eng_err.c	1
openssl30/crypto/http/http_err.c	1
openssl30/crypto/ocsp/ocsp_err.c	1
openssl30/crypto/ui/ui_err.c	1
openssl30/crypto/cms/cms_err.c	1
openssl30/crypto/crmf/crmf_err.c	1
openssl30/crypto/cmp/cmp_err.c	1
openssl30/crypto/ct/ct_err.c	1
openssl30/crypto/ess/ess_err.c	1
openssl30/crypto/async/async_err.c	1
openssl30/crypto/store/store_err.c	1
openssl30/crypto/property/property_err.c	1
openssl30/providers/common/provider_err.c	1
openssl30/crypto/evp/c_allc.c	1
openssl30/crypto/evp/e_des.c	6
openssl30/crypto/evp/names.c	9
openssl30/crypto/objects/obj_dat.c	23
openssl30/crypto/evp/c_alld.c	1
openssl30/crypto/evp/legacy_md4.c	1
openssl30/crypto/objects/obj_local.h	18
openssl30/crypto/objects/o_names.c	12
openssl30/crypto/conf/conf_sap.c	2
openssl30/crypto/conf/conf_mod.c	33
openssl30/crypto/engine/eng_openssl.c	20
openssl30/crypto/evp/evp_lib.c	37
openssl30/crypto/dso/dso_lib.c	9
openssl30/crypto/provider_local.h	4
openssl30/crypto/provider_child.c	2
openssl30/crypto/evp/cmeth_lib.c	8
openssl30/crypto/evp/evp_enc.c	24
openssl30/crypto/rsa/rsa_ossl.c	1
openssl30/crypto/engine/tb_rsa.c	4
openssl30/crypto/dsa/dsa_ossl.c	1
openssl30/crypto/engine/tb_dsa.c	4
openssl30/crypto/ec/ec_kmeth.c	1
openssl30/crypto/engine/tb_eckey.c	4
openssl30/crypto/dh/dh_key.c	1
openssl30/crypto/engine/tb_dh.c	4
openssl30/crypto/rand/rand_meth.c	1
openssl30/crypto/engine/tb_rand.c	4
openssl30/crypto/engine/tb_cipher.c	7
openssl30/crypto/params.c	47
openssl30/crypto/evp/evp_utils.c	5
openssl30/crypto/engine/tb_digest.c	7
openssl30/crypto/evp/digest.c	17
openssl30/crypto/sha/sha_local.h	1
openssl30/include/crypto/md32_common.h	2
openssl30/crypto/engine/eng_pkey.c	1
openssl30/crypto/bio/bss_file.c	2
openssl30/crypto/o_fopen.c	1
openssl30/crypto/bio/bio_lib.c	17
openssl30/crypto/pem/pem_pkey.c	5
openssl30/crypto/bio/bf_readbuff.c	1
openssl30/crypto/pem/pem_lib.c	15
openssl30/crypto/evp/evp_key.c	3
openssl30/crypto/ui/ui_lib.c	27
openssl30/crypto/ui/ui_openssl.c	1
openssl30/crypto/ui/ui_null.c	1
openssl30/include/openssl/ui.h	2
openssl30/crypto/err/err_prn.c	1
openssl30/crypto/o_str.c	12
openssl30/crypto/bio/bio_print.c	11
openssl30/crypto/passphrase.c	9
openssl30/crypto/encode_decode/decoder_pkey.c	13
openssl30/crypto/encode_decode/decoder_meth.c	16
openssl30/crypto/encode_decode/decoder_lib.c	23
openssl30/crypto/evp/keymgmt_meth.c	21
openssl30/crypto/evp/evp_fetch.c	16
openssl30/crypto/core_namemap.c	19
openssl30/crypto/engine/eng_rdrand.c	4
openssl30/crypto/engine/eng_local.h	14
openssl30/crypto/engine/eng_dyn.c	12
openssl30/include/openssl/safestack.h	4
openssl30/crypto/dso/dso_dlfcn.c	1
openssl30/engines/e_padlock.c	22
openssl30/crypto/asn1/evp_asn1.c	1
openssl30/crypto/asn1/tasn_typ.c	17
openssl30/crypto/asn1/asn1_lib.c	12
openssl30/crypto/asn1/a_octet.c	1
openssl30/crypto/asn1/a_type.c	1
openssl30/crypto/asn1/tasn_fre.c	5
openssl30/crypto/asn1/a_object.c	7
openssl30/engines/e_afalg.c	27
openssl30/engines/e_afalg_err.c	3
openssl30/crypto/engine/eng_fat.c	5
openssl30/crypto/engine/eng_table.c	8
openssl30/crypto/async/async_wait.c	3
openssl30/crypto/async/arch/async_posix.h	1
openssl30/crypto/bsearch.c	1
openssl30/crypto/bn/bn_word.c	4
openssl30/crypto/bn/bn_lib.c	23
openssl30/crypto/bn/bn_local.h	1
openssl30/crypto/mem_sec.c	18
openssl30/crypto/bn/bn_shift.c	2
openssl30/crypto/bn/bn_conv.c	4
openssl30/include/internal/constant_time.h	4
openssl30/crypto/bn/asm/x86_64-gcc.c	2
openssl30/include/crypto/asn1.h	3
openssl30/crypto/property/property.c	25
openssl30/crypto/sparse_array.c	1
openssl30/crypto/core_fetch.c	3
openssl30/crypto/core_algorithm.c	4
openssl30/crypto/getenv.c	1
openssl30/include/openssl/core_dispatch.h	81
openssl30/crypto/provider.c	2
openssl30/crypto/property/property_query.c	3
openssl30/crypto/encode_decode/encoder_local.h	5
openssl30/crypto/evp/keymgmt_lib.c	14
openssl30/crypto/evp/p_lib.c	19
openssl30/include/crypto/evp.h	8
openssl30/include/openssl/x509.h	4
openssl30/crypto/x509/x_attrib.c	2
openssl30/include/openssl/asn1t.h	2
openssl30/crypto/asn1/tasn_utl.c	13
openssl30/crypto/asn1/a_int.c	10
openssl30/crypto/bio/bss_mem.c	3
openssl30/crypto/bio/ossl_core_bio.c	3
openssl30/crypto/ui/ui_util.c	8
openssl30/crypto/evp/encode.c	7
openssl30/crypto/evp/legacy_md5.c	1
openssl30/crypto/evp/m_sigver.c	7
openssl30/crypto/evp/signature.c	9
openssl30/crypto/evp/exchange.c	2
openssl30/crypto/evp/kem.c	2
openssl30/crypto/evp/asymcipher.c	2
openssl30/crypto/evp/ctrl_params_translate.c	10
openssl30/crypto/params_from_text.c	3
openssl30/crypto/asn1/p8_pkey.c	4
openssl30/crypto/evp/evp_pkey.c	1
openssl30/crypto/asn1/x_sig.c	3
openssl30/crypto/pkcs12/p12_p8d.c	2
openssl30/crypto/pkcs12/p12_decr.c	2
openssl30/crypto/evp/evp_pbe.c	6
openssl30/crypto/evp/evp_local.h	3
openssl30/crypto/asn1/d2i_pr.c	1
openssl30/crypto/x509/x_pubkey.c	7
openssl30/crypto/x509/x509_def.c	1
openssl30/crypto/conf/conf_lib.c	10
openssl30/crypto/conf/conf_def.c	1
openssl30/crypto/conf/conf_api.c	3
openssl30/include/openssl/conf.h	3
openssl30/crypto/conf/conf_mall.c	1
openssl30/crypto/asn1/asn_moid.c	3
openssl30/crypto/objects/obj_lib.c	1
openssl30/crypto/asn1/asn_mstbl.c	3
openssl30/crypto/x509/v3_utl.c	6
openssl30/crypto/asn1/asn1_gen.c	3
openssl30/crypto/asn1/a_strnid.c	6
openssl30/include/openssl/asn1.h	3
openssl30/crypto/engine/eng_cnf.c	5
openssl30/crypto/engine/eng_all.c	1
openssl30/crypto/engine/eng_ctrl.c	7
openssl30/crypto/evp/evp_cnf.c	2
openssl30/crypto/conf/conf_ssl.c	3
openssl30/crypto/provider_conf.c	10
openssl30/crypto/encode_decode/encoder_meth.c	3
openssl30/crypto/store/store_meth.c	3
openssl30/crypto/evp/legacy_md5_sha1.c	1
openssl30/crypto/evp/legacy_sha.c	13
openssl30/crypto/evp/legacy_mdc2.c	1
openssl30/crypto/evp/legacy_ripemd.c	1
openssl30/crypto/evp/legacy_wp.c	1
openssl30/crypto/sm3/legacy_sm3.c	1
openssl30/crypto/evp/legacy_blake2.c	2
openssl30/crypto/evp/e_des3.c	11
openssl30/crypto/evp/e_xcbc_d.c	1
openssl30/crypto/evp/e_rc4.c	2
openssl30/crypto/evp/e_rc4_hmac_md5.c	1
openssl30/crypto/evp/e_idea.c	4
openssl30/crypto/evp/e_seed.c	4
openssl30/crypto/evp/e_sm4.c	5
openssl30/crypto/evp/e_rc2.c	6
openssl30/crypto/evp/e_bf.c	4
openssl30/crypto/evp/e_cast.c	4
openssl30/crypto/evp/e_rc5.c	4
openssl30/crypto/evp/e_aes.c	38
openssl30/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl30/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl30/crypto/evp/e_aria.c	27
openssl30/crypto/evp/e_camellia.c	21
openssl30/crypto/evp/e_chacha20_poly1305.c	2
openssl30/crypto/store/store_init.c	1
openssl30/crypto/store/store_register.c	1
openssl30/crypto/store/store_local.h	1
openssl30/crypto/bio/bio_sock.c	1
openssl30/crypto/objects/obj_xref.c	5
openssl30/crypto/objects/obj_xref.h	4
openssl30/crypto/cmp/cmp_util.c	1
openssl30/crypto/trace.c	2
openssl30/crypto/buffer/buffer.c	5
openssl30/crypto/asn1/tasn_new.c	9
openssl30/crypto/asn1/a_bitstr.c	2
openssl30/crypto/bio/bss_null.c	1
openssl30/crypto/x509/t_crl.c	2
openssl30/crypto/x509/x509cset.c	10
openssl30/crypto/x509/t_x509.c	2
openssl30/crypto/bio/bio_dump.c	4
openssl30/crypto/asn1/a_strex.c	8
openssl30/crypto/x509/x_name.c	1
openssl30/crypto/x509/x509_obj.c	1
openssl30/crypto/x509/x509name.c	5
openssl30/crypto/asn1/asn1_parse.c	4
openssl30/crypto/asn1/tasn_enc.c	8
openssl30/crypto/asn1/asn1_local.h	3
openssl30/crypto/asn1/a_utf8.c	2
openssl30/include/internal/unicode.h	1
openssl30/crypto/asn1/a_time.c	6
openssl30/crypto/o_time.c	4
openssl30/crypto/x509/v3_prn.c	4
openssl30/crypto/x509/x509_v3.c	3
openssl30/crypto/x509/v3_lib.c	4
openssl30/include/openssl/x509v3.h	2
openssl30/crypto/bio/bf_prefix.c	1
openssl30/crypto/asn1/a_print.c	1
openssl30/crypto/asn1/f_int.c	1

Fuzzer: server_30

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3435	51.6%
gold	[1:9]	995	14.9%
yellow	[10:29]	124	1.86%
greenyellow	[30:49]	51	0.76%
lawngreen	50+	2045	30.7%
All colors	6650	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
34547	55366	6 : View List ['BUF_MEM_grow_clean', 'ERR_put_error', 'ASN1_get_object', 'BIO_read', 'ERR_clear_error', 'ERR_peek_error']	34547	55455	asn1_d2i_read_bio	call site: 05586	/src/openssl111/crypto/asn1/a_d2i_fp.c:145
28780	34738	11 : View List ['ossl_ffc_params_set_gindex', 'BN_GENCB_set', 'ossl_dh_generate_ffc_parameters', 'ossl_ffc_set_digest', 'ossl_ffc_params_set_h', 'ossl_ffc_params_set_seed', 'ossl_dh_new_ex', 'ossl_ffc_params_copy', 'DH_generate_parameters_ex', 'ossl_ffc_params_set_pcounter', 'BN_GENCB_new']	28784	38219	dh_gen	call site: 00000	/src/openssl/providers/implementations/keymgmt/dh_kmgmt.c:710
18426	39765	7 : View List ['ossl_rsa_pss_decode', 'ERR_set_error', 'ossl_rsa_sync_to_pss_params_30', 'ERR_new', 'ossl_rsa_set0_pss_params', 'ERR_set_debug', 'RSA_PSS_PARAMS_free']	18426	39765	ossl_rsa_param_decode	call site: 00000	/src/openssl/crypto/rsa/rsa_backend.c:542
17315	17315	1 : View List ['EVP_get_cipherbyname']	17315	17315	ssl_cipher_get_evp	call site: 00000	/src/openssl111/ssl/ssl_ciph.c:556
10061	10067	4 : View List ['EC_GROUP_check_named_curve', 'EC_GROUP_check', 'EC_KEY_get0_group', 'EC_KEY_get_flags']	22428	35023	ec_validate	call site: 00000	/src/openssl/providers/implementations/keymgmt/ec_kmgmt.c:952
9914	9914	2 : View List ['ec_GF2m_simple_oct2point', 'ec_GFp_simple_oct2point']	9914	9914	EC_POINT_oct2point	call site: 00000	/src/openssl111/crypto/ec/ec_oct.c:113
9386	9386	2 : View List ['conf_diagnostics', 'CONF_modules_load']	9386	16308	CONF_modules_load_file_ex	call site: 03837	/src/openssl/crypto/conf/conf_mod.c:206
8805	8805	2 : View List ['ec_GF2m_simple_set_compressed_coordinates', 'ec_GFp_simple_set_compressed_coordinates']	8805	8805	EC_POINT_set_compressed_coordinates	call site: 00000	/src/openssl111/crypto/ec/ec_oct.c:32
6939	46163	6 : View List ['ossl_param_build_set_int', 'EC_GROUP_get_trinomial_basis', 'EC_GROUP_get_basis_type', 'EC_GROUP_get_pentanomial_basis', 'EC_GROUP_get_degree', 'ossl_param_build_set_utf8_string']	6939	46163	ec_get_ecm_params	call site: 00000	/src/openssl/providers/implementations/keymgmt/ec_kmgmt.c:595
6939	6945	3 : View List ['ERR_put_error', 'CRYPTO_malloc', 'RAND_bytes']	6939	17791	RSA_padding_add_PKCS1_PSS_mgf1	call site: 00000	/src/openssl111/crypto/rsa/rsa_pss.c:196
6423	6423	1 : View List ['ossl_ec_key_pairwise_check']	6423	6529	ec_validate	call site: 00000	/src/openssl/providers/implementations/keymgmt/ec_kmgmt.c:972
6000	6002	3 : View List ['ossl_rsa_get0_pss_params_30', 'ossl_rsa_get0_libctx', 'pss_params_fromdata']	6000	12268	rsa_import	call site: 00000	/src/openssl/providers/implementations/keymgmt/rsa_kmgmt.c:188

Runtime coverage analysis

Covered functions

3724

Functions that are reachable but not covered

850

Reachable functions

2409

Percentage of reachable functions covered

64.72%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
openssl30/fuzz/driver.c	1
openssl30/fuzz/server.c	1
openssl30/ssl/methods.c	1
openssl30/ssl/ssl_lib.c	43
openssl30/crypto/err/err_blocks.c	2
openssl30/crypto/err/err.c	31
openssl30/crypto/init.c	40
openssl30/crypto/err/err_local.h	5
openssl30/crypto/mem.c	7
openssl30/crypto/threads_pthread.c	13
openssl30/crypto/cpuid.c	4
openssl30/crypto/ctype.c	3
openssl30/crypto/initthread.c	21
openssl30/crypto/stack/stack.c	21
openssl30/crypto/comp/c_zlib.c	2
openssl30/crypto/async/async.c	17
openssl30/crypto/rand/rand_lib.c	19
openssl30/providers/implementations/rands/seeding/rand_unix.c	4
openssl30/crypto/engine/eng_init.c	4
openssl30/crypto/cryptlib.c	2
openssl30/crypto/engine/eng_lib.c	21
openssl30/include/internal/refcount.h	2
openssl30/crypto/engine/tb_pkmeth.c	7
openssl30/crypto/evp/pmeth_lib.c	31
openssl30/crypto/engine/tb_asnmth.c	9
openssl30/crypto/asn1/ameth_lib.c	9
openssl30/crypto/engine/eng_list.c	10
openssl30/crypto/ex_data.c	14
openssl30/crypto/context.c	19
openssl30/include/internal/cryptlib.h	8
openssl30/include/openssl/crypto.h	2
openssl30/crypto/property/property_parse.c	25
openssl30/crypto/property/property_string.c	12
openssl30/crypto/lhash/lhash.c	12
openssl30/crypto/evp/evp_rand.c	16
openssl30/crypto/provider_core.c	44
openssl30/crypto/err/err_all.c	1
openssl30/include/openssl/err.h	4
openssl30/crypto/bn/bn_err.c	1
openssl30/crypto/rsa/rsa_err.c	1
openssl30/crypto/dh/dh_err.c	1
openssl30/crypto/evp/evp_err.c	1
openssl30/crypto/buffer/buf_err.c	1
openssl30/crypto/objects/obj_err.c	1
openssl30/crypto/pem/pem_err.c	1
openssl30/crypto/dsa/dsa_err.c	1
openssl30/crypto/x509/x509_err.c	1
openssl30/crypto/asn1/asn1_err.c	1
openssl30/crypto/conf/conf_err.c	1
openssl30/crypto/cpt_err.c	1
openssl30/crypto/comp/comp_err.c	1
openssl30/crypto/ec/ec_err.c	1
openssl30/crypto/bio/bio_err.c	1
openssl30/crypto/pkcs7/pkcs7err.c	1
openssl30/crypto/x509/v3err.c	1
openssl30/crypto/pkcs12/pk12err.c	1
openssl30/crypto/rand/rand_err.c	1
openssl30/crypto/dso/dso_err.c	1
openssl30/crypto/ts/ts_err.c	1
openssl30/crypto/engine/eng_err.c	1
openssl30/crypto/http/http_err.c	1
openssl30/crypto/ocsp/ocsp_err.c	1
openssl30/crypto/ui/ui_err.c	1
openssl30/crypto/cms/cms_err.c	1
openssl30/crypto/crmf/crmf_err.c	1
openssl30/crypto/cmp/cmp_err.c	1
openssl30/crypto/ct/ct_err.c	1
openssl30/crypto/ess/ess_err.c	1
openssl30/crypto/async/async_err.c	1
openssl30/crypto/store/store_err.c	1
openssl30/crypto/property/property_err.c	1
openssl30/providers/common/provider_err.c	1
openssl30/crypto/evp/c_allc.c	1
openssl30/crypto/evp/e_des.c	6
openssl30/crypto/evp/names.c	9
openssl30/crypto/objects/obj_dat.c	23
openssl30/crypto/evp/c_alld.c	1
openssl30/crypto/evp/legacy_md4.c	1
openssl30/crypto/objects/obj_local.h	18
openssl30/crypto/objects/o_names.c	12
openssl30/crypto/conf/conf_sap.c	2
openssl30/crypto/conf/conf_mod.c	33
openssl30/crypto/engine/eng_openssl.c	20
openssl30/crypto/evp/evp_lib.c	39
openssl30/crypto/dso/dso_lib.c	9
openssl30/crypto/provider_local.h	4
openssl30/crypto/provider_child.c	2
openssl30/crypto/evp/cmeth_lib.c	8
openssl30/crypto/evp/evp_enc.c	24
openssl30/crypto/rsa/rsa_ossl.c	2
openssl30/crypto/engine/tb_rsa.c	4
openssl30/crypto/dsa/dsa_ossl.c	2
openssl30/crypto/engine/tb_dsa.c	4
openssl30/crypto/ec/ec_kmeth.c	2
openssl30/crypto/engine/tb_eckey.c	4
openssl30/crypto/dh/dh_key.c	2
openssl30/crypto/engine/tb_dh.c	4
openssl30/crypto/rand/rand_meth.c	1
openssl30/crypto/engine/tb_rand.c	6
openssl30/crypto/engine/tb_cipher.c	7
openssl30/crypto/params.c	48
openssl30/crypto/evp/evp_utils.c	5
openssl30/crypto/engine/tb_digest.c	7
openssl30/crypto/evp/digest.c	18
openssl30/crypto/sha/sha_local.h	1
openssl30/include/crypto/md32_common.h	2
openssl30/crypto/engine/eng_pkey.c	1
openssl30/crypto/bio/bss_file.c	3
openssl30/crypto/o_fopen.c	1
openssl30/crypto/bio/bio_lib.c	19
openssl30/crypto/pem/pem_pkey.c	5
openssl30/crypto/bio/bf_readbuff.c	1
openssl30/crypto/pem/pem_lib.c	15
openssl30/crypto/evp/evp_key.c	3
openssl30/crypto/ui/ui_lib.c	27
openssl30/crypto/ui/ui_openssl.c	1
openssl30/crypto/ui/ui_null.c	1
openssl30/include/openssl/ui.h	2
openssl30/crypto/err/err_prn.c	2
openssl30/crypto/o_str.c	12
openssl30/crypto/bio/bio_print.c	11
openssl30/crypto/passphrase.c	9
openssl30/crypto/encode_decode/decoder_pkey.c	13
openssl30/crypto/encode_decode/decoder_meth.c	16
openssl30/crypto/encode_decode/decoder_lib.c	24
openssl30/crypto/evp/keymgmt_meth.c	22
openssl30/crypto/evp/evp_fetch.c	16
openssl30/crypto/core_namemap.c	19
openssl30/crypto/engine/eng_rdrand.c	4
openssl30/crypto/engine/eng_local.h	14
openssl30/crypto/engine/eng_dyn.c	12
openssl30/include/openssl/safestack.h	4
openssl30/crypto/dso/dso_dlfcn.c	1
openssl30/engines/e_padlock.c	22
openssl30/crypto/asn1/evp_asn1.c	1
openssl30/crypto/asn1/tasn_typ.c	11
openssl30/crypto/asn1/asn1_lib.c	13
openssl30/crypto/asn1/a_octet.c	2
openssl30/crypto/asn1/a_type.c	1
openssl30/crypto/asn1/tasn_fre.c	5
openssl30/crypto/asn1/a_object.c	6
openssl30/engines/e_afalg.c	27
openssl30/engines/e_afalg_err.c	3
openssl30/crypto/engine/eng_fat.c	5
openssl30/crypto/engine/eng_table.c	8
openssl30/crypto/async/async_wait.c	6
openssl30/crypto/async/arch/async_posix.h	1
openssl30/crypto/bsearch.c	1
openssl30/crypto/bn/bn_word.c	4
openssl30/crypto/bn/bn_lib.c	24
openssl30/crypto/bn/bn_local.h	1
openssl30/crypto/mem_sec.c	18
openssl30/crypto/bn/bn_shift.c	2
openssl30/crypto/bn/bn_conv.c	4
openssl30/include/internal/constant_time.h	4
openssl30/crypto/bn/asm/x86_64-gcc.c	2
openssl30/include/crypto/asn1.h	3
openssl30/crypto/property/property.c	25
openssl30/crypto/sparse_array.c	1
openssl30/crypto/core_fetch.c	3
openssl30/crypto/core_algorithm.c	4
openssl30/crypto/getenv.c	1
openssl30/include/openssl/core_dispatch.h	104
openssl30/crypto/provider.c	4
openssl30/crypto/property/property_query.c	3
openssl30/crypto/encode_decode/encoder_local.h	5
openssl30/crypto/evp/keymgmt_lib.c	15
openssl30/crypto/evp/p_lib.c	33
openssl30/include/crypto/evp.h	8
openssl30/include/openssl/x509.h	8
openssl30/crypto/x509/x_attrib.c	2
openssl30/include/openssl/asn1t.h	2
openssl30/crypto/asn1/tasn_utl.c	13
openssl30/crypto/asn1/a_int.c	11
openssl30/crypto/bio/bss_mem.c	3
openssl30/crypto/bio/ossl_core_bio.c	3
openssl30/crypto/ui/ui_util.c	8
openssl30/crypto/evp/encode.c	7
openssl30/crypto/evp/legacy_md5.c	1
openssl30/crypto/evp/m_sigver.c	7
openssl30/crypto/evp/signature.c	9
openssl30/crypto/evp/exchange.c	5
openssl30/crypto/evp/kem.c	2
openssl30/crypto/evp/asymcipher.c	2
openssl30/crypto/evp/ctrl_params_translate.c	10
openssl30/crypto/params_from_text.c	3
openssl30/crypto/asn1/p8_pkey.c	4
openssl30/crypto/asn1/tasn_dec.c	14
openssl30/crypto/buffer/buffer.c	4
openssl30/crypto/asn1/tasn_new.c	9
openssl30/crypto/asn1/a_bitstr.c	2
openssl30/crypto/evp/evp_pkey.c	1
openssl30/crypto/asn1/x_sig.c	3
openssl30/crypto/pkcs12/p12_p8d.c	2
openssl30/crypto/pkcs12/p12_decr.c	2
openssl30/crypto/evp/evp_pbe.c	6
openssl30/crypto/evp/evp_local.h	3
openssl30/crypto/asn1/d2i_pr.c	4
openssl30/crypto/x509/x_pubkey.c	7
openssl30/crypto/x509/x509_def.c	1
openssl30/crypto/conf/conf_lib.c	10
openssl30/crypto/conf/conf_def.c	1
openssl30/crypto/conf/conf_api.c	3
openssl30/include/openssl/conf.h	3
openssl30/crypto/conf/conf_mall.c	1
openssl30/crypto/asn1/asn_moid.c	3
openssl30/crypto/objects/obj_lib.c	1
openssl30/crypto/asn1/asn_mstbl.c	3
openssl30/crypto/x509/v3_utl.c	6
openssl30/crypto/asn1/asn1_gen.c	3
openssl30/crypto/asn1/a_strnid.c	6
openssl30/include/openssl/asn1.h	7
openssl30/crypto/engine/eng_cnf.c	5
openssl30/crypto/engine/eng_all.c	1
openssl30/crypto/engine/eng_ctrl.c	7
openssl30/crypto/evp/evp_cnf.c	2
openssl30/crypto/conf/conf_ssl.c	6
openssl30/crypto/provider_conf.c	10
openssl30/crypto/encode_decode/encoder_meth.c	3
openssl30/crypto/store/store_meth.c	3
openssl30/crypto/evp/legacy_md5_sha1.c	1
openssl30/crypto/evp/legacy_sha.c	13
openssl30/crypto/evp/legacy_mdc2.c	1
openssl30/crypto/evp/legacy_ripemd.c	1
openssl30/crypto/evp/legacy_wp.c	1
openssl30/crypto/sm3/legacy_sm3.c	1
openssl30/crypto/evp/legacy_blake2.c	2
openssl30/crypto/evp/e_des3.c	11
openssl30/crypto/evp/e_xcbc_d.c	1
openssl30/crypto/evp/e_rc4.c	2
openssl30/crypto/evp/e_rc4_hmac_md5.c	1
openssl30/crypto/evp/e_idea.c	4
openssl30/crypto/evp/e_seed.c	4
openssl30/crypto/evp/e_sm4.c	5
openssl30/crypto/evp/e_rc2.c	6
openssl30/crypto/evp/e_bf.c	4
openssl30/crypto/evp/e_cast.c	4
openssl30/crypto/evp/e_rc5.c	4
openssl30/crypto/evp/e_aes.c	38
openssl30/crypto/evp/e_aes_cbc_hmac_sha1.c	2
openssl30/crypto/evp/e_aes_cbc_hmac_sha256.c	2
openssl30/crypto/evp/e_aria.c	27
openssl30/crypto/evp/e_camellia.c	21
openssl30/crypto/evp/e_chacha20_poly1305.c	2
openssl30/crypto/store/store_init.c	1
openssl30/crypto/store/store_register.c	1
openssl30/crypto/store/store_local.h	1
openssl30/crypto/bio/bio_sock.c	1
openssl30/crypto/objects/obj_xref.c	5
openssl30/crypto/objects/obj_xref.h	4
openssl30/crypto/cmp/cmp_util.c	1
openssl30/crypto/trace.c	2
openssl30/ssl/ssl_init.c	8
openssl30/ssl/ssl_ciph.c	21
openssl30/include/openssl/ssl.h	5
openssl30/crypto/comp/comp_lib.c	3
openssl30/ssl/s3_lib.c	2
openssl30/ssl/ssl_err.c	1
openssl30/ssl/ssl_cert.c	15
openssl30/ssl/ssl_local.h	9
openssl30/crypto/x509/x509_lu.c	8
openssl30/include/openssl/x509_vfy.h	4
openssl30/crypto/x509/x509_cmp.c	9
openssl30/crypto/x509/x_name.c	7
openssl30/crypto/asn1/tasn_enc.c	8
openssl30/crypto/asn1/asn1_local.h	3
openssl30/crypto/x509/x509_vpm.c	10
openssl30/crypto/ct/ct_log.c	3
openssl30/include/openssl/ct.h	2
openssl30/ssl/tls_depr.c	3
openssl30/ssl/t1_lib.c	14
openssl30/ssl/tls_srp.c	2
openssl30/ssl/ssl_mcnf.c	2
openssl30/ssl/ssl_conf.c	13
openssl30/ssl/ssl_rsa.c	7
openssl30/crypto/x509/x_all.c	2
openssl30/crypto/asn1/a_d2i_fp.c	1
openssl30/ssl/ssl_sess.c	10
openssl30/crypto/x509/x_x509.c	3
openssl30/crypto/x509/x_crl.c	2
openssl30/ssl/statem/extensions_cust.c	4
openssl30/ssl/statem/statem_lib.c	1
openssl30/crypto/rsa/rsa_asn1.c	2
openssl30/crypto/ec/ec_key.c	4
openssl30/crypto/ec/ec_lib.c	4
openssl30/crypto/rsa/rsa_backend.c	1
openssl30/crypto/rsa/rsa_lib.c	1
openssl30/crypto/ec/ec_backend.c	1
openssl30/crypto/dsa/dsa_backend.c	1
openssl30/crypto/dsa/dsa_lib.c	3
openssl30/crypto/dh/dh_backend.c	1
openssl30/crypto/dh/dh_lib.c	1
openssl30/crypto/x509/v3_purp.c	12
openssl30/crypto/asn1/a_digest.c	1
openssl30/crypto/x509/x509_set.c	6
openssl30/crypto/x509/x509_ext.c	4
openssl30/crypto/x509/v3_lib.c	6
openssl30/crypto/x509/x509_v3.c	5
openssl30/include/openssl/x509v3.h	6
openssl30/crypto/x509/v3_bcons.c	2
openssl30/crypto/x509/v3_pcia.c	2
openssl30/crypto/x509/v3_crld.c	1
openssl30/crypto/asn1/a_dup.c	1
openssl30/crypto/x509/x509name.c	1
openssl30/crypto/pem/pem_all.c	4
openssl30/crypto/evp/p_legacy.c	2
openssl30/crypto/ec/ecp_nistz256.c	1
openssl30/crypto/ec/ecp_nistp224.c	1
openssl30/crypto/ec/ecp_nistp256.c	1
openssl30/crypto/ec/ecp_nistp521.c	1
openssl30/crypto/ec/ec_mult.c	1
openssl30/crypto/bn/bn_mont.c	1
openssl30/crypto/pem/pem_x509.c	1
openssl30/crypto/pem/pem_oth.c	1
openssl30/crypto/ffc/ffc_params.c	2
openssl30/ssl/record/rec_layer_s3.c	6
openssl30/ssl/record/ssl3_record.c	2
openssl30/ssl/statem/statem.c	5
openssl30/ssl/record/ssl3_buffer.c	3
openssl30/ssl/record/rec_layer_d1.c	1
openssl30/ssl/pqueue.c	2
openssl30/include/internal/dane.h	1
openssl30/crypto/x509/x_exten.c	2
openssl30/include/openssl/ocsp.h	1
openssl30/crypto/ocsp/ocsp_asn.c	2
openssl30/crypto/ct/ct_sct.c	2
openssl30/crypto/async/async_local.h	4
openssl30/crypto/async/arch/async_posix.c	3