High level conclusions

Fuzzers reach 25.54% of cyclomatic complexity.

Fuzzers reach 24.11% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

3787 / 15705

Cyclomatic complexity statically reachable by fuzzers

21013 / 82260

Runtime code coverage of functions

7605 / 15705

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: pem

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	41	28.6%
gold	[1:9]	3	2.09%
yellow	[10:29]	3	2.09%
greenyellow	[30:49]	1	0.69%
lawngreen	50+	95	66.4%
All colors	143	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1591	3190	5 : View List ['CRYPTO_free', 'CRYPTO_FREE_REF.9603', 'EVP_RAND_free', 'CRYPTO_DOWN_REF.9602', 'EVP_RAND_CTX_free']	1591	3190	EVP_RAND_CTX_free	call site: 00000	/src/openssl/crypto/evp/evp_rand.c:390
1587	1587	1 : View List ['ossl_rand_crng_ctx_free']	1587	1625	context_deinit_objs	call site: 00000	/src/openssl/crypto/context.c:331
43	48	6 : View List ['lh_OBJ_NAME_set_down_load', 'lh_OBJ_NAME_free', 'CRYPTO_THREAD_lock_free', 'sk_NAME_FUNCS_pop_free', 'lh_OBJ_NAME_doall', 'lh_OBJ_NAME_get_down_load']	43	48	OBJ_NAME_cleanup	call site: 00000	/src/openssl/crypto/objects/o_names.c:371
37	37	2 : View List ['ossl_strtouint64', 'ossl_strchr']	41	41	OPENSSL_cpuid_setup	call site: 00000	/src/openssl/crypto/cpuid.c:106
14	14	1 : View List ['async_deinit']	14	4964	OPENSSL_cleanup	call site: 00000	/src/openssl/crypto/init.c:407
14	14	2 : View List ['qsort', 'CRYPTO_get_ex_data']	14	19	CRYPTO_free_ex_data	call site: 00038	/src/openssl/crypto/ex_data.c:398
6	6	2 : View List ['sk_EX_CALLBACK_value', 'CRYPTO_malloc']	20	30	CRYPTO_free_ex_data	call site: 00036	/src/openssl/crypto/ex_data.c:385
6	6	2 : View List ['sk_EX_CALLBACK_value', 'CRYPTO_malloc']	18	23	ossl_crypto_new_ex_data_ex	call site: 00022	/src/openssl/crypto/ex_data.c:239
6	6	1 : View List ['sk_EX_CALLBACK_value']	6	11	ossl_crypto_free_ex_index_ex	call site: 00000	/src/openssl/crypto/ex_data.c:127
0	1651	1 : View List ['ossl_provider_store_free']	0	1651	ossl_provider_store_new	call site: 00000	/src/openssl/crypto/provider_core.c:312
0	292	2 : View List ['sk_reserve', 'OPENSSL_sk_free']	0	292	OPENSSL_sk_new_reserve	call site: 00000	/src/openssl/crypto/stack/stack.c:235
0	261	3 : View List ['ERR_set_debug', 'ERR_new', 'ERR_set_error']	0	261	BIO_puts	call site: 00092	/src/openssl/crypto/bio/bio_lib.c:536

Runtime coverage analysis

Covered functions

359

Functions that are reachable but not covered

28

Reachable functions

83

Percentage of reachable functions covered

66.27%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/pem.c	1
crypto/bio/bio_lib.c	11
include/internal/refcount.h	3
crypto/ex_data.c	6
crypto/context.c	4
crypto/threads_pthread.c	4
crypto/err/err_blocks.c	1
crypto/err/err_local.h	3
include/internal/cryptlib.h	2
crypto/stack/stack.c	3
include/openssl/crypto.h	2
crypto/pem/pem_lib.c	6
crypto/ctype.c	1
crypto/evp/encode.c	7

Fuzzer: asn1parse

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	321	57.5%
gold	[1:9]	6	1.07%
yellow	[10:29]	3	0.53%
greenyellow	[30:49]	2	0.35%
lawngreen	50+	226	40.5%
All colors	558	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
3263	3281	2 : View List ['OSSL_LIB_CTX_get_conf_diagnostics', 'CONF_modules_load']	3270	3305	CONF_modules_load_file_ex	call site: 00000	/src/openssl/crypto/conf/conf_mod.c:217
1591	3190	5 : View List ['CRYPTO_free', 'CRYPTO_FREE_REF.9603', 'EVP_RAND_free', 'CRYPTO_DOWN_REF.9602', 'EVP_RAND_CTX_free']	1591	3190	EVP_RAND_CTX_free	call site: 00000	/src/openssl/crypto/evp/evp_rand.c:390
1587	1587	1 : View List ['ossl_rand_crng_ctx_free']	1587	1625	context_deinit_objs	call site: 00000	/src/openssl/crypto/context.c:331
982	1243	5 : View List ['ERR_add_error_data', 'ERR_new', 'asn1_template_ex_d2i', 'ERR_set_debug', 'ERR_set_error']	982	1243	asn1_item_embed_d2i	call site: 00287	/src/openssl/crypto/asn1/tasn_dec.c:202
871	1235	2 : View List ['BIO_free', 'def_load_bio']	871	1235	def_load	call site: 00000	/src/openssl/crypto/conf/conf_def.c:177
636	636	2 : View List ['ASN1_TYPE_new', 'ASN1_TYPE_set']	925	4454	asn1_ex_c2i	call site: 00391	/src/openssl/crypto/asn1/tasn_dec.c:845
478	478	1 : View List ['ossl_asn1_template_free']	478	478	ossl_asn1_item_embed_free	call site: 00315	/src/openssl/crypto/asn1/tasn_fre.c:48
335	857	5 : View List ['ERR_new', 'ERR_set_debug', 'ERR_set_error', 'asn1_collect', 'BUF_MEM_grow_clean']	335	1594	asn1_d2i_ex_primitive	call site: 00373	/src/openssl/crypto/asn1/tasn_dec.c:783
313	313	1 : View List ['asn1_find_end']	313	1311	asn1_d2i_ex_primitive	call site: 00371	/src/openssl/crypto/asn1/tasn_dec.c:758
312	312	1 : View List ['OBJ_nid2sn']	318	1944	OBJ_obj2txt	call site: 00192	/src/openssl/crypto/objects/obj_dat.c:474
43	48	6 : View List ['lh_OBJ_NAME_set_down_load', 'lh_OBJ_NAME_free', 'CRYPTO_THREAD_lock_free', 'sk_NAME_FUNCS_pop_free', 'lh_OBJ_NAME_doall', 'lh_OBJ_NAME_get_down_load']	43	48	OBJ_NAME_cleanup	call site: 00000	/src/openssl/crypto/objects/o_names.c:371
37	37	2 : View List ['ossl_strtouint64', 'ossl_strchr']	41	41	OPENSSL_cpuid_setup	call site: 00000	/src/openssl/crypto/cpuid.c:106

Runtime coverage analysis

Covered functions

457

Functions that are reachable but not covered

75

Reachable functions

228

Percentage of reachable functions covered

67.11%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/asn1parse.c	1
crypto/asn1/asn1_parse.c	4
crypto/bio/bio_lib.c	10
crypto/err/err_blocks.c	1
crypto/err/err_local.h	3
crypto/asn1/asn1_lib.c	8
crypto/bio/bio_print.c	11
include/internal/common.h	1
crypto/ctype.c	1
crypto/o_str.c	2
crypto/bio/bf_prefix.c	1
include/internal/refcount.h	4
crypto/ex_data.c	6
crypto/context.c	4
crypto/threads_pthread.c	6
include/internal/cryptlib.h	2
crypto/stack/stack.c	13
include/openssl/crypto.h	2
crypto/asn1/a_object.c	6
crypto/objects/obj_dat.c	14
crypto/bsearch.c	1
crypto/objects/obj_local.h	1
crypto/lhash/lhash.c	2
crypto/bn/bn_word.c	3
crypto/bn/bn_lib.c	17
crypto/bn/bn_local.h	1
crypto/bn/bn_shift.c	2
crypto/bn/bn_conv.c	1
include/internal/constant_time.h	4
crypto/bn/asm/x86_64-gcc.c	1
crypto/bio/bio_dump.c	4
crypto/asn1/tasn_typ.c	15
crypto/asn1/tasn_dec.c	14
include/openssl/asn1t.h	2
crypto/asn1/tasn_fre.c	5
crypto/asn1/tasn_utl.c	9
crypto/asn1/a_int.c	8
crypto/asn1/tasn_new.c	9
crypto/asn1/a_type.c	1
crypto/asn1/a_bitstr.c	1

Fuzzer: bndiv

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	94	37.1%
gold	[1:9]	6	2.37%
yellow	[10:29]	3	1.18%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	150	59.2%
All colors	253	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1591	3190	5 : View List ['CRYPTO_free', 'CRYPTO_FREE_REF.9603', 'EVP_RAND_free', 'CRYPTO_DOWN_REF.9602', 'EVP_RAND_CTX_free']	1591	3190	EVP_RAND_CTX_free	call site: 00000	/src/openssl/crypto/evp/evp_rand.c:390
1587	1587	1 : View List ['ossl_rand_crng_ctx_free']	1587	1625	context_deinit_objs	call site: 00000	/src/openssl/crypto/context.c:331
261	261	3 : View List ['ERR_set_debug', 'ERR_new', 'ERR_set_error']	261	261	BN_usub	call site: 00168	/src/openssl/crypto/bn/bn_add.c:138
261	261	3 : View List ['ERR_set_debug', 'ERR_new', 'ERR_set_error']	261	261	BN_CTX_get	call site: 00039	/src/openssl/crypto/bn/bn_ctx.c:219
261	261	3 : View List ['ERR_set_debug', 'ERR_new', 'ERR_set_error']	261	261	BN_div	call site: 00031	/src/openssl/crypto/bn/bn_div.c:224
261	261	3 : View List ['ERR_set_debug', 'ERR_new', 'ERR_set_error']	261	261	bn_expand_internal	call site: 00014	/src/openssl/crypto/bn/bn_lib.c:273
261	261	3 : View List ['ERR_set_debug', 'ERR_new', 'ERR_set_error']	261	261	do_init_module_list_lock	call site: 00000	/src/openssl/crypto/conf/conf_mod.c:103
261	261	3 : View List ['ERR_set_debug', 'ERR_new', 'ERR_set_error']	261	261	OPENSSL_sk_insert	call site: 00000	/src/openssl/crypto/stack/stack.c:264
261	261	3 : View List ['ERR_set_debug', 'ERR_new', 'ERR_set_error']	261	261	sk_reserve	call site: 00000	/src/openssl/crypto/stack/stack.c:209
43	48	6 : View List ['lh_OBJ_NAME_set_down_load', 'lh_OBJ_NAME_free', 'CRYPTO_THREAD_lock_free', 'sk_NAME_FUNCS_pop_free', 'lh_OBJ_NAME_doall', 'lh_OBJ_NAME_get_down_load']	43	48	OBJ_NAME_cleanup	call site: 00000	/src/openssl/crypto/objects/o_names.c:371
37	37	2 : View List ['ossl_strtouint64', 'ossl_strchr']	41	41	OPENSSL_cpuid_setup	call site: 00000	/src/openssl/crypto/cpuid.c:106
14	14	1 : View List ['async_deinit']	14	4964	OPENSSL_cleanup	call site: 00000	/src/openssl/crypto/init.c:407

Runtime coverage analysis

Covered functions

344

Functions that are reachable but not covered

62

Reachable functions

126

Percentage of reachable functions covered

50.79%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/bndiv.c	1
crypto/bn/bn_lib.c	23
crypto/err/err_blocks.c	1
crypto/err/err_local.h	3
crypto/bn/bn_div.c	3
crypto/bn/bn_ctx.c	7
crypto/bn/bn_shift.c	2
crypto/bn/asm/x86_64-gcc.c	7
crypto/bn/bn_mul.c	6
crypto/bn/bn_add.c	3
include/internal/constant_time.h	2
crypto/bn/bn_print.c	2
crypto/bio/bss_file.c	1
crypto/bio/bio_lib.c	7
include/internal/refcount.h	3
crypto/ex_data.c	6
crypto/context.c	4
crypto/threads_pthread.c	4
include/internal/cryptlib.h	2
crypto/stack/stack.c	3
include/openssl/crypto.h	2

Fuzzer: v3name

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	127	33.3%
gold	[1:9]	18	4.72%
yellow	[10:29]	24	6.29%
greenyellow	[30:49]	7	1.83%
lawngreen	50+	205	53.8%
All colors	381	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
3263	3281	2 : View List ['OSSL_LIB_CTX_get_conf_diagnostics', 'CONF_modules_load']	3270	3305	CONF_modules_load_file_ex	call site: 00000	/src/openssl/crypto/conf/conf_mod.c:217
1591	3190	5 : View List ['CRYPTO_free', 'CRYPTO_FREE_REF.9603', 'EVP_RAND_free', 'CRYPTO_DOWN_REF.9602', 'EVP_RAND_CTX_free']	1591	3190	EVP_RAND_CTX_free	call site: 00000	/src/openssl/crypto/evp/evp_rand.c:390
1587	1587	1 : View List ['ossl_rand_crng_ctx_free']	1587	1625	context_deinit_objs	call site: 00000	/src/openssl/crypto/context.c:331
1235	1235	2 : View List ['BIO_free', 'def_load_bio']	1235	1235	def_load	call site: 00000	/src/openssl/crypto/conf/conf_def.c:177
663	1695	2 : View List ['x509_name_canon', 'x509_name_encode']	663	1695	x509_name_ex_i2d	call site: 00000	/src/openssl/crypto/x509/x_name.c:220
650	650	5 : View List ['fclose', 'BIO_clear_flags', 'BIO_ctrl', 'BIO_new', 'BIO_s_file']	650	650	BIO_new_file	call site: 00000	/src/openssl/crypto/bio/bss_file.c:66
605	605	1 : View List ['ASN1_TYPE_new']	605	4454	asn1_ex_c2i	call site: 00143	/src/openssl/crypto/asn1/tasn_dec.c:846
278	1137	5 : View List ['ERR_new', 'ERR_set_debug', 'ERR_set_error', 'OBJ_obj2nid', 'ASN1_INTEGER_get']	278	1137	ossl_asn1_do_adb	call site: 00077	/src/openssl/crypto/asn1/tasn_utl.c:234
261	265	2 : View List ['sk_const_ASN1_VALUE_set', 'sk_const_ASN1_VALUE_num']	261	265	asn1_set_seq_out	call site: 00368	/src/openssl/crypto/asn1/tasn_enc.c:451
43	48	6 : View List ['lh_OBJ_NAME_set_down_load', 'lh_OBJ_NAME_free', 'CRYPTO_THREAD_lock_free', 'sk_NAME_FUNCS_pop_free', 'lh_OBJ_NAME_doall', 'lh_OBJ_NAME_get_down_load']	43	48	OBJ_NAME_cleanup	call site: 00000	/src/openssl/crypto/objects/o_names.c:371
37	37	2 : View List ['ossl_strtouint64', 'ossl_strchr']	41	41	OPENSSL_cpuid_setup	call site: 00000	/src/openssl/crypto/cpuid.c:106
22	39	6 : View List ['OPENSSL_LH_set_down_load', 'ossl_check_CONF_VALUE_lh_doallfunc_type', 'ossl_check_CONF_VALUE_lh_type', 'OPENSSL_LH_free', 'lh_CONF_VALUE_doall_LH_CONF_VALUE', 'OPENSSL_LH_doall']	22	39	_CONF_free_data	call site: 00000	/src/openssl/crypto/conf/conf_api.c:142

Runtime coverage analysis

Covered functions

498

Functions that are reachable but not covered

32

Reachable functions

177

Percentage of reachable functions covered

81.92%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/v3name.c	1
crypto/x509/v3_genn.c	6
crypto/asn1/tasn_dec.c	14
crypto/err/err_blocks.c	1
crypto/err/err_local.h	3
crypto/asn1/asn1_lib.c	13
crypto/stack/stack.c	13
include/openssl/asn1t.h	2
crypto/asn1/tasn_fre.c	5
crypto/asn1/a_object.c	3
crypto/asn1/tasn_utl.c	13
include/internal/refcount.h	4
crypto/threads_pthread.c	4
crypto/objects/obj_dat.c	11
crypto/bsearch.c	1
crypto/objects/obj_local.h	1
crypto/lhash/lhash.c	2
crypto/asn1/a_int.c	10
crypto/asn1/tasn_typ.c	7
crypto/asn1/tasn_new.c	9
crypto/asn1/a_type.c	2
crypto/asn1/a_bitstr.c	2
crypto/objects/obj_lib.c	1
crypto/x509/x509_cmp.c	1
crypto/x509/x_name.c	2
crypto/asn1/tasn_enc.c	8
crypto/asn1/asn1_local.h	3
crypto/asn1/a_octet.c	1

Fuzzer: crl

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	266	29.6%
gold	[1:9]	6	0.66%
yellow	[10:29]	4	0.44%
greenyellow	[30:49]	7	0.78%
lawngreen	50+	614	68.4%
All colors	897	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
7085	7484	7 : View List ['ENGINE_finish', 'CRYPTO_free', 'EVP_KEYMGMT_free', 'evp_pkey_ctx_free_all_cached_data', 'BN_free', 'evp_pkey_ctx_free_old_ops', 'EVP_PKEY_free']	7085	7484	EVP_PKEY_CTX_free	call site: 00000	/src/openssl/crypto/evp/pmeth_lib.c:389
5886	5886	2 : View List ['EVP_DigestVerifyInit', 'EVP_DigestSignInit']	5886	6147	evp_md_init_internal	call site: 00000	/src/openssl/crypto/evp/digest.c:166
3263	3281	2 : View List ['OSSL_LIB_CTX_get_conf_diagnostics', 'CONF_modules_load']	3270	3305	CONF_modules_load_file_ex	call site: 00000	/src/openssl/crypto/conf/conf_mod.c:217
2566	2954	5 : View List ['CRYPTO_zalloc', 'EVP_PKEY_CTX_ctrl', 'ENGINE_init', 'ENGINE_finish', 'ENGINE_get_digest']	2566	5336	evp_md_init_internal	call site: 00000	/src/openssl/crypto/evp/digest.c:226
1729	3617	14 : View List ['DSO_ctrl', 'CRYPTO_strdup', 'CRYPTO_free', 'DSO_free', 'DSO_new', 'ossl_safe_getenv', 'ossl_get_modulesdir', 'CRYPTO_THREAD_read_lock', 'DSO_bind_func', 'DSO_load', 'DSO_merge', 'DSO_convert_filename', 'get_provider_store', 'CRYPTO_THREAD_unlock']	1735	4416	provider_init	call site: 00000	/src/openssl/crypto/provider_core.c:890
1591	3190	5 : View List ['CRYPTO_free', 'CRYPTO_FREE_REF.9603', 'EVP_RAND_free', 'CRYPTO_DOWN_REF.9602', 'EVP_RAND_CTX_free']	1591	3190	EVP_RAND_CTX_free	call site: 00000	/src/openssl/crypto/evp/evp_rand.c:390
1589	3181	2 : View List ['ossl_provider_up_ref_parent', 'ossl_provider_free']	1589	3181	ossl_provider_up_ref	call site: 00000	/src/openssl/crypto/provider_core.c:483
1589	1589	1 : View List ['ossl_provider_free_parent']	1589	1589	provider_deactivate	call site: 00000	/src/openssl/crypto/provider_core.c:1152
1587	1587	1 : View List ['ossl_rand_crng_ctx_free']	1587	1625	context_deinit_objs	call site: 00000	/src/openssl/crypto/context.c:331
871	1235	2 : View List ['BIO_free', 'def_load_bio']	871	1235	def_load	call site: 00000	/src/openssl/crypto/conf/conf_def.c:177
726	726	2 : View List ['ENGINE_get_pkey_asn1_meth', 'ENGINE_get_pkey_asn1_meth_engine']	726	726	EVP_PKEY_asn1_find	call site: 00512	/src/openssl/crypto/asn1/ameth_lib.c:91
602	602	2 : View List ['EVP_DigestSignUpdate', 'EVP_DigestVerifyUpdate']	602	863	EVP_DigestUpdate	call site: 00000	/src/openssl/crypto/evp/digest.c:396

Runtime coverage analysis

Covered functions

1455

Functions that are reachable but not covered

64

Reachable functions

377

Percentage of reachable functions covered

83.02%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/crl.c	1
crypto/x509/x_crl.c	4
crypto/asn1/tasn_dec.c	14
crypto/err/err_blocks.c	1
crypto/err/err_local.h	3
crypto/asn1/asn1_lib.c	14
crypto/stack/stack.c	17
include/openssl/asn1t.h	2
crypto/asn1/tasn_fre.c	5
crypto/asn1/a_object.c	6
crypto/asn1/tasn_utl.c	13
include/internal/refcount.h	4
crypto/threads_pthread.c	6
crypto/objects/obj_dat.c	14
crypto/bsearch.c	1
crypto/objects/obj_local.h	1
crypto/lhash/lhash.c	3
crypto/asn1/a_int.c	10
crypto/asn1/tasn_typ.c	16
crypto/asn1/tasn_new.c	9
crypto/asn1/a_type.c	1
crypto/asn1/a_bitstr.c	2
crypto/bio/bss_null.c	1
crypto/bio/bio_lib.c	11
crypto/ex_data.c	6
crypto/context.c	4
include/internal/cryptlib.h	2
include/openssl/crypto.h	2
crypto/x509/t_crl.c	2
crypto/bio/bio_print.c	11
include/internal/common.h	1
crypto/ctype.c	3
crypto/o_str.c	2
crypto/x509/x509cset.c	10
crypto/x509/t_x509.c	2
crypto/bn/bn_word.c	3
crypto/bn/bn_lib.c	17
crypto/bn/bn_local.h	1
crypto/bn/bn_shift.c	2
crypto/bn/bn_conv.c	1
include/internal/constant_time.h	4
crypto/bn/asm/x86_64-gcc.c	1
crypto/bio/bio_dump.c	4
crypto/objects/obj_xref.c	7
crypto/objects/obj_xref.h	2
crypto/asn1/ameth_lib.c	5
include/crypto/asn1.h	2
crypto/engine/tb_asnmth.c	3
crypto/engine/eng_table.c	3
crypto/err/err_mark.c	2
crypto/engine/eng_local.h	4
crypto/engine/eng_init.c	2
crypto/engine/eng_lib.c	1
crypto/engine/tb_pkmeth.c	1
crypto/evp/pmeth_lib.c	1
crypto/engine/eng_list.c	1
crypto/asn1/a_strex.c	8
crypto/x509/x_name.c	1
crypto/x509/x509_obj.c	1
include/openssl/x509.h	3
crypto/x509/x509name.c	5
crypto/asn1/asn1_parse.c	4
crypto/asn1/tasn_enc.c	8
crypto/asn1/asn1_local.h	3
crypto/asn1/a_utf8.c	2
include/internal/unicode.h	1
crypto/asn1/a_time.c	6
crypto/o_time.c	4
crypto/x509/v3_prn.c	4
crypto/x509/x509_v3.c	3
crypto/x509/v3_lib.c	4
include/openssl/x509v3.h	2
crypto/bio/bf_prefix.c	1
include/openssl/conf.h	2
crypto/x509/v3_utl.c	1
crypto/asn1/a_print.c	1
crypto/asn1/f_int.c	1

Fuzzer: dtlsclient

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3189	71.2%
gold	[1:9]	310	6.92%
yellow	[10:29]	102	2.27%
greenyellow	[30:49]	17	0.37%
lawngreen	50+	859	19.1%
All colors	4477	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16717	16726	15 : View List ['tls1_set_peer_legacy_sigalg', 'CRYPTO_free', 'EVP_DigestVerify', 'EVP_MD_CTX_new', 'EVP_DigestVerifyInit_ex', 'PACKET_get_net_2.5727', 'EVP_PKEY_CTX_set_rsa_pss_saltlen', 'PACKET_data.5729', 'EVP_PKEY_CTX_set_rsa_padding', 'construct_key_exchange_tbs', 'PACKET_get_sub_packet.5726', 'tls12_check_peer_sigalg', 'EVP_MD_get0_name', 'tls1_lookup_md', 'PACKET_get_length_prefixed_2.5731']	16717	39347	tls_process_key_exchange	call site: 00000	/src/openssl/ssl/statem/statem_clnt.c:2448
8249	10643	11 : View List ['ossl_ed448_public_from_private', 'ossl_ecx_dhkem_derive_private', 'ossl_x25519_public_from_private', 'RAND_priv_bytes_ex', 'ossl_ed25519_public_from_private', 'ERR_new', 'ossl_ecx_key_free', 'ERR_set_debug', 'ERR_set_error', 'ossl_ecx_key_allocate_privkey', 'ossl_x448_public_from_private']	8249	10643	ecx_gen	call site: 00000	/src/openssl/providers/implementations/keymgmt/ecx_kmgmt.c:674
6813	6816	5 : View List ['BN_clear_bit', 'BN_priv_rand_ex', 'BN_is_bit_set', 'BN_is_word', 'ossl_ffc_params_simple_validate']	6813	10315	generate_key	call site: 00000	/src/openssl/crypto/dh/dh_key.c:313
6591	57333	26 : View List ['dtls1_read_failed', 'SSL_CTX_remove_session', 'ssl_release_record', 'ossl_tls_handle_rlayer_return', 'ossl_statem_set_in_init', 'dtls_unbuffer_record', 'ossl_statem_fatal', 'PACKET_get_1.4074', 'BIO_set_flags', 'PACKET_remaining.4070', 'dtls1_retransmit_buffered_messages', 'PACKET_buf_init.4075', 'SSL_get_rbio', 'dtls1_handle_timeout', 'ossl_statem_get_in_handshake', 'ERR_set_debug', 'dtls_buffer_record', 'SSL_is_init_finished', 'dtls1_check_timeout_num', 'BIO_clear_flags', 'ERR_new', 'ossl_statem_app_data_allowed', 'dtls1_get_message_header', 'ossl_assert_int.4073', 'ossl_statem_in_error', 'SSL_in_init']	6591	57333	dtls1_read_bytes	call site: 00000	/src/openssl/ssl/record/rec_layer_d1.c:264
5016	5016	1 : View List ['ssl_validate_ct']	5016	5016	tls_process_initial_server_flight	call site: 00000	/src/openssl/ssl/statem/statem_clnt.c:2948
3692	3692	1 : View List ['tls13_change_cipher_state']	3692	3692	ossl_statem_client_post_work	call site: 00000	/src/openssl/ssl/statem/statem_clnt.c:807
3554	5476	20 : View List ['sk_STACK_OF_X509_NAME_ENTRY_new_null', 'ossl_check_X509_NAME_ENTRY_sk_type.18534', 'OPENSSL_sk_new_null', 'sk_STACK_OF_X509_NAME_ENTRY_pop_free', 'OBJ_dup', 'ERR_set_debug', 'ERR_set_error', 'asn1_string_canon', 'OPENSSL_sk_value', 'CRYPTO_malloc', 'sk_STACK_OF_X509_NAME_ENTRY_push', 'ossl_check_X509_NAME_ENTRY_type.18535', 'OPENSSL_sk_push', 'OPENSSL_sk_free', 'ERR_new', 'OPENSSL_sk_num', 'ossl_check_const_X509_NAME_ENTRY_sk_type.18533', 'X509_NAME_ENTRY_new', 'i2d_name_canon', 'X509_NAME_ENTRY_free']	3554	5476	x509_name_canon	call site: 00000	/src/openssl/crypto/x509/x_name.c:321
3543	3543	1 : View List ['tls_process_as_hello_retry_request']	3543	5638	tls_process_server_hello	call site: 00000	/src/openssl/ssl/statem/statem_clnt.c:1564
3417	3417	1 : View List ['tls_construct_cke_dhe']	3417	3417	tls_construct_client_key_exchange	call site: 00000	/src/openssl/ssl/statem/statem_clnt.c:3544
3405	3405	1 : View List ['ossl_ec_GF2m_simple_oct2point']	3405	3405	EC_POINT_oct2point	call site: 00000	/src/openssl/crypto/ec/ec_oct.c:118
3369	5165	10 : View List ['EC_POINT_set_compressed_coordinates', 'EC_POINT_set_affine_coordinates', 'BN_CTX_end', 'BN_ucmp', 'BN_CTX_free', 'BN_CTX_get', 'BN_CTX_start', 'BN_bin2bn', 'BN_CTX_new_ex', 'BN_is_odd']	3369	5948	ossl_ec_GFp_simple_oct2point	call site: 00000	/src/openssl/crypto/ec/ecp_oct.c:317
3263	3281	2 : View List ['OSSL_LIB_CTX_get_conf_diagnostics', 'CONF_modules_load']	3263	3305	CONF_modules_load_file_ex	call site: 00000	/src/openssl/crypto/conf/conf_mod.c:217

Runtime coverage analysis

Covered functions

2365

Functions that are reachable but not covered

966

Reachable functions

1776

Percentage of reachable functions covered

45.61%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/dtlsclient.c	1
ssl/methods.c	1
ssl/ssl_lib.c	38
crypto/err/err_blocks.c	4
crypto/err/err_local.h	6
ssl/ssl_init.c	7
ssl/ssl_ciph.c	16
crypto/context.c	12
crypto/threads_pthread.c	8
providers/implementations/rands/crngt.c	1
crypto/evp/digest.c	19
crypto/evp/evp_fetch.c	10
crypto/core_namemap.c	19
crypto/objects/o_names.c	8
crypto/lhash/lhash.c	8
crypto/objects/obj_local.h	9
crypto/stack/stack.c	22
crypto/evp/evp_lib.c	22
crypto/objects/obj_dat.c	26
crypto/asn1/a_object.c	6
crypto/o_str.c	11
crypto/bsearch.c	1
crypto/bn/bn_word.c	4
crypto/bn/bn_lib.c	18
crypto/bn/bn_local.h	1
crypto/bn/bn_shift.c	2
crypto/bn/bn_conv.c	1
include/internal/constant_time.h	4
crypto/bn/asm/x86_64-gcc.c	2
crypto/bio/bio_print.c	11
include/internal/common.h	2
crypto/ctype.c	3
crypto/asn1/ameth_lib.c	9
include/crypto/asn1.h	3
crypto/property/property.c	23
crypto/sparse_array.c	1
crypto/core_fetch.c	3
crypto/core_algorithm.c	4
crypto/provider_core.c	28
include/internal/refcount.h	5
crypto/initthread.c	13
crypto/dso/dso_lib.c	9
include/openssl/crypto.h	2
crypto/provider_local.h	2
crypto/provider_child.c	2
crypto/dso/dso_dlfcn.c	1
crypto/getenv.c	1
crypto/defaults.c	4
include/openssl/core_dispatch.h	107
include/openssl/err.h	2
crypto/encode_decode/decoder_pkey.c	23
crypto/params.c	32
crypto/evp/evp_utils.c	5
ssl/s3_lib.c	2
ssl/ssl_cert.c	10
crypto/ex_data.c	9
include/internal/cryptlib.h	6
ssl/ssl_local.h	7
crypto/x509/x509_lu.c	7
include/openssl/x509_vfy.h	4
crypto/x509/x509_cmp.c	6
crypto/x509/x_name.c	3
crypto/asn1/tasn_enc.c	8
crypto/asn1/asn1_local.h	3
crypto/asn1/a_bitstr.c	2
crypto/asn1/a_int.c	10
crypto/asn1/asn1_lib.c	14
crypto/asn1/tasn_utl.c	13
crypto/x509/x509_vpm.c	3
include/openssl/asn1.h	3
include/openssl/safestack.h	1
crypto/ct/ct_log.c	3
include/openssl/ct.h	1
crypto/evp/p_lib.c	22
crypto/evp/keymgmt_lib.c	14
include/crypto/evp.h	7
crypto/evp/keymgmt_meth.c	23
crypto/engine/tb_asnmth.c	5
crypto/engine/eng_table.c	6
crypto/err/err_mark.c	4
crypto/engine/eng_local.h	5
crypto/engine/eng_init.c	4
crypto/engine/eng_lib.c	4
crypto/engine/tb_pkmeth.c	4
crypto/evp/pmeth_lib.c	28
crypto/engine/eng_list.c	1
include/openssl/x509.h	3
crypto/x509/x_attrib.c	2
crypto/asn1/tasn_fre.c	5
include/openssl/asn1t.h	2
ssl/tls_depr.c	3
crypto/engine/tb_cipher.c	3
crypto/evp/evp_enc.c	27
crypto/engine/tb_digest.c	3
crypto/evp/signature.c	9
crypto/evp/exchange.c	5
ssl/t1_lib.c	7
crypto/provider.c	3
crypto/objects/obj_lib.c	1
crypto/objects/obj_xref.c	9
crypto/objects/obj_xref.h	5
crypto/evp/kem.c	2
crypto/evp/asymcipher.c	2
crypto/bio/bio_lib.c	22
include/openssl/ssl.h	3
crypto/rand/rand_lib.c	12
providers/implementations/rands/seeding/rand_unix.c	1
crypto/engine/tb_rand.c	2
crypto/rand/rand_meth.c	1
crypto/property/property_parse.c	18
crypto/evp/evp_rand.c	20
ssl/tls_srp.c	2
ssl/ssl_mcnf.c	2
crypto/conf/conf_ssl.c	3
ssl/ssl_conf.c	13
ssl/ssl_rsa.c	5
crypto/bio/bss_file.c	2
crypto/pem/pem_pkey.c	4
crypto/bio/bf_readbuff.c	1
crypto/passphrase.c	9
crypto/encode_decode/decoder_meth.c	19
crypto/encode_decode/decoder_lib.c	28
crypto/encode_decode/encoder_local.h	6
crypto/bio/ossl_core_bio.c	3
crypto/ui/ui_util.c	8
crypto/ui/ui_lib.c	28
crypto/ui/ui_openssl.c	1
crypto/ui/ui_null.c	1
include/openssl/ui.h	2
crypto/err/err_prn.c	1
crypto/pem/pem_lib.c	15
crypto/evp/encode.c	7
crypto/evp/names.c	6
crypto/evp/evp_key.c	3
crypto/evp/legacy_md5.c	1
crypto/evp/m_sigver.c	6
crypto/evp/ctrl_params_translate.c	8
crypto/asn1/p8_pkey.c	4
crypto/asn1/tasn_dec.c	14
crypto/asn1/tasn_typ.c	9
crypto/asn1/tasn_new.c	9
crypto/asn1/a_type.c	1
crypto/evp/evp_pkey.c	1
crypto/asn1/x_sig.c	3
crypto/pkcs12/p12_p8d.c	2
crypto/pkcs12/p12_decr.c	2
crypto/evp/evp_pbe.c	4
crypto/evp/evp_local.h	3
crypto/asn1/d2i_pr.c	4
crypto/x509/x_pubkey.c	7
crypto/x509/x_all.c	1
crypto/asn1/a_d2i_fp.c	1
ssl/ssl_sess.c	9
include/internal/time.h	14
crypto/x509/x_x509.c	2
crypto/x509/t_x509.c	1
crypto/x509/x_crl.c	2
ssl/statem/extensions_cust.c	4
ssl/statem/statem.c	6
ssl/statem/statem_lib.c	1
ssl/quic/quic_impl.c	34
ssl/quic/quic_channel.c	23
ssl/quic/quic_port.c	11
crypto/err/err_save.c	4
ssl/quic/quic_reactor.c	12
ssl/quic/quic_record_tx.c	3
ssl/quic/quic_engine.c	4
ssl/quic/quic_demux.c	2
ssl/record/rec_layer_s3.c	10
ssl/s3_msg.c	1
ssl/tls13_enc.c	2
ssl/t1_enc.c	1
ssl/record/rec_layer_d1.c	2
ssl/pqueue.c	3
crypto/bio/bss_dgram_pair.c	1
crypto/thread/arch/thread_posix.c	8
crypto/bio/bio_addr.c	2
ssl/quic/quic_txp.c	3
ssl/quic/quic_record_util.c	11
crypto/evp/kdf_meth.c	7
crypto/evp/kdf_lib.c	3
ssl/quic/quic_record_rx.c	2
ssl/quic/quic_record_shared.c	7
ssl/quic/quic_wire_pkt.c	2
include/internal/quic_demux.h	3
ssl/quic/quic_wire.c	5
include/internal/quic_vlint.h	1
ssl/quic/quic_fc.c	1
ssl/quic/quic_tls.c	5
ssl/quic/qlog.c	34
ssl/quic/json_enc.c	42
crypto/o_fopen.c	1
crypto/cversion.c	1
crypto/info.c	3
ssl/quic/qlog_event_helpers.c	5
ssl/quic/quic_rstream.c	1
ssl/quic/quic_sstream.c	1
crypto/bio/bss_null.c	1
crypto/async/async.c	13
crypto/async/async_wait.c	2
crypto/async/async_local.h	4
crypto/async/arch/async_posix.c	3
crypto/async/arch/async_posix.h	1
crypto/time.c	1
ssl/quic/quic_ackm.c	1
ssl/quic/quic_statm.c	1
ssl/quic/quic_thread_assist.c	2
crypto/thread/arch.c	1

Fuzzer: cmp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3023	57.8%
gold	[1:9]	259	4.95%
yellow	[10:29]	140	2.67%
greenyellow	[30:49]	28	0.53%
lawngreen	50+	1779	34.0%
All colors	5229	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
21179	21179	2 : View List ['check_msg_given_cert', 'ossl_cmp_ctx_set1_validatedSrvCert']	21179	58966	check_msg_find_cert	call site: 03570	/src/openssl/crypto/cmp/cmp_vfy.c:491
20234	28576	18 : View List ['ossl_sk_ASN1_UTF8STRING2text', 'ossl_cmp_exchange_error', 'ossl_cmp_pollrepcontent_get0_pollrep', 'sk_OSSL_CMP_POLLREP_num', 'ossl_cmp_is_error_with_waiting', 'OSSL_sleep', 'ossl_cmp_pollReq_new', 'OSSL_CMP_MSG_get_bodytype', 'ERR_set_debug', 'ERR_set_error', 'ossl_cmp_print_log', 'ASN1_INTEGER_get_int64', 'send_receive_check', 'CRYPTO_free', 'time', 'ERR_add_error_data', 'is_crep_with_waiting', 'ERR_new']	20234	31571	poll_for_response	call site: 04701	/src/openssl/crypto/cmp/cmp_client.c:289
11648	14991	22 : View List ['ossl_check_const_OSSL_CMP_PKISI_sk_type', 'OSSL_CRMF_CERTTEMPLATE_get0_issuer', 'ossl_check_const_X509_CRL_sk_type', 'ossl_cmp_pkisi_get_status', 'save_statusInfo', 'OSSL_CRMF_CERTID_get0_serialNumber', 'ERR_set_debug', 'ERR_set_error', 'ossl_cmp_print_log', 'OSSL_CRMF_CERTID_get0_issuer', 'ossl_check_const_OSSL_CRMF_CERTID_sk_type', 'send_receive_also_delayed', 'ERR_add_error_data', 'ERR_new', 'OPENSSL_sk_num', 'OSSL_CRMF_CERTTEMPLATE_get0_serialNumber', 'X509_NAME_cmp', 'ossl_cmp_revrepcontent_get_pkisi', 'ossl_cmp_revrepcontent_get_CertId', 'ASN1_INTEGER_cmp', 'sk_OSSL_CMP_REVDETAILS_value', 'OSSL_CMP_CTX_snprint_PKIStatus']	11648	15949	OSSL_CMP_exec_RR_ses	call site: 04881	/src/openssl/crypto/cmp/cmp_client.c:914
10061	10360	2 : View List ['send_receive_also_delayed', 'OPENSSL_sk_new_null']	10061	11318	OSSL_CMP_exec_GENM_ses	call site: 04965	/src/openssl/crypto/cmp/cmp_client.c:1035
10056	10056	1 : View List ['ossl_cmp_exchange_error']	10056	10056	OSSL_CMP_try_certreq	call site: 04873	/src/openssl/crypto/cmp/cmp_client.c:838
9245	9724	2 : View List ['send_receive_check', 'OSSL_CMP_MSG_free']	9245	9724	initial_certreq	call site: 01417	/src/openssl/crypto/cmp/cmp_client.c:808
8610	8871	7 : View List ['ossl_cmp_hdr_has_implicitConfirm', 'OSSL_CMP_CTX_set_option', 'ossl_cmp_pkisi_get_status', 'ERR_new', 'ERR_set_debug', 'ERR_set_error', 'ossl_cmp_certrep_new']	8610	10809	process_cert_request	call site: 05003	/src/openssl/crypto/cmp/cmp_server.c:278
8350	8826	7 : View List ['ERR_peek_last_error', 'X509_STORE_CTX_new_ex', 'OSSL_CMP_CTX_print_errors', 'ERR_GET_REASON.2010', 'X509_STORE_CTX_free', 'X509_STORE_CTX_init', 'X509_verify_cert']	8350	9087	OSSL_CMP_validate_cert_path	call site: 04147	/src/openssl/crypto/cmp/cmp_vfy.c:118
6884	7424	11 : View List ['OSSL_CRMF_POPO_new', 'OSSL_CRMF_POPOSIGNINGKEY_free', 'create_popo_signature', 'ASN1_NULL_new', 'ERR_new', 'ASN1_INTEGER_new', 'ERR_set_debug', 'ERR_set_error', 'ASN1_INTEGER_set', 'OSSL_CRMF_POPOSIGNINGKEY_new', 'OSSL_CRMF_POPOPRIVKEY_new']	6884	8382	OSSL_CRMF_MSG_create_popo	call site: 02018	/src/openssl/crypto/crmf/crmf_lib.c:406
6347	6608	4 : View List ['ERR_set_debug', 'ERR_new', 'ERR_set_error', 'ossl_cmp_rp_new']	6347	7566	process_rr	call site: 05140	/src/openssl/crypto/cmp/cmp_server.c:337
5568	5570	4 : View List ['strcmp', 'EVP_PKEY_get_default_digest_name', 'OSSL_CMP_PROTECTEDPART_it', 'ASN1_item_sign_ex']	5568	5846	ossl_cmp_calc_protection	call site: 02917	/src/openssl/crypto/cmp/cmp_protect.c:55
5059	10773	4 : View List ['ossl_x509_add_cert_new', 'ossl_cmp_print_log', 'OSSL_CMP_CTX_print_errors', 'X509_build_chain']	5059	19504	ossl_cmp_msg_add_extraCerts	call site: 03021	/src/openssl/crypto/cmp/cmp_protect.c:140

Runtime coverage analysis

Covered functions

2888

Functions that are reachable but not covered

794

Reachable functions

1983

Percentage of reachable functions covered

59.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/cmp.c	7
crypto/bio/bio_lib.c	16
include/internal/refcount.h	5
crypto/ex_data.c	9
crypto/context.c	8
crypto/threads_pthread.c	8
crypto/err/err_blocks.c	2
crypto/err/err_local.h	4
include/internal/cryptlib.h	6
crypto/stack/stack.c	24
include/openssl/crypto.h	2
crypto/cmp/cmp_msg.c	37
crypto/cmp/cmp_asn.c	37
crypto/asn1/a_d2i_fp.c	2
crypto/err/err_mark.c	3
crypto/asn1/asn1_lib.c	19
include/openssl/err.h	2
crypto/asn1/tasn_dec.c	14
include/openssl/asn1t.h	2
crypto/asn1/tasn_fre.c	5
crypto/asn1/a_object.c	6
crypto/asn1/tasn_utl.c	13
crypto/objects/obj_dat.c	19
crypto/bsearch.c	1
crypto/objects/obj_local.h	6
crypto/lhash/lhash.c	7
crypto/asn1/a_int.c	20
crypto/asn1/tasn_typ.c	22
crypto/asn1/tasn_new.c	10
crypto/asn1/a_type.c	3
crypto/asn1/a_bitstr.c	5
crypto/bio/bss_null.c	1
crypto/cmp/cmp_server.c	15
crypto/cmp/cmp_ctx.c	28
crypto/o_str.c	12
crypto/evp/digest.c	22
crypto/evp/evp_fetch.c	8
providers/implementations/rands/crngt.c	1
crypto/provider_core.c	28
crypto/core_namemap.c	19
crypto/objects/o_names.c	8
crypto/evp/evp_lib.c	24
crypto/asn1/ameth_lib.c	8
include/crypto/asn1.h	3
crypto/initthread.c	13
crypto/dso/dso_lib.c	9
crypto/provider_local.h	2
crypto/provider_child.c	2
crypto/core_algorithm.c	4
include/openssl/core_dispatch.h	113
crypto/params.c	19
crypto/evp/evp_utils.c	5
include/internal/common.h	1
crypto/property/property.c	23
crypto/sparse_array.c	1
crypto/core_fetch.c	3
crypto/dso/dso_dlfcn.c	1
crypto/getenv.c	1
crypto/defaults.c	1
crypto/encode_decode/decoder_pkey.c	3
crypto/http/http_client.c	2
crypto/bio/bio_print.c	11
crypto/ctype.c	5
crypto/x509/x_x509.c	11
crypto/x509/x_name.c	10
crypto/x509/x509_lu.c	19
include/openssl/x509_vfy.h	9
crypto/x509/x_crl.c	2
crypto/x509/x509_vpm.c	14
include/openssl/asn1.h	5
include/openssl/safestack.h	4
crypto/x509/t_x509.c	6
include/openssl/x509.h	9
crypto/evp/p_lib.c	24
crypto/evp/keymgmt_lib.c	11
include/crypto/evp.h	7
crypto/evp/keymgmt_meth.c	20
crypto/engine/tb_asnmth.c	3
crypto/engine/eng_table.c	3
crypto/engine/eng_local.h	4
crypto/engine/eng_init.c	4
crypto/engine/eng_lib.c	3
crypto/engine/tb_pkmeth.c	4
crypto/evp/pmeth_lib.c	31
crypto/engine/eng_list.c	1
crypto/x509/x_attrib.c	2
include/openssl/cmp.h	8
include/openssl/x509v3.h	10
crypto/x509/v3_genn.c	4
crypto/x509/x_exten.c	5
crypto/x509/v3_cpols.c	4
crypto/x509/x_req.c	4
crypto/asn1/a_i2d_fp.c	1
crypto/asn1/tasn_enc.c	8
crypto/asn1/asn1_local.h	3
crypto/asn1/tasn_prn.c	9
crypto/asn1/asn1_parse.c	4
crypto/x509/v3_utl.c	3
crypto/bn/bn_lib.c	20
include/internal/constant_time.h	4
crypto/bn/bn_conv.c	2
crypto/bn/bn_word.c	3
crypto/bn/bn_shift.c	2
crypto/bn/asm/x86_64-gcc.c	1
crypto/asn1/a_utctm.c	2
crypto/asn1/a_time.c	14
crypto/o_time.c	6
crypto/asn1/a_gentm.c	3
crypto/bn/bn_local.h	1
crypto/bio/bio_dump.c	4
crypto/bio/bf_prefix.c	1
crypto/asn1/a_strex.c	9
crypto/asn1/a_utf8.c	2
include/internal/unicode.h	1
crypto/cmp/cmp_util.c	7
crypto/asn1/a_octet.c	3
crypto/x509/x509_set.c	12
crypto/asn1/a_dup.c	1
crypto/cmp/cmp_client.c	16
crypto/cmp/cmp_hdr.c	16
crypto/x509/x509_cmp.c	16
crypto/x509/x509_req.c	7
crypto/rand/rand_lib.c	10
providers/implementations/rands/seeding/rand_unix.c	1
crypto/engine/tb_rand.c	2
crypto/rand/rand_meth.c	1
crypto/property/property_parse.c	18
crypto/evp/evp_rand.c	20
crypto/x509/v3_skid.c	1
crypto/crmf/crmf_asn.c	29
crypto/cmp/cmp_local.h	12
crypto/x509/x_pubkey.c	11
crypto/x509/x509name.c	6
crypto/x509/x509_v3.c	14
crypto/objects/obj_lib.c	2
crypto/crmf/crmf_lib.c	18
crypto/x509/x509_att.c	4
crypto/x509/v3_lib.c	6
crypto/x509/v3_conf.c	2
include/openssl/crmf.h	5
crypto/evp/signature.c	12
crypto/evp/exchange.c	3
crypto/evp/kem.c	3
crypto/evp/asymcipher.c	11
crypto/asn1/a_sign.c	2
crypto/evp/m_sigver.c	10
crypto/evp/names.c	6
crypto/evp/ctrl_params_translate.c	8
crypto/engine/tb_digest.c	3
crypto/asn1/x_algor.c	11
crypto/objects/obj_xref.c	10
crypto/objects/obj_xref.h	2
crypto/cmp/cmp_protect.c	5
crypto/crmf/crmf_pbm.c	2
crypto/x509/v3_purp.c	17
crypto/evp/legacy_sha.c	1
crypto/x509/x_all.c	4
crypto/asn1/a_digest.c	1
crypto/x509/x509_ext.c	4
crypto/x509/v3_bcons.c	2
crypto/x509/v3_pcia.c	2
crypto/x509/v3_crld.c	1
crypto/evp/evp_pbe.c	4
crypto/evp/evp_local.h	3
crypto/evp/mac_lib.c	10
crypto/evp/mac_meth.c	9
crypto/x509/x509_vfy.c	35
crypto/x509/pcy_tree.c	2
crypto/x509/pcy_node.c	1
crypto/x509/pcy_local.h	1
crypto/x509/pcy_data.c	1
crypto/asn1/a_verify.c	2
crypto/rsa/rsa_ameth.c	3
crypto/rsa/rsa_backend.c	2
crypto/rsa/rsa_asn1.c	2
crypto/asn1/asn_pack.c	1
crypto/rsa/rsa_pss.c	3
crypto/rsa/rsa_lib.c	4
include/internal/dane.h	2
crypto/x509/x509_trust.c	5
crypto/bio/bss_file.c	2
crypto/cmp/cmp_vfy.c	18
crypto/x509/x509_obj.c	1
crypto/x509/x509cset.c	1
crypto/err/err_prn.c	5
crypto/encode_decode/encoder_pkey.c	7
crypto/encode_decode/encoder_meth.c	16
crypto/encode_decode/encoder_lib.c	19
crypto/provider.c	1
crypto/encode_decode/encoder_local.h	5
crypto/passphrase.c	5
crypto/bio/ossl_core_bio.c	3
crypto/ui/ui_util.c	8
crypto/ui/ui_lib.c	28
crypto/ui/ui_openssl.c	1
crypto/ui/ui_null.c	1
include/openssl/ui.h	2
crypto/x509/v3_prn.c	4
include/openssl/conf.h	2
crypto/asn1/a_print.c	1
crypto/x509/x_x509a.c	5
crypto/evp/evp_enc.c	24
crypto/asn1/evp_asn1.c	1
crypto/engine/tb_cipher.c	3
crypto/cmp/cmp_status.c	7
crypto/sleep.c	1

Fuzzer: decoder

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	931	46.8%
gold	[1:9]	165	8.29%
yellow	[10:29]	86	4.32%
greenyellow	[30:49]	19	0.95%
lawngreen	50+	787	39.5%
All colors	1988	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
8720	10562	8 : View List ['do_b2i_key', 'EVP_CIPHER_fetch', 'EVP_DecryptInit_ex', 'EVP_DecryptUpdate', 'EVP_DecryptFinal_ex', 'read_ledword', 'CRYPTO_malloc', 'derive_pvk_key']	8722	14377	do_PVK_body_key	call site: 00000	/src/openssl/crypto/pem/pvkfmt.c:868
8690	9529	5 : View List ['generate_q_fips186_4', 'BN_lshift', 'BN_CTX_get', 'generate_p', 'CRYPTO_malloc']	13570	21701	ossl_ffc_params_FIPS186_4_gen_verify	call site: 00000	/src/openssl/crypto/ffc/ffc_params_generate.c:619
5886	5886	2 : View List ['EVP_DigestVerifyInit', 'EVP_DigestSignInit']	5886	6147	evp_md_init_internal	call site: 00000	/src/openssl/crypto/evp/digest.c:166
4577	11497	9 : View List ['BN_clear_bit', 'BN_priv_rand_ex', 'BN_num_bits', 'BN_is_bit_set', 'ossl_ffc_params_simple_validate', 'DH_get_nid', 'BN_is_word', 'ossl_ifc_ffc_compute_security_bits', 'ossl_ffc_generate_private_key']	4577	12655	generate_key	call site: 00000	/src/openssl/crypto/dh/dh_key.c:311
4459	8959	2 : View List ['ossl_ffc_params_FIPS186_2_validate', 'ossl_ffc_params_FIPS186_4_validate']	4459	8959	ossl_ffc_params_full_validate	call site: 00000	/src/openssl/crypto/ffc/ffc_params_validate.c:154
4459	4459	1 : View List ['ossl_ffc_params_FIPS186_2_validate']	4459	4735	ossl_ffc_params_simple_validate	call site: 00000	/src/openssl/crypto/ffc/ffc_params_validate.c:115
3263	3281	2 : View List ['OSSL_LIB_CTX_get_conf_diagnostics', 'CONF_modules_load']	3263	3305	CONF_modules_load_file_ex	call site: 00000	/src/openssl/crypto/conf/conf_mod.c:217
3239	4878	10 : View List ['ossl_assert_int.34170', 'evp_keymgmt_freedata', 'evp_keymgmt_util_export', 'CRYPTO_THREAD_read_lock', 'evp_keymgmt_util_cache_keydata', 'evp_keymgmt_util_clear_operation_cache', 'match_type', 'evp_keymgmt_util_find_operation_cache', 'CRYPTO_THREAD_write_lock', 'CRYPTO_THREAD_unlock']	3239	4878	evp_keymgmt_util_export_to_provider	call site: 01820	/src/openssl/crypto/evp/keymgmt_lib.c:117
2566	2954	5 : View List ['CRYPTO_zalloc', 'EVP_PKEY_CTX_ctrl', 'ENGINE_init', 'ENGINE_finish', 'ENGINE_get_digest']	2566	5336	evp_md_init_internal	call site: 00000	/src/openssl/crypto/evp/digest.c:226
2225	4211	2 : View List ['EVP_PKEY_CTX_free', 'EVP_PKEY_CTX_new_from_pkey']	3869	15853	evp_pkey_export_to_provider	call site: 01847	/src/openssl/crypto/evp/p_lib.c:1885
2125	2125	1 : View List ['RAND_bytes_ex']	2125	2441	bnrand	call site: 00000	/src/openssl/crypto/bn/bn_rand.c:53
1936	1936	1 : View List ['EVP_KEYMGMT_fetch']	1936	9614	int_ctx_new	call site: 01887	/src/openssl/crypto/evp/pmeth_lib.c:253

Runtime coverage analysis

Covered functions

2689

Functions that are reachable but not covered

226

Reachable functions

874

Percentage of reachable functions covered

74.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/decoder.c	1
crypto/bio/bss_null.c	1
crypto/bio/bio_lib.c	12
include/internal/refcount.h	4
crypto/ex_data.c	10
crypto/context.c	8
crypto/threads_pthread.c	7
crypto/err/err_blocks.c	1
crypto/err/err_local.h	3
include/internal/cryptlib.h	6
crypto/stack/stack.c	17
include/openssl/crypto.h	2
crypto/encode_decode/decoder_pkey.c	22
providers/implementations/rands/crngt.c	1
crypto/evp/digest.c	6
crypto/evp/evp_fetch.c	9
crypto/core_namemap.c	19
crypto/objects/o_names.c	8
crypto/lhash/lhash.c	7
crypto/objects/obj_local.h	6
crypto/evp/evp_lib.c	4
crypto/objects/obj_dat.c	19
crypto/asn1/a_object.c	3
crypto/o_str.c	9
crypto/bsearch.c	1
crypto/bn/bn_word.c	3
crypto/bn/bn_lib.c	17
crypto/bn/bn_local.h	1
crypto/bn/bn_shift.c	2
crypto/bn/bn_conv.c	1
include/internal/constant_time.h	4
crypto/bn/asm/x86_64-gcc.c	1
crypto/bio/bio_print.c	11
include/internal/common.h	1
crypto/ctype.c	2
crypto/asn1/ameth_lib.c	9
include/crypto/asn1.h	3
crypto/property/property.c	23
crypto/sparse_array.c	1
crypto/core_fetch.c	3
crypto/core_algorithm.c	4
crypto/provider_core.c	28
crypto/initthread.c	9
crypto/dso/dso_lib.c	9
crypto/provider_local.h	2
crypto/provider_child.c	2
crypto/dso/dso_dlfcn.c	1
crypto/getenv.c	1
crypto/defaults.c	1
include/openssl/core_dispatch.h	46
include/openssl/err.h	1
crypto/params.c	14
crypto/evp/evp_utils.c	2
crypto/encode_decode/decoder_meth.c	19
crypto/encode_decode/decoder_lib.c	28
crypto/evp/keymgmt_meth.c	24
crypto/provider.c	1
crypto/encode_decode/encoder_local.h	11
crypto/evp/keymgmt_lib.c	14
crypto/evp/p_lib.c	24
crypto/err/err_mark.c	3
include/crypto/evp.h	7
crypto/engine/tb_asnmth.c	5
crypto/engine/eng_table.c	6
crypto/engine/eng_local.h	5
crypto/engine/eng_init.c	4
crypto/engine/eng_lib.c	4
crypto/engine/tb_pkmeth.c	4
crypto/evp/pmeth_lib.c	13
crypto/engine/eng_list.c	1
include/openssl/x509.h	2
crypto/x509/x_attrib.c	3
crypto/asn1/tasn_fre.c	5
include/openssl/asn1t.h	2
crypto/asn1/asn1_lib.c	12
crypto/asn1/tasn_utl.c	13
crypto/asn1/a_int.c	10
crypto/passphrase.c	7
crypto/bio/bf_readbuff.c	1
crypto/bio/ossl_core_bio.c	3
crypto/ui/ui_util.c	8
crypto/ui/ui_lib.c	28
crypto/ui/ui_openssl.c	1
crypto/ui/ui_null.c	1
include/openssl/ui.h	2
crypto/err/err_prn.c	1
crypto/bio/bf_prefix.c	1
crypto/encode_decode/encoder_pkey.c	7
crypto/encode_decode/encoder_meth.c	16
crypto/encode_decode/encoder_lib.c	18
include/openssl/safestack.h	2
crypto/x509/x509_att.c	4
crypto/objects/obj_lib.c	1
crypto/asn1/a_dup.c	1
crypto/asn1/tasn_enc.c	8
crypto/asn1/asn1_local.h	3
crypto/asn1/a_bitstr.c	2
crypto/asn1/tasn_dec.c	13
crypto/asn1/tasn_typ.c	7
crypto/asn1/tasn_new.c	9
crypto/asn1/a_type.c	1
crypto/evp/signature.c	1
crypto/evp/exchange.c	1
crypto/evp/kem.c	1
crypto/evp/asymcipher.c	1
crypto/evp/pmeth_check.c	7

Fuzzer: client

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2679	59.8%
gold	[1:9]	273	6.09%
yellow	[10:29]	106	2.36%
greenyellow	[30:49]	27	0.60%
lawngreen	50+	1392	31.0%
All colors	4477	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
15287	33717	14 : View List ['X509_STORE_CTX_new_ex', 'ossl_statem_fatal', 'X509_STORE_CTX_get0_chain', 'ossl_check_const_X509_sk_type.6001', 'ssl_security_cert_chain', 'ERR_new', 'ssl_add_cert_to_wpacket', 'OPENSSL_sk_num', 'ERR_set_debug', 'OPENSSL_sk_value', 'ERR_clear_error', 'X509_STORE_CTX_free', 'X509_STORE_CTX_init', 'X509_verify_cert']	15287	33717	ssl_add_cert_chain	call site: 00000	/src/openssl/ssl/statem/statem_lib.c:1003
9434	9445	6 : View List ['verify_cb_cert', 'X509_chain_check_suiteb', 'check_name_constraints', 'X509v3_asid_validate_path', 'internal_verify', 'X509v3_addr_validate_path']	9434	9445	verify_chain	call site: 00000	/src/openssl/crypto/x509/x509_vfy.c:240
7245	7245	1 : View List ['tls_post_process_server_rpk']	7245	7245	tls_post_process_server_certificate	call site: 00000	/src/openssl/ssl/statem/statem_clnt.c:2068
6827	6827	2 : View List ['SSL_use_certificate', 'SSL_use_PrivateKey']	6827	19307	tls_prepare_client_certificate	call site: 00000	/src/openssl/ssl/statem/statem_clnt.c:3713
5886	5886	2 : View List ['EVP_DigestVerifyInit', 'EVP_DigestSignInit']	5886	6147	evp_md_init_internal	call site: 02477	/src/openssl/crypto/evp/digest.c:166
5016	5016	1 : View List ['ssl_validate_ct']	5016	5016	tls_process_initial_server_flight	call site: 00000	/src/openssl/ssl/statem/statem_clnt.c:2948
4603	6887	2 : View List ['ossl_ffc_generate_private_key', 'ossl_ffc_params_simple_validate']	4603	8064	generate_key	call site: 00000	/src/openssl/crypto/dh/dh_key.c:329
4116	4116	1 : View List ['srp_generate_client_master_secret']	4116	4116	tls_client_key_exchange_post_work	call site: 00000	/src/openssl/ssl/statem/statem_clnt.c:3587
4074	6139	4 : View List ['ssl_check_srvr_ecc_cert_and_alg', 'ERR_new', 'ossl_statem_fatal', 'ERR_set_debug']	4074	6139	ssl3_check_cert_and_algorithm	call site: 00000	/src/openssl/ssl/statem/statem_clnt.c:3955
3843	3917	2 : View List ['EC_GROUP_free', 'EC_GROUP_new_from_ecpkparameters']	3843	4875	d2i_ECPKParameters	call site: 00000	/src/openssl/crypto/ec/ec_asn1.c:891
3546	3546	2 : View List ['ecx_key_pairwise_check', 'ecd_key_pairwise_check']	3546	3546	ecx_validate	call site: 00000	/src/openssl/providers/implementations/keymgmt/ecx_kmgmt.c:918
3426	5295	8 : View List ['RSA_size', 'CRYPTO_free', 'EVP_MD_fetch', 'ossl_rsa_padding_add_PKCS1_OAEP_mgf1_ex', 'ERR_new', 'ERR_set_debug', 'ERR_set_error', 'CRYPTO_malloc']	3426	5297	rsa_encrypt	call site: 00000	/src/openssl/providers/implementations/asymciphers/rsa_enc.c:172

Runtime coverage analysis

Covered functions

3975

Functions that are reachable but not covered

727

Reachable functions

1776

Percentage of reachable functions covered

59.07%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/client.c	1
ssl/methods.c	1
ssl/ssl_lib.c	38
crypto/err/err_blocks.c	4
crypto/err/err_local.h	6
ssl/ssl_init.c	7
ssl/ssl_ciph.c	16
crypto/context.c	12
crypto/threads_pthread.c	8
providers/implementations/rands/crngt.c	1
crypto/evp/digest.c	19
crypto/evp/evp_fetch.c	10
crypto/core_namemap.c	19
crypto/objects/o_names.c	8
crypto/lhash/lhash.c	8
crypto/objects/obj_local.h	9
crypto/stack/stack.c	22
crypto/evp/evp_lib.c	22
crypto/objects/obj_dat.c	26
crypto/asn1/a_object.c	6
crypto/o_str.c	11
crypto/bsearch.c	1
crypto/bn/bn_word.c	4
crypto/bn/bn_lib.c	18
crypto/bn/bn_local.h	1
crypto/bn/bn_shift.c	2
crypto/bn/bn_conv.c	1
include/internal/constant_time.h	4
crypto/bn/asm/x86_64-gcc.c	2
crypto/bio/bio_print.c	11
include/internal/common.h	2
crypto/ctype.c	3
crypto/asn1/ameth_lib.c	9
include/crypto/asn1.h	3
crypto/property/property.c	23
crypto/sparse_array.c	1
crypto/core_fetch.c	3
crypto/core_algorithm.c	4
crypto/provider_core.c	28
include/internal/refcount.h	5
crypto/initthread.c	13
crypto/dso/dso_lib.c	9
include/openssl/crypto.h	2
crypto/provider_local.h	2
crypto/provider_child.c	2
crypto/dso/dso_dlfcn.c	1
crypto/getenv.c	1
crypto/defaults.c	4
include/openssl/core_dispatch.h	107
include/openssl/err.h	2
crypto/encode_decode/decoder_pkey.c	23
crypto/params.c	32
crypto/evp/evp_utils.c	5
ssl/s3_lib.c	2
ssl/ssl_cert.c	10
crypto/ex_data.c	9
include/internal/cryptlib.h	6
ssl/ssl_local.h	7
crypto/x509/x509_lu.c	7
include/openssl/x509_vfy.h	4
crypto/x509/x509_cmp.c	6
crypto/x509/x_name.c	3
crypto/asn1/tasn_enc.c	8
crypto/asn1/asn1_local.h	3
crypto/asn1/a_bitstr.c	2
crypto/asn1/a_int.c	10
crypto/asn1/asn1_lib.c	14
crypto/asn1/tasn_utl.c	13
crypto/x509/x509_vpm.c	3
include/openssl/asn1.h	3
include/openssl/safestack.h	1
crypto/ct/ct_log.c	3
include/openssl/ct.h	1
crypto/evp/p_lib.c	22
crypto/evp/keymgmt_lib.c	14
include/crypto/evp.h	7
crypto/evp/keymgmt_meth.c	23
crypto/engine/tb_asnmth.c	5
crypto/engine/eng_table.c	6
crypto/err/err_mark.c	4
crypto/engine/eng_local.h	5
crypto/engine/eng_init.c	4
crypto/engine/eng_lib.c	4
crypto/engine/tb_pkmeth.c	4
crypto/evp/pmeth_lib.c	28
crypto/engine/eng_list.c	1
include/openssl/x509.h	3
crypto/x509/x_attrib.c	2
crypto/asn1/tasn_fre.c	5
include/openssl/asn1t.h	2
ssl/tls_depr.c	3
crypto/engine/tb_cipher.c	3
crypto/evp/evp_enc.c	27
crypto/engine/tb_digest.c	3
crypto/evp/signature.c	9
crypto/evp/exchange.c	5
ssl/t1_lib.c	7
crypto/provider.c	3
crypto/objects/obj_lib.c	1
crypto/objects/obj_xref.c	9
crypto/objects/obj_xref.h	5
crypto/evp/kem.c	2
crypto/evp/asymcipher.c	2
crypto/bio/bio_lib.c	22
include/openssl/ssl.h	3
crypto/rand/rand_lib.c	12
providers/implementations/rands/seeding/rand_unix.c	1
crypto/engine/tb_rand.c	2
crypto/rand/rand_meth.c	1
crypto/property/property_parse.c	18
crypto/evp/evp_rand.c	20
ssl/tls_srp.c	2
ssl/ssl_mcnf.c	2
crypto/conf/conf_ssl.c	3
ssl/ssl_conf.c	13
ssl/ssl_rsa.c	5
crypto/bio/bss_file.c	2
crypto/pem/pem_pkey.c	4
crypto/bio/bf_readbuff.c	1
crypto/passphrase.c	9
crypto/encode_decode/decoder_meth.c	19
crypto/encode_decode/decoder_lib.c	28
crypto/encode_decode/encoder_local.h	6
crypto/bio/ossl_core_bio.c	3
crypto/ui/ui_util.c	8
crypto/ui/ui_lib.c	28
crypto/ui/ui_openssl.c	1
crypto/ui/ui_null.c	1
include/openssl/ui.h	2
crypto/err/err_prn.c	1
crypto/pem/pem_lib.c	15
crypto/evp/encode.c	7
crypto/evp/names.c	6
crypto/evp/evp_key.c	3
crypto/evp/legacy_md5.c	1
crypto/evp/m_sigver.c	6
crypto/evp/ctrl_params_translate.c	8
crypto/asn1/p8_pkey.c	4
crypto/asn1/tasn_dec.c	14
crypto/asn1/tasn_typ.c	9
crypto/asn1/tasn_new.c	9
crypto/asn1/a_type.c	1
crypto/evp/evp_pkey.c	1
crypto/asn1/x_sig.c	3
crypto/pkcs12/p12_p8d.c	2
crypto/pkcs12/p12_decr.c	2
crypto/evp/evp_pbe.c	4
crypto/evp/evp_local.h	3
crypto/asn1/d2i_pr.c	4
crypto/x509/x_pubkey.c	7
crypto/x509/x_all.c	1
crypto/asn1/a_d2i_fp.c	1
ssl/ssl_sess.c	9
include/internal/time.h	14
crypto/x509/x_x509.c	2
crypto/x509/t_x509.c	1
crypto/x509/x_crl.c	2
ssl/statem/extensions_cust.c	4
ssl/statem/statem.c	6
ssl/statem/statem_lib.c	1
ssl/quic/quic_impl.c	34
ssl/quic/quic_channel.c	23
ssl/quic/quic_port.c	11
crypto/err/err_save.c	4
ssl/quic/quic_reactor.c	12
ssl/quic/quic_record_tx.c	3
ssl/quic/quic_engine.c	4
ssl/quic/quic_demux.c	2
ssl/record/rec_layer_s3.c	10
ssl/s3_msg.c	1
ssl/tls13_enc.c	2
ssl/t1_enc.c	1
ssl/record/rec_layer_d1.c	2
ssl/pqueue.c	3
crypto/bio/bss_dgram_pair.c	1
crypto/thread/arch/thread_posix.c	8
crypto/bio/bio_addr.c	2
ssl/quic/quic_txp.c	3
ssl/quic/quic_record_util.c	11
crypto/evp/kdf_meth.c	7
crypto/evp/kdf_lib.c	3
ssl/quic/quic_record_rx.c	2
ssl/quic/quic_record_shared.c	7
ssl/quic/quic_wire_pkt.c	2
include/internal/quic_demux.h	3
ssl/quic/quic_wire.c	5
include/internal/quic_vlint.h	1
ssl/quic/quic_fc.c	1
ssl/quic/quic_tls.c	5
ssl/quic/qlog.c	34
ssl/quic/json_enc.c	42
crypto/o_fopen.c	1
crypto/cversion.c	1
crypto/info.c	3
ssl/quic/qlog_event_helpers.c	5
ssl/quic/quic_rstream.c	1
ssl/quic/quic_sstream.c	1
crypto/bio/bss_null.c	1
crypto/async/async.c	13
crypto/async/async_wait.c	2
crypto/async/async_local.h	4
crypto/async/arch/async_posix.c	3
crypto/async/arch/async_posix.h	1
crypto/time.c	1
ssl/quic/quic_ackm.c	1
ssl/quic/quic_statm.c	1
ssl/quic/quic_thread_assist.c	2
crypto/thread/arch.c	1

Fuzzer: asn1

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1368	32.3%
gold	[1:9]	326	7.70%
yellow	[10:29]	140	3.30%
greenyellow	[30:49]	41	0.96%
lawngreen	50+	2355	55.6%
All colors	4230	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
9182	11497	9 : View List ['BN_clear_bit', 'BN_priv_rand_ex', 'BN_num_bits', 'BN_is_bit_set', 'ossl_ffc_params_simple_validate', 'DH_get_nid', 'BN_is_word', 'ossl_ifc_ffc_compute_security_bits', 'ossl_ffc_generate_private_key']	9182	12655	generate_key	call site: 00000	/src/openssl/crypto/dh/dh_key.c:311
5886	5886	2 : View List ['EVP_DigestVerifyInit', 'EVP_DigestSignInit']	5886	6147	evp_md_init_internal	call site: 00000	/src/openssl/crypto/evp/digest.c:166
4026	4026	1 : View List ['key_to_epki_der_priv_bio']	4026	4026	key_to_pki_der_priv_bio	call site: 00000	/src/openssl/providers/implementations/encode_decode/encode_key2any.c:253
4015	6947	15 : View List ['BN_RECP_CTX_init', 'BN_nnmod', 'BN_CTX_end', 'BN_num_bits', 'BN_is_bit_set', 'BN_set_word', 'BN_zero_ex', 'BN_CTX_get', 'BN_copy', 'BN_abs_is_word', 'BN_CTX_start', 'BN_is_zero', 'BN_mod_mul_reciprocal', 'BN_RECP_CTX_free', 'BN_RECP_CTX_set']	4015	6947	BN_mod_exp_recp	call site: 02051	/src/openssl/crypto/bn/bn_exp.c:179
3263	3281	2 : View List ['OSSL_LIB_CTX_get_conf_diagnostics', 'CONF_modules_load']	3263	3305	CONF_modules_load_file_ex	call site: 00000	/src/openssl/crypto/conf/conf_mod.c:217
2679	2679	1 : View List ['i2d_PUBKEY']	2679	3303	i2d_SSL_SESSION	call site: 00000	/src/openssl/ssl/ssl_asn1.c:179
2566	2954	5 : View List ['CRYPTO_zalloc', 'EVP_PKEY_CTX_ctrl', 'ENGINE_init', 'ENGINE_finish', 'ENGINE_get_digest']	2566	5336	evp_md_init_internal	call site: 00000	/src/openssl/crypto/evp/digest.c:226
2369	4307	4 : View List ['ossl_ecx_key_free', 'ossl_evp_pkey_get1_X25519', 'EVP_PKEY_get_id', 'EVP_PKEY_free']	2369	4307	ossl_d2i_X25519_PUBKEY	call site: 00000	/src/openssl/crypto/x509/x_pubkey.c:932
2125	2125	1 : View List ['RAND_bytes_ex']	2125	2441	bnrand	call site: 02724	/src/openssl/crypto/bn/bn_rand.c:53
1729	3617	14 : View List ['DSO_ctrl', 'CRYPTO_strdup', 'CRYPTO_free', 'DSO_free', 'DSO_new', 'ossl_safe_getenv', 'ossl_get_modulesdir', 'CRYPTO_THREAD_read_lock', 'DSO_bind_func', 'DSO_load', 'DSO_merge', 'DSO_convert_filename', 'get_provider_store', 'CRYPTO_THREAD_unlock']	1735	4416	provider_init	call site: 02298	/src/openssl/crypto/provider_core.c:890
1696	3852	3 : View List ['OSSL_PARAM_get_utf8_string_ptr', 'EVP_CIPHER_fetch', 'EVP_CIPHER_free']	1696	4140	key2any_set_ctx_params	call site: 00000	/src/openssl/providers/implementations/encode_decode/encode_key2any.c:986
1640	7484	7 : View List ['ENGINE_finish', 'CRYPTO_free', 'EVP_KEYMGMT_free', 'evp_pkey_ctx_free_all_cached_data', 'BN_free', 'evp_pkey_ctx_free_old_ops', 'EVP_PKEY_free']	1640	7484	EVP_PKEY_CTX_free	call site: 00000	/src/openssl/crypto/evp/pmeth_lib.c:389

Runtime coverage analysis

Covered functions

3186

Functions that are reachable but not covered

294

Reachable functions

1539

Percentage of reachable functions covered

80.9%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/asn1.c	1
crypto/asn1/tasn_dec.c	14
crypto/err/err_blocks.c	1
crypto/err/err_local.h	3
crypto/asn1/asn1_lib.c	14
crypto/stack/stack.c	19
include/openssl/asn1t.h	2
crypto/asn1/tasn_fre.c	5
crypto/asn1/a_object.c	6
crypto/asn1/tasn_utl.c	13
include/internal/refcount.h	4
crypto/threads_pthread.c	8
crypto/objects/obj_dat.c	16
crypto/bsearch.c	1
crypto/objects/obj_local.h	6
crypto/lhash/lhash.c	7
crypto/asn1/a_int.c	12
crypto/asn1/tasn_typ.c	18
crypto/asn1/tasn_new.c	9
crypto/asn1/a_type.c	1
crypto/asn1/a_bitstr.c	3
crypto/bio/bss_null.c	1
crypto/bio/bio_lib.c	12
crypto/ex_data.c	9
crypto/context.c	9
include/internal/cryptlib.h	6
include/openssl/crypto.h	2
crypto/asn1/tasn_prn.c	9
crypto/bio/bio_print.c	11
include/internal/common.h	1
crypto/ctype.c	4
crypto/o_str.c	10
crypto/asn1/asn1_local.h	3
crypto/asn1/asn1_parse.c	4
crypto/x509/v3_utl.c	7
crypto/bn/bn_lib.c	40
include/internal/constant_time.h	7
crypto/bn/bn_conv.c	2
crypto/bn/bn_word.c	4
crypto/bn/bn_shift.c	6
crypto/bn/asm/x86_64-gcc.c	10
crypto/asn1/a_utctm.c	1
crypto/asn1/a_time.c	6
crypto/o_time.c	4
crypto/asn1/a_gentm.c	1
crypto/bn/bn_local.h	1
crypto/bio/bio_dump.c	4
crypto/bio/bf_prefix.c	1
crypto/asn1/a_strex.c	6
crypto/asn1/tasn_enc.c	8
crypto/asn1/a_utf8.c	2
include/internal/unicode.h	1
crypto/ts/ts_asn1.c	12
crypto/ts/ts_req_print.c	1
crypto/ts/ts_req_utils.c	2
crypto/ts/ts_lib.c	5
crypto/x509/x509_v3.c	5
include/openssl/x509.h	4
crypto/x509/v3_prn.c	3
crypto/x509/v3_lib.c	4
include/openssl/x509v3.h	2
include/openssl/conf.h	2
crypto/asn1/a_print.c	1
crypto/ts/ts_rsp_print.c	5
include/openssl/asn1.h	3
crypto/x509/v3_san.c	1
crypto/x509/x509_obj.c	1
crypto/ess/ess_asn1.c	10
crypto/dh/dh_asn1.c	5
crypto/dh/dh_lib.c	6
crypto/engine/eng_init.c	4
crypto/engine/eng_lib.c	4
crypto/engine/tb_pkmeth.c	1
crypto/evp/pmeth_lib.c	1
crypto/engine/tb_asnmth.c	5
crypto/asn1/ameth_lib.c	9
crypto/engine/eng_list.c	1
crypto/ffc/ffc_params.c	6
crypto/dh/dh_key.c	1
crypto/engine/tb_dh.c	2
crypto/engine/eng_table.c	6
crypto/err/err_mark.c	3
crypto/engine/eng_local.h	5
crypto/dh/dh_group_params.c	1
crypto/ffc/ffc_dh.c	4
crypto/dsa/dsa_sign.c	3
crypto/asn1_dsa.c	3
include/internal/packet.h	14
crypto/dsa/dsa_asn1.c	6
crypto/dsa/dsa_lib.c	1
crypto/rsa/rsa_asn1.c	4
crypto/rsa/rsa_lib.c	1
crypto/rsa/rsa_local.h	1
crypto/rsa/rsa_mp.c	2
crypto/bn/bn_blind.c	1
crypto/ec/ec_asn1.c	14
crypto/ec/ec_curve.c	6
crypto/ec/ec_lib.c	36
crypto/bn/bn_ctx.c	15
crypto/ec/ec_cvt.c	2
crypto/ec/ecp_mont.c	1
crypto/ec/ecp_nistz256.c	2
crypto/ec/ecp_nistp224.c	2
crypto/ec/ecp_nistp256.c	2
crypto/ec/ecp_nistp384.c	2
crypto/ec/ecp_nistp521.c	2
crypto/ec/ec_mult.c	2
crypto/bn/bn_mont.c	11
crypto/ec/ec2_smpl.c	1
crypto/ec/ec_local.h	1
crypto/bn/bn_add.c	4
crypto/bn/bn_div.c	3
crypto/bn/bn_gcd.c	3
crypto/bn/bn_mod.c	7
crypto/bn/bn_mul.c	6
crypto/ec/ec_oct.c	4
crypto/ec/ecp_oct.c	3
crypto/bn/bn_sqr.c	4
crypto/bn/bn_sqrt.c	1
crypto/bn/bn_exp.c	8
crypto/bn/rsaz_exp.c	2
crypto/bn/rsaz_exp.h	2
crypto/bn/bn_recp.c	6
crypto/bn/bn_rand.c	2
crypto/rand/rand_lib.c	11
crypto/engine/tb_rand.c	2
crypto/rand/rand_meth.c	1
providers/implementations/rands/crngt.c	1
crypto/evp/digest.c	7
crypto/evp/evp_fetch.c	9
crypto/core_namemap.c	19
crypto/objects/o_names.c	8
crypto/evp/evp_lib.c	8
include/crypto/asn1.h	3
crypto/property/property.c	23
crypto/sparse_array.c	1
crypto/core_fetch.c	3
crypto/core_algorithm.c	4
crypto/provider_core.c	28
crypto/initthread.c	13
crypto/dso/dso_lib.c	9
crypto/provider_local.h	2
crypto/provider_child.c	2
crypto/dso/dso_dlfcn.c	1
crypto/getenv.c	1
crypto/defaults.c	1
include/openssl/core_dispatch.h	78
include/openssl/err.h	2
crypto/encode_decode/decoder_pkey.c	22
crypto/params.c	16
crypto/evp/evp_utils.c	3
crypto/property/property_parse.c	18
crypto/evp/evp_rand.c	20
crypto/bn/bn_kron.c	1
crypto/ec/ec2_oct.c	3
crypto/bn/bn_gf2m.c	7
crypto/ec/eck_prn.c	2
crypto/evp/ec_support.c	1
crypto/asn1/t_pkey.c	2
crypto/bn/bn_intern.c	1
crypto/ec/ec_key.c	11
crypto/ec/ec_kmeth.c	2
crypto/engine/tb_eckey.c	2
crypto/ec/ec_ameth.c	3
crypto/asn1/d2i_pr.c	5
crypto/evp/p_lib.c	16
crypto/asn1/p8_pkey.c	6
crypto/encode_decode/decoder_meth.c	19
crypto/encode_decode/decoder_lib.c	28
crypto/evp/keymgmt_meth.c	18
crypto/provider.c	1
crypto/encode_decode/encoder_local.h	11
crypto/evp/keymgmt_lib.c	7
include/crypto/evp.h	1
crypto/x509/x_attrib.c	2
crypto/passphrase.c	7
crypto/bio/bf_readbuff.c	1
crypto/bio/ossl_core_bio.c	3
crypto/ui/ui_util.c	8
crypto/ui/ui_lib.c	28
crypto/ui/ui_openssl.c	1
crypto/ui/ui_null.c	1
include/openssl/ui.h	2
crypto/err/err_prn.c	1
crypto/evp/evp_pkey.c	2
crypto/encode_decode/encoder_pkey.c	7
crypto/encode_decode/encoder_meth.c	16
crypto/encode_decode/encoder_lib.c	19
include/openssl/safestack.h	2
crypto/asn1/i2d_evp.c	2
ssl/ssl_asn1.c	6
ssl/ssl_sess.c	3
ssl/ssl_init.c	7
ssl/ssl_ciph.c	5
ssl/s3_lib.c	3
include/internal/time.h	9
crypto/time.c	1
ssl/ssl_lib.c	8
crypto/x509/x_x509.c	2
crypto/x509/x_pubkey.c	7
crypto/x509/t_x509.c	1
ssl/ssl_txt.c	1
include/openssl/comp.h	2
crypto/evp/evp_enc.c	8
ssl/tls_depr.c	1
crypto/engine/tb_cipher.c	3
crypto/x509/x509_txt.c	1

Fuzzer: quic-client

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2527	52.0%
gold	[1:9]	300	6.18%
yellow	[10:29]	103	2.12%
greenyellow	[30:49]	25	0.51%
lawngreen	50+	1899	39.1%
All colors	4854	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
9434	9445	6 : View List ['verify_cb_cert', 'X509_chain_check_suiteb', 'check_name_constraints', 'X509v3_asid_validate_path', 'internal_verify', 'X509v3_addr_validate_path']	9434	9445	verify_chain	call site: 00000	/src/openssl/crypto/x509/x509_vfy.c:240
8089	8647	11 : View List ['ossl_ffc_set_digest', 'BN_GENCB_new', 'ossl_ffc_params_set_seed', 'ossl_ffc_params_set_gindex', 'ossl_ffc_params_set_pcounter', 'DH_generate_parameters_ex', 'ossl_dh_generate_ffc_parameters', 'BN_GENCB_set', 'ossl_dh_new_ex', 'ossl_ffc_params_copy', 'ossl_ffc_params_set_h']	8091	9084	dh_gen	call site: 00000	/src/openssl/providers/implementations/keymgmt/dh_kmgmt.c:727
7574	10457	22 : View List ['ec_group_explicit_to_named', 'BN_CTX_end', 'BN_CTX_start', 'EC_POINT_free', 'EC_GROUP_set_seed', 'BN_CTX_new_ex', 'EC_POINT_new', 'EC_GROUP_set_point_conversion_form', 'ossl_ec_encoding_param2id', 'BN_CTX_get', 'BN_is_negative', 'BN_is_zero', 'EC_GROUP_set_generator', 'EC_GROUP_new_curve_GF2m', 'BN_num_bits', 'BN_CTX_free', 'EC_POINT_oct2point', 'OPENSSL_strcasecmp', 'EC_GROUP_get_degree', 'OSSL_PARAM_get_BN', 'EC_GROUP_set_asn1_flag', 'EC_GROUP_new_curve_GFp']	7574	15915	EC_GROUP_new_from_params	call site: 00000	/src/openssl/crypto/ec/ec_lib.c:1561
7362	20438	15 : View List ['OPENSSL_sk_pop', 'X509_add_cert', 'OPENSSL_sk_push', 'ossl_assert_int.17648', 'check_dane_issuer', 'find_issuer', 'get1_trusted_issuer', 'X509_cmp', 'ERR_set_debug', 'ERR_new', 'ossl_check_X509_type.17647', 'X509_free', 'ERR_set_error', 'OPENSSL_sk_delete_ptr', 'OPENSSL_sk_set']	11343	50143	build_chain	call site: 00000	/src/openssl/crypto/x509/x509_vfy.c:3441
7245	7245	1 : View List ['tls_post_process_server_rpk']	7245	7245	tls_post_process_server_certificate	call site: 00000	/src/openssl/ssl/statem/statem_clnt.c:2068
6805	6816	5 : View List ['BN_clear_bit', 'BN_priv_rand_ex', 'BN_is_bit_set', 'BN_is_word', 'ossl_ffc_params_simple_validate']	6805	10315	generate_key	call site: 00000	/src/openssl/crypto/dh/dh_key.c:313
5886	5886	2 : View List ['EVP_DigestVerifyInit', 'EVP_DigestSignInit']	5886	6147	evp_md_init_internal	call site: 02477	/src/openssl/crypto/evp/digest.c:166
5016	5016	1 : View List ['ssl_validate_ct']	5016	5016	tls_process_initial_server_flight	call site: 00000	/src/openssl/ssl/statem/statem_clnt.c:2948
4077	4083	4 : View List ['OPENSSL_sk_value', 'ossl_check_const_X509_sk_type.16655', 'OPENSSL_sk_num', 'X509_cmp']	4077	8950	X509_add_cert	call site: 00000	/src/openssl/crypto/x509/x509_cmp.c:199
3961	3961	1 : View List ['X509_verify']	3961	3961	X509_self_signed	call site: 00000	/src/openssl/crypto/x509/x509_vfy.c:108
3940	3940	4 : View List ['tls1_get_group_id', 'ssl_get_EC_curve_nid', 'tls1_check_pkey_comp', 'tls1_check_group_id']	3940	18692	tls12_check_peer_sigalg	call site: 00000	/src/openssl/ssl/t1_lib.c:1929
3546	3546	2 : View List ['ecx_key_pairwise_check', 'ecd_key_pairwise_check']	3546	3546	ecx_validate	call site: 00000	/src/openssl/providers/implementations/keymgmt/ecx_kmgmt.c:918

Runtime coverage analysis

Covered functions

4183

Functions that are reachable but not covered

610

Reachable functions

1935

Percentage of reachable functions covered

68.48%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/quic-client.c	2
ssl/quic/quic_method.c	1
ssl/ssl_lib.c	49
crypto/err/err_blocks.c	4
crypto/err/err_local.h	6
ssl/ssl_init.c	7
ssl/ssl_ciph.c	16
crypto/context.c	12
crypto/threads_pthread.c	8
providers/implementations/rands/crngt.c	1
crypto/evp/digest.c	19
crypto/evp/evp_fetch.c	10
crypto/core_namemap.c	19
crypto/objects/o_names.c	8
crypto/lhash/lhash.c	8
crypto/objects/obj_local.h	9
crypto/stack/stack.c	22
crypto/evp/evp_lib.c	22
crypto/objects/obj_dat.c	26
crypto/asn1/a_object.c	6
crypto/o_str.c	11
crypto/bsearch.c	1
crypto/bn/bn_word.c	4
crypto/bn/bn_lib.c	18
crypto/bn/bn_local.h	1
crypto/bn/bn_shift.c	2
crypto/bn/bn_conv.c	1
include/internal/constant_time.h	4
crypto/bn/asm/x86_64-gcc.c	2
crypto/bio/bio_print.c	11
include/internal/common.h	2
crypto/ctype.c	3
crypto/asn1/ameth_lib.c	9
include/crypto/asn1.h	3
crypto/property/property.c	23
crypto/sparse_array.c	1
crypto/core_fetch.c	3
crypto/core_algorithm.c	4
crypto/provider_core.c	28
include/internal/refcount.h	5
crypto/initthread.c	13
crypto/dso/dso_lib.c	9
include/openssl/crypto.h	2
crypto/provider_local.h	2
crypto/provider_child.c	2
crypto/dso/dso_dlfcn.c	1
crypto/getenv.c	1
crypto/defaults.c	4
include/openssl/core_dispatch.h	107
include/openssl/err.h	2
crypto/encode_decode/decoder_pkey.c	23
crypto/params.c	32
crypto/evp/evp_utils.c	5
ssl/s3_lib.c	2
ssl/ssl_cert.c	10
crypto/ex_data.c	9
include/internal/cryptlib.h	6
ssl/ssl_local.h	7
crypto/x509/x509_lu.c	7
include/openssl/x509_vfy.h	4
crypto/x509/x509_cmp.c	6
crypto/x509/x_name.c	3
crypto/asn1/tasn_enc.c	8
crypto/asn1/asn1_local.h	3
crypto/asn1/a_bitstr.c	2
crypto/asn1/a_int.c	10
crypto/asn1/asn1_lib.c	14
crypto/asn1/tasn_utl.c	13
crypto/x509/x509_vpm.c	3
include/openssl/asn1.h	3
include/openssl/safestack.h	1
crypto/ct/ct_log.c	3
include/openssl/ct.h	1
crypto/evp/p_lib.c	22
crypto/evp/keymgmt_lib.c	14
include/crypto/evp.h	7
crypto/evp/keymgmt_meth.c	23
crypto/engine/tb_asnmth.c	5
crypto/engine/eng_table.c	6
crypto/err/err_mark.c	4
crypto/engine/eng_local.h	5
crypto/engine/eng_init.c	4
crypto/engine/eng_lib.c	4
crypto/engine/tb_pkmeth.c	4
crypto/evp/pmeth_lib.c	28
crypto/engine/eng_list.c	1
include/openssl/x509.h	3
crypto/x509/x_attrib.c	2
crypto/asn1/tasn_fre.c	5
include/openssl/asn1t.h	2
ssl/tls_depr.c	3
crypto/engine/tb_cipher.c	3
crypto/evp/evp_enc.c	27
crypto/engine/tb_digest.c	3
crypto/evp/signature.c	9
crypto/evp/exchange.c	5
ssl/t1_lib.c	7
crypto/provider.c	3
crypto/objects/obj_lib.c	1
crypto/objects/obj_xref.c	9
crypto/objects/obj_xref.h	5
crypto/evp/kem.c	2
crypto/evp/asymcipher.c	2
crypto/bio/bio_lib.c	22
include/openssl/ssl.h	3
crypto/rand/rand_lib.c	12
providers/implementations/rands/seeding/rand_unix.c	1
crypto/engine/tb_rand.c	2
crypto/rand/rand_meth.c	1
crypto/property/property_parse.c	18
crypto/evp/evp_rand.c	20
ssl/tls_srp.c	2
ssl/ssl_mcnf.c	2
crypto/conf/conf_ssl.c	3
ssl/ssl_conf.c	13
ssl/ssl_rsa.c	5
crypto/bio/bss_file.c	2
crypto/pem/pem_pkey.c	4
crypto/bio/bf_readbuff.c	1
crypto/passphrase.c	9
crypto/encode_decode/decoder_meth.c	19
crypto/encode_decode/decoder_lib.c	28
crypto/encode_decode/encoder_local.h	6
crypto/bio/ossl_core_bio.c	3
crypto/ui/ui_util.c	8
crypto/ui/ui_lib.c	28
crypto/ui/ui_openssl.c	1
crypto/ui/ui_null.c	1
include/openssl/ui.h	2
crypto/err/err_prn.c	1
crypto/pem/pem_lib.c	15
crypto/evp/encode.c	7
crypto/evp/names.c	6
crypto/evp/evp_key.c	3
crypto/evp/legacy_md5.c	1
crypto/evp/m_sigver.c	6
crypto/evp/ctrl_params_translate.c	8
crypto/asn1/p8_pkey.c	4
crypto/asn1/tasn_dec.c	14
crypto/asn1/tasn_typ.c	9
crypto/asn1/tasn_new.c	9
crypto/asn1/a_type.c	1
crypto/evp/evp_pkey.c	1
crypto/asn1/x_sig.c	3
crypto/pkcs12/p12_p8d.c	2
crypto/pkcs12/p12_decr.c	2
crypto/evp/evp_pbe.c	4
crypto/evp/evp_local.h	3
crypto/asn1/d2i_pr.c	4
crypto/x509/x_pubkey.c	7
crypto/x509/x_all.c	1
crypto/asn1/a_d2i_fp.c	1
ssl/ssl_sess.c	9
include/internal/time.h	17
crypto/x509/x_x509.c	2
crypto/x509/t_x509.c	1
crypto/x509/x_crl.c	2
ssl/statem/extensions_cust.c	4
ssl/quic/quic_impl.c	62
ssl/quic/quic_channel.c	30
ssl/quic/quic_port.c	11
crypto/err/err_save.c	4
crypto/thread/arch/thread_posix.c	8
crypto/bio/bio_addr.c	5
ssl/statem/statem.c	6
ssl/statem/statem_lib.c	1
crypto/bio/bss_dgram_pair.c	1
ssl/quic/quic_reactor.c	12
ssl/quic/quic_record_tx.c	3
ssl/quic/quic_engine.c	4
ssl/quic/quic_demux.c	2
ssl/record/rec_layer_s3.c	10
ssl/s3_msg.c	1
ssl/tls13_enc.c	2
ssl/t1_enc.c	1
ssl/record/rec_layer_d1.c	2
ssl/pqueue.c	3
ssl/quic/quic_txp.c	3
ssl/quic/quic_record_util.c	11
crypto/evp/kdf_meth.c	7
crypto/evp/kdf_lib.c	3
ssl/quic/quic_record_rx.c	6
ssl/quic/quic_record_shared.c	7
ssl/quic/quic_wire_pkt.c	2
include/internal/quic_demux.h	3
ssl/quic/quic_wire.c	5
include/internal/quic_vlint.h	1
ssl/quic/quic_fc.c	18
ssl/quic/quic_tls.c	5
ssl/quic/qlog.c	34
ssl/quic/json_enc.c	42
crypto/o_fopen.c	1
crypto/cversion.c	1
crypto/info.c	3
ssl/quic/qlog_event_helpers.c	5
ssl/quic/quic_rstream.c	3
ssl/quic/quic_sstream.c	12
crypto/bio/bss_null.c	1
crypto/async/async.c	13
crypto/async/async_wait.c	2
crypto/async/async_local.h	4
crypto/async/arch/async_posix.c	3
crypto/async/arch/async_posix.h	1
crypto/time.c	1
ssl/quic/quic_ackm.c	1
ssl/quic/quic_statm.c	1
ssl/quic/quic_thread_assist.c	2
crypto/thread/arch.c	1
ssl/quic/quic_stream_map.c	23
include/internal/quic_stream_map.h	6
include/internal/ring_buf.h	7
ssl/quic/uint_set.c	8
include/internal/uint_set.h	12
ssl/quic/quic_sf_list.c	3

Fuzzer: provider

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	9	15.5%
gold	[1:9]	10	17.2%
yellow	[10:29]	15	25.8%
greenyellow	[30:49]	5	8.62%
lawngreen	50+	19	32.7%
All colors	58	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
5886	5886	2 : View List ['EVP_DigestVerifyInit', 'EVP_DigestSignInit']	5886	6147	evp_md_init_internal	call site: 00000	/src/openssl/crypto/evp/digest.c:166
5496	7484	7 : View List ['ENGINE_finish', 'CRYPTO_free', 'EVP_KEYMGMT_free', 'evp_pkey_ctx_free_all_cached_data', 'BN_free', 'evp_pkey_ctx_free_old_ops', 'EVP_PKEY_free']	5496	7484	EVP_PKEY_CTX_free	call site: 00000	/src/openssl/crypto/evp/pmeth_lib.c:389
3263	3281	2 : View List ['OSSL_LIB_CTX_get_conf_diagnostics', 'CONF_modules_load']	3263	3305	CONF_modules_load_file_ex	call site: 00000	/src/openssl/crypto/conf/conf_mod.c:217
3181	3181	2 : View List ['ossl_provider_up_ref_parent', 'ossl_provider_free']	3181	3181	ossl_provider_up_ref	call site: 00000	/src/openssl/crypto/provider_core.c:483
3115	3117	2 : View List ['ossl_prov_digest_md', 'SSKDF_hash_kdm']	3115	3378	x963kdf_derive	call site: 00000	/src/openssl/providers/implementations/kdfs/sskdf.c:504
3115	3115	1 : View List ['SSKDF_hash_kdm']	3115	3376	sskdf_derive	call site: 00000	/src/openssl/providers/implementations/kdfs/sskdf.c:412
2566	2954	5 : View List ['CRYPTO_zalloc', 'EVP_PKEY_CTX_ctrl', 'ENGINE_init', 'ENGINE_finish', 'ENGINE_get_digest']	2566	5336	evp_md_init_internal	call site: 00000	/src/openssl/crypto/evp/digest.c:226
2381	4657	5 : View List ['EVP_PKEY_CTX_dup', 'ERR_new', 'EVP_MD_CTX_reset', 'ERR_set_debug', 'ERR_set_error']	2381	4657	EVP_MD_CTX_copy_ex	call site: 00000	/src/openssl/crypto/evp/digest.c:654
2098	9008	7 : View List ['drbg_ctr_init', 'CRYPTO_free', 'CRYPTO_strndup', 'EVP_CIPHER_fetch', 'ossl_drbg_set_ctx_params', 'strcpy', 'EVP_CIPHER_free']	2098	9269	drbg_ctr_set_ctx_params_locked	call site: 00000	/src/openssl/providers/implementations/rands/drbg_ctr.c:739
2002	3617	14 : View List ['DSO_ctrl', 'CRYPTO_strdup', 'CRYPTO_free', 'DSO_free', 'DSO_new', 'ossl_safe_getenv', 'ossl_get_modulesdir', 'CRYPTO_THREAD_read_lock', 'DSO_bind_func', 'DSO_load', 'DSO_merge', 'DSO_convert_filename', 'get_provider_store', 'CRYPTO_THREAD_unlock']	2008	4416	provider_init	call site: 00000	/src/openssl/crypto/provider_core.c:890
1642	1642	1 : View List ['blake2b_mac']	1642	1642	blake2b	call site: 00000	/src/openssl/providers/implementations/kdfs/argon2.c:843
1595	1595	1 : View List ['EVP_CIPHER_is_a']	1595	3448	find_alg_id	call site: 00000	/src/openssl/providers/implementations/kdfs/x942kdf.c:86

Runtime coverage analysis

Covered functions

1980

Functions that are reachable but not covered

289

Reachable functions

772

Percentage of reachable functions covered

62.56%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/provider.c	12
crypto/stack/stack.c	1
crypto/evp/digest.c	1
crypto/evp/evp_lib.c	2
crypto/provider_core.c	1
crypto/params_dup.c	1
crypto/evp/evp_enc.c	1
crypto/evp/kdf_meth.c	1
crypto/evp/kdf_lib.c	1
crypto/evp/mac_meth.c	2
crypto/evp/kem.c	2
crypto/evp/evp_rand.c	2
crypto/evp/asymcipher.c	2
crypto/evp/signature.c	2
crypto/evp/exchange.c	2

Fuzzer: x509

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1248	41.7%
gold	[1:9]	158	5.28%
yellow	[10:29]	105	3.50%
greenyellow	[30:49]	47	1.57%
lawngreen	50+	1434	47.9%
All colors	2992	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
4078	4378	5 : View List ['verify_cb_cert', 'check_cert_key_level', 'OPENSSL_sk_value', 'ossl_check_const_X509_sk_type.17644', 'check_sig_level']	4078	4378	check_auth_level	call site: 00000	/src/openssl/crypto/x509/x509_vfy.c:195
3308	5963	7 : View List ['ERR_new', 'ossl_ecx_key_free', 'RAND_priv_bytes_ex', 'ossl_ecx_public_from_private', 'ERR_set_debug', 'ERR_set_error', 'ossl_ecx_key_allocate_privkey']	3308	5963	ossl_ecx_key_op	call site: 00000	/src/openssl/crypto/ec/ecx_backend.c:193
3263	3281	2 : View List ['OSSL_LIB_CTX_get_conf_diagnostics', 'CONF_modules_load']	3263	3305	CONF_modules_load_file_ex	call site: 00000	/src/openssl/crypto/conf/conf_mod.c:217
3239	4878	10 : View List ['ossl_assert_int.34170', 'evp_keymgmt_freedata', 'evp_keymgmt_util_export', 'CRYPTO_THREAD_read_lock', 'evp_keymgmt_util_cache_keydata', 'evp_keymgmt_util_clear_operation_cache', 'match_type', 'evp_keymgmt_util_find_operation_cache', 'CRYPTO_THREAD_write_lock', 'CRYPTO_THREAD_unlock']	3239	4878	evp_keymgmt_util_export_to_provider	call site: 02012	/src/openssl/crypto/evp/keymgmt_lib.c:117
2943	5886	2 : View List ['EVP_DigestVerifyInit', 'EVP_DigestSignInit']	2943	6147	evp_md_init_internal	call site: 01675	/src/openssl/crypto/evp/digest.c:166
2569	2569	1 : View List ['EVP_PKEY_copy_parameters']	2569	2569	X509_get_pubkey_parameters	call site: 00000	/src/openssl/crypto/x509/x509_vfy.c:2092
2423	2425	8 : View List ['RSA_get0_iqmp', 'sk_BIGNUM_const_push', 'RSA_get0_dmp1', 'RSA_get0_dmq1', 'RSA_get_multi_prime_extra_count', 'RSA_get0_q', 'sk_RSA_PRIME_INFO_value.14742', 'RSA_get0_p']	2423	2425	ossl_rsa_get0_all_params	call site: 00000	/src/openssl/crypto/rsa/rsa_lib.c:887
2225	4450	2 : View List ['EVP_PKEY_CTX_new', 'EVP_PKEY_CTX_new_from_pkey']	13107	52667	do_sigver_init	call site: 01677	/src/openssl/crypto/evp/m_sigver.c:57
2125	2125	1 : View List ['RAND_bytes_ex']	2125	2441	bnrand	call site: 00000	/src/openssl/crypto/bn/bn_rand.c:53
2031	2296	5 : View List ['EVP_PKEY_CTX_get_signature_md', 'EVP_MD_get_type', 'ERR_new', 'ERR_set_debug', 'ERR_set_error']	2031	8832	ossl_rsa_pss_to_ctx	call site: 02688	/src/openssl/crypto/rsa/rsa_ameth.c:563
1936	1936	1 : View List ['EVP_KEYMGMT_fetch']	1936	9614	int_ctx_new	call site: 01724	/src/openssl/crypto/evp/pmeth_lib.c:253
1729	3617	14 : View List ['DSO_ctrl', 'CRYPTO_strdup', 'CRYPTO_free', 'DSO_free', 'DSO_new', 'ossl_safe_getenv', 'ossl_get_modulesdir', 'CRYPTO_THREAD_read_lock', 'DSO_bind_func', 'DSO_load', 'DSO_merge', 'DSO_convert_filename', 'get_provider_store', 'CRYPTO_THREAD_unlock']	1735	4416	provider_init	call site: 00973	/src/openssl/crypto/provider_core.c:890

Runtime coverage analysis

Covered functions

3056

Functions that are reachable but not covered

369

Reachable functions

1397

Percentage of reachable functions covered

73.59%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/x509.c	2
crypto/x509/x_x509.c	6
crypto/asn1/tasn_dec.c	14
crypto/err/err_blocks.c	1
crypto/err/err_local.h	3
crypto/asn1/asn1_lib.c	16
crypto/stack/stack.c	21
include/openssl/asn1t.h	2
crypto/asn1/tasn_fre.c	5
crypto/asn1/a_object.c	6
crypto/asn1/tasn_utl.c	13
include/internal/refcount.h	4
crypto/threads_pthread.c	8
crypto/objects/obj_dat.c	19
crypto/bsearch.c	1
crypto/objects/obj_local.h	6
crypto/lhash/lhash.c	7
crypto/asn1/a_int.c	13
crypto/asn1/tasn_typ.c	16
crypto/asn1/tasn_new.c	9
crypto/asn1/a_type.c	3
crypto/asn1/a_bitstr.c	2
crypto/bio/bss_null.c	1
crypto/bio/bio_lib.c	12
crypto/ex_data.c	9
crypto/context.c	8
include/internal/cryptlib.h	6
include/openssl/crypto.h	2
crypto/x509/t_x509.c	6
crypto/x509/x509_set.c	10
crypto/bio/bio_print.c	11
include/internal/common.h	1
crypto/ctype.c	4
crypto/o_str.c	9
crypto/x509/x509_cmp.c	16
crypto/err/err_mark.c	3
crypto/bn/bn_word.c	3
crypto/bn/bn_lib.c	17
crypto/bn/bn_local.h	1
crypto/bn/bn_shift.c	2
crypto/bn/bn_conv.c	1
include/internal/constant_time.h	4
crypto/bn/asm/x86_64-gcc.c	1
crypto/bio/bio_dump.c	4
crypto/objects/obj_xref.c	7
crypto/objects/obj_xref.h	2
crypto/asn1/ameth_lib.c	8
include/crypto/asn1.h	3
crypto/engine/tb_asnmth.c	3
crypto/engine/eng_table.c	3
crypto/engine/eng_local.h	4
crypto/engine/eng_init.c	4
crypto/engine/eng_lib.c	3
crypto/engine/tb_pkmeth.c	4
crypto/evp/pmeth_lib.c	31
crypto/engine/eng_list.c	1
crypto/asn1/a_strex.c	8
crypto/x509/x_name.c	8
crypto/x509/x509_obj.c	1
include/openssl/x509.h	7
crypto/x509/x509name.c	6
crypto/asn1/asn1_parse.c	4
crypto/asn1/tasn_enc.c	8
crypto/asn1/asn1_local.h	3
crypto/asn1/a_utf8.c	2
include/internal/unicode.h	1
crypto/asn1/a_time.c	4
crypto/o_time.c	4
crypto/x509/x_pubkey.c	8
crypto/err/err_prn.c	2
crypto/evp/p_lib.c	20
crypto/bio/bf_prefix.c	1
crypto/encode_decode/encoder_pkey.c	7
crypto/encode_decode/encoder_meth.c	16
crypto/evp/keymgmt_meth.c	17
crypto/provider_core.c	28
crypto/encode_decode/encoder_lib.c	18
crypto/evp/evp_fetch.c	8
crypto/core_namemap.c	19
providers/implementations/rands/crngt.c	1
crypto/evp/digest.c	22
crypto/objects/o_names.c	8
crypto/evp/evp_lib.c	12
crypto/property/property.c	23
crypto/sparse_array.c	1
crypto/core_fetch.c	3
crypto/core_algorithm.c	4
crypto/initthread.c	9
crypto/dso/dso_lib.c	9
crypto/provider_local.h	2
crypto/provider_child.c	2
crypto/dso/dso_dlfcn.c	1
crypto/getenv.c	1
crypto/defaults.c	1
include/openssl/core_dispatch.h	63
include/openssl/err.h	1
crypto/encode_decode/decoder_pkey.c	3
crypto/params.c	9
crypto/evp/evp_utils.c	2
include/openssl/safestack.h	4
crypto/provider.c	1
crypto/encode_decode/encoder_local.h	5
crypto/passphrase.c	5
crypto/bio/ossl_core_bio.c	3
crypto/ui/ui_util.c	8
crypto/ui/ui_lib.c	28
crypto/ui/ui_openssl.c	1
crypto/ui/ui_null.c	1
include/openssl/ui.h	2
crypto/x509/v3_prn.c	4
crypto/x509/x509_v3.c	7
crypto/x509/v3_lib.c	6
include/openssl/x509v3.h	8
include/openssl/conf.h	2
crypto/x509/v3_utl.c	1
crypto/asn1/a_print.c	1
crypto/x509/x_x509a.c	5
include/openssl/asn1.h	2
crypto/evp/m_sigver.c	8
include/crypto/evp.h	7
crypto/evp/signature.c	11
crypto/evp/exchange.c	3
crypto/evp/kem.c	3
crypto/evp/asymcipher.c	3
crypto/evp/keymgmt_lib.c	9
crypto/x509/x_attrib.c	2
crypto/evp/names.c	3
crypto/evp/ctrl_params_translate.c	8
crypto/engine/tb_digest.c	3
crypto/x509/x_crl.c	3
crypto/ocsp/ocsp_asn.c	10
crypto/x509/x509_lu.c	16
include/openssl/x509_vfy.h	9
crypto/x509/x509_vpm.c	15
crypto/x509/x509cset.c	1
crypto/x509/v3_purp.c	14
crypto/evp/legacy_sha.c	1
crypto/x509/x_all.c	4
crypto/asn1/a_digest.c	2
crypto/x509/x509_ext.c	4
crypto/x509/v3_bcons.c	2
crypto/objects/obj_lib.c	2
crypto/x509/v3_pcia.c	2
crypto/asn1/a_octet.c	2
crypto/x509/v3_crld.c	1
crypto/asn1/a_dup.c	1
crypto/x509/x509_vfy.c	22
crypto/x509/pcy_tree.c	2
crypto/x509/pcy_node.c	1
crypto/x509/pcy_local.h	1
crypto/x509/pcy_data.c	1
crypto/x509/v3_cpols.c	2
include/internal/dane.h	2
crypto/ocsp/ocsp_cl.c	5
crypto/asn1/asn_pack.c	1
crypto/ocsp/ocsp_vfy.c	9
crypto/asn1/a_verify.c	2
crypto/rsa/rsa_ameth.c	3
crypto/rsa/rsa_backend.c	2
crypto/rsa/rsa_asn1.c	2
crypto/asn1/x_algor.c	4
crypto/rsa/rsa_pss.c	3
crypto/rsa/rsa_lib.c	4
crypto/x509/x509_trust.c	5
crypto/x509/x509_txt.c	1
include/openssl/ocsp.h	1
crypto/ocsp/ocsp_lib.c	4

Fuzzer: conf

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	22	34.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	41	65.0%
All colors	63	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1591	3190	5 : View List ['CRYPTO_free', 'CRYPTO_FREE_REF.9603', 'EVP_RAND_free', 'CRYPTO_DOWN_REF.9602', 'EVP_RAND_CTX_free']	1591	3190	EVP_RAND_CTX_free	call site: 00000	/src/openssl/crypto/evp/evp_rand.c:390
1587	1587	1 : View List ['ossl_rand_crng_ctx_free']	1587	1625	context_deinit_objs	call site: 00000	/src/openssl/crypto/context.c:331
43	48	6 : View List ['lh_OBJ_NAME_set_down_load', 'lh_OBJ_NAME_free', 'CRYPTO_THREAD_lock_free', 'sk_NAME_FUNCS_pop_free', 'lh_OBJ_NAME_doall', 'lh_OBJ_NAME_get_down_load']	43	48	OBJ_NAME_cleanup	call site: 00000	/src/openssl/crypto/objects/o_names.c:371
37	37	2 : View List ['ossl_strtouint64', 'ossl_strchr']	41	41	OPENSSL_cpuid_setup	call site: 00000	/src/openssl/crypto/cpuid.c:106
14	14	1 : View List ['async_deinit']	14	4964	OPENSSL_cleanup	call site: 00000	/src/openssl/crypto/init.c:407
14	14	2 : View List ['qsort', 'CRYPTO_get_ex_data']	14	19	CRYPTO_free_ex_data	call site: 00042	/src/openssl/crypto/ex_data.c:398
6	6	2 : View List ['sk_EX_CALLBACK_value', 'CRYPTO_malloc']	20	30	CRYPTO_free_ex_data	call site: 00040	/src/openssl/crypto/ex_data.c:385
6	6	2 : View List ['sk_EX_CALLBACK_value', 'CRYPTO_malloc']	18	23	ossl_crypto_new_ex_data_ex	call site: 00026	/src/openssl/crypto/ex_data.c:239
4	4	2 : View List ['__errno_location', 'free']	4	4	OPENSSL_DIR_read	call site: 00000	/src/openssl/crypto/LPdir_unix.c:113
2	2	1 : View List ['fclose']	2	2	BIO_new_file	call site: 00000	/src/openssl/crypto/bio/bss_file.c:80
0	1651	1 : View List ['ossl_provider_store_free']	0	1651	ossl_provider_store_new	call site: 00000	/src/openssl/crypto/provider_core.c:312
0	292	2 : View List ['sk_reserve', 'OPENSSL_sk_free']	0	292	OPENSSL_sk_new_reserve	call site: 00000	/src/openssl/crypto/stack/stack.c:235

Runtime coverage analysis

Covered functions

417

Functions that are reachable but not covered

16

Reachable functions

66

Percentage of reachable functions covered

75.76%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/conf.c	1
crypto/conf/conf_lib.c	4
crypto/conf/conf_def.c	1
crypto/err/err_blocks.c	1
crypto/err/err_local.h	3
crypto/bio/bio_lib.c	6
include/internal/refcount.h	3
crypto/ex_data.c	6
crypto/context.c	4
crypto/threads_pthread.c	4
include/internal/cryptlib.h	2
crypto/stack/stack.c	3
include/openssl/crypto.h	2

Fuzzer: ct

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	385	63.2%
gold	[1:9]	5	0.82%
yellow	[10:29]	3	0.49%
greenyellow	[30:49]	3	0.49%
lawngreen	50+	213	34.9%
All colors	609	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1591	3190	5 : View List ['CRYPTO_free', 'CRYPTO_FREE_REF.9603', 'EVP_RAND_free', 'CRYPTO_DOWN_REF.9602', 'EVP_RAND_CTX_free']	1591	3190	EVP_RAND_CTX_free	call site: 00000	/src/openssl/crypto/evp/evp_rand.c:390
1587	1587	1 : View List ['ossl_rand_crng_ctx_free']	1587	1625	context_deinit_objs	call site: 00000	/src/openssl/crypto/context.c:331
982	1243	5 : View List ['ERR_add_error_data', 'ERR_new', 'asn1_template_ex_d2i', 'ERR_set_debug', 'ERR_set_error']	982	1243	asn1_item_embed_d2i	call site: 00015	/src/openssl/crypto/asn1/tasn_dec.c:202
636	636	2 : View List ['ASN1_TYPE_new', 'ASN1_TYPE_set']	2088	4454	asn1_ex_c2i	call site: 00144	/src/openssl/crypto/asn1/tasn_dec.c:845
613	613	1 : View List ['asn1_template_ex_i2d']	613	613	ASN1_item_ex_i2d	call site: 00543	/src/openssl/crypto/asn1/tasn_enc.c:101
478	478	1 : View List ['ossl_asn1_template_free']	478	478	ossl_asn1_item_embed_free	call site: 00047	/src/openssl/crypto/asn1/tasn_fre.c:48
313	313	1 : View List ['asn1_find_end']	313	1311	asn1_d2i_ex_primitive	call site: 00124	/src/openssl/crypto/asn1/tasn_dec.c:758
43	48	6 : View List ['lh_OBJ_NAME_set_down_load', 'lh_OBJ_NAME_free', 'CRYPTO_THREAD_lock_free', 'sk_NAME_FUNCS_pop_free', 'lh_OBJ_NAME_doall', 'lh_OBJ_NAME_get_down_load']	43	48	OBJ_NAME_cleanup	call site: 00000	/src/openssl/crypto/objects/o_names.c:371
37	37	2 : View List ['ossl_strtouint64', 'ossl_strchr']	41	41	OPENSSL_cpuid_setup	call site: 00000	/src/openssl/crypto/cpuid.c:106
14	14	1 : View List ['CTLOG_STORE_get0_log_by_id']	16	2035	SCT_print	call site: 00371	/src/openssl/crypto/ct/ct_prn.c:75
14	14	1 : View List ['async_deinit']	14	4964	OPENSSL_cleanup	call site: 00000	/src/openssl/crypto/init.c:407
14	14	2 : View List ['qsort', 'CRYPTO_get_ex_data']	14	19	CRYPTO_free_ex_data	call site: 00359	/src/openssl/crypto/ex_data.c:398

Runtime coverage analysis

Covered functions

411

Functions that are reachable but not covered

107

Reachable functions

251

Percentage of reachable functions covered

57.37%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/ct.c	1
crypto/ct/ct_oct.c	8
crypto/asn1/tasn_typ.c	13
crypto/asn1/tasn_dec.c	14
crypto/err/err_blocks.c	1
crypto/err/err_local.h	3
crypto/asn1/asn1_lib.c	15
crypto/stack/stack.c	14
include/openssl/asn1t.h	2
crypto/asn1/tasn_fre.c	5
crypto/asn1/a_object.c	3
crypto/asn1/tasn_utl.c	13
include/internal/refcount.h	4
crypto/threads_pthread.c	6
crypto/objects/obj_dat.c	12
crypto/bsearch.c	1
crypto/objects/obj_local.h	1
crypto/lhash/lhash.c	2
crypto/asn1/a_int.c	10
crypto/asn1/tasn_new.c	9
crypto/asn1/a_type.c	1
crypto/asn1/a_bitstr.c	2
include/openssl/ct.h	3
crypto/ct/ct_sct.c	7
crypto/o_str.c	2
crypto/bio/bss_null.c	1
crypto/bio/bio_lib.c	6
crypto/ex_data.c	6
crypto/context.c	4
include/internal/cryptlib.h	2
include/openssl/crypto.h	2
crypto/ct/ct_prn.c	4
crypto/ct/ct_log.c	2
crypto/bio/bio_print.c	11
include/internal/common.h	1
crypto/ctype.c	2
crypto/bio/bio_dump.c	1
crypto/asn1/a_gentm.c	5
crypto/o_time.c	5
crypto/asn1/a_time.c	8
crypto/asn1/tasn_enc.c	8
crypto/asn1/asn1_local.h	3

Fuzzer: hashtable

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	19	13.8%
gold	[1:9]	51	37.2%
yellow	[10:29]	25	18.2%
greenyellow	[30:49]	20	14.5%
lawngreen	50+	22	16.0%
All colors	137	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1591	3190	5 : View List ['CRYPTO_free', 'CRYPTO_FREE_REF.9603', 'EVP_RAND_free', 'CRYPTO_DOWN_REF.9602', 'EVP_RAND_CTX_free']	1591	3190	EVP_RAND_CTX_free	call site: 00000	/src/openssl/crypto/evp/evp_rand.c:390
1587	1587	1 : View List ['ossl_rand_crng_ctx_free']	1587	1625	context_deinit_objs	call site: 00000	/src/openssl/crypto/context.c:331
261	261	3 : View List ['ERR_set_debug', 'ERR_new', 'ERR_set_error']	261	261	do_init_module_list_lock	call site: 00000	/src/openssl/crypto/conf/conf_mod.c:103
261	261	3 : View List ['ERR_set_debug', 'ERR_new', 'ERR_set_error']	261	261	OPENSSL_sk_insert	call site: 00000	/src/openssl/crypto/stack/stack.c:264
261	261	3 : View List ['ERR_set_debug', 'ERR_new', 'ERR_set_error']	261	261	sk_reserve	call site: 00084	/src/openssl/crypto/stack/stack.c:209
43	48	6 : View List ['lh_OBJ_NAME_set_down_load', 'lh_OBJ_NAME_free', 'CRYPTO_THREAD_lock_free', 'sk_NAME_FUNCS_pop_free', 'lh_OBJ_NAME_doall', 'lh_OBJ_NAME_get_down_load']	43	48	OBJ_NAME_cleanup	call site: 00000	/src/openssl/crypto/objects/o_names.c:371
37	37	2 : View List ['ossl_strtouint64', 'ossl_strchr']	41	41	OPENSSL_cpuid_setup	call site: 00000	/src/openssl/crypto/cpuid.c:106
14	14	1 : View List ['async_deinit']	14	4964	OPENSSL_cleanup	call site: 00000	/src/openssl/crypto/init.c:407
0	1651	1 : View List ['ossl_provider_store_free']	0	1651	ossl_provider_store_new	call site: 00000	/src/openssl/crypto/provider_core.c:312
0	292	2 : View List ['sk_reserve', 'OPENSSL_sk_free']	0	292	OPENSSL_sk_new_reserve	call site: 00078	/src/openssl/crypto/stack/stack.c:235
0	93	1 : View List ['ossl_method_store_free']	0	93	ossl_method_store_new	call site: 00000	/src/openssl/crypto/property/property.c:249
0	33	1 : View List ['ossl_namemap_free']	0	33	ossl_namemap_new	call site: 00000	/src/openssl/crypto/core_namemap.c:515

Runtime coverage analysis

Covered functions

331

Functions that are reachable but not covered

36

Reachable functions

112

Percentage of reachable functions covered

67.86%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/hashtable.c	8
crypto/hashtable/hashtable.c	21
crypto/threads_pthread.c	20
crypto/context.c	4
crypto/initthread.c	9
crypto/stack/stack.c	7
crypto/err/err_blocks.c	1
crypto/err/err_local.h	3

Fuzzer: smime

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	185	28.2%
gold	[1:9]	27	4.12%
yellow	[10:29]	19	2.90%
greenyellow	[30:49]	36	5.49%
lawngreen	50+	388	59.2%
All colors	655	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
5886	5886	2 : View List ['EVP_DigestVerifyInit', 'EVP_DigestSignInit']	5886	6147	evp_md_init_internal	call site: 00000	/src/openssl/crypto/evp/digest.c:166
3263	3281	2 : View List ['OSSL_LIB_CTX_get_conf_diagnostics', 'CONF_modules_load']	3263	3305	CONF_modules_load_file_ex	call site: 00000	/src/openssl/crypto/conf/conf_mod.c:217
3015	3979	7 : View List ['OPENSSL_sk_num', 'i2d_X509_NAME', 'OPENSSL_sk_value', 'X509_NAME_dup', 'ossl_check_const_X509_NAME_ENTRY_sk_type.37345', 'X509_NAME_add_entry', 'X509_NAME_free']	3015	3979	DIST_POINT_set_dpname	call site: 00000	/src/openssl/crypto/x509/v3_crld.c:490
2566	2954	5 : View List ['CRYPTO_zalloc', 'EVP_PKEY_CTX_ctrl', 'ENGINE_init', 'ENGINE_finish', 'ENGINE_get_digest']	2566	5336	evp_md_init_internal	call site: 00000	/src/openssl/crypto/evp/digest.c:226
2423	2425	8 : View List ['RSA_get0_iqmp', 'sk_BIGNUM_const_push', 'RSA_get0_dmp1', 'RSA_get0_dmq1', 'RSA_get_multi_prime_extra_count', 'RSA_get0_q', 'sk_RSA_PRIME_INFO_value.14742', 'RSA_get0_p']	2423	2425	ossl_rsa_get0_all_params	call site: 00000	/src/openssl/crypto/rsa/rsa_lib.c:887
2367	4717	4 : View List ['EVP_PKEY_get1_DH', 'DH_free', 'EVP_PKEY_get_id', 'EVP_PKEY_free']	2367	4717	ossl_d2i_DH_PUBKEY	call site: 00000	/src/openssl/crypto/x509/x_pubkey.c:654
1729	3617	14 : View List ['DSO_ctrl', 'CRYPTO_strdup', 'CRYPTO_free', 'DSO_free', 'DSO_new', 'ossl_safe_getenv', 'ossl_get_modulesdir', 'CRYPTO_THREAD_read_lock', 'DSO_bind_func', 'DSO_load', 'DSO_merge', 'DSO_convert_filename', 'get_provider_store', 'CRYPTO_THREAD_unlock']	1735	4416	provider_init	call site: 00000	/src/openssl/crypto/provider_core.c:890
1640	7484	7 : View List ['ENGINE_finish', 'CRYPTO_free', 'EVP_KEYMGMT_free', 'evp_pkey_ctx_free_all_cached_data', 'BN_free', 'evp_pkey_ctx_free_old_ops', 'EVP_PKEY_free']	1640	7484	EVP_PKEY_CTX_free	call site: 00000	/src/openssl/crypto/evp/pmeth_lib.c:389
1596	2506	6 : View List ['EVP_get_digestbyname', 'ERR_new', 'ERR_set_debug', 'ERR_set_error', 'OBJ_obj2nid', 'OBJ_nid2sn']	1596	2506	ossl_x509_algor_get_md	call site: 00000	/src/openssl/crypto/asn1/x_algor.c:161
1591	3190	5 : View List ['CRYPTO_free', 'CRYPTO_FREE_REF.9603', 'EVP_RAND_free', 'CRYPTO_DOWN_REF.9602', 'EVP_RAND_CTX_free']	1591	3190	EVP_RAND_CTX_free	call site: 00000	/src/openssl/crypto/evp/evp_rand.c:390
1589	3181	2 : View List ['ossl_provider_up_ref_parent', 'ossl_provider_free']	1589	3181	ossl_provider_up_ref	call site: 00000	/src/openssl/crypto/provider_core.c:483
1589	1589	1 : View List ['ossl_provider_free_parent']	1589	1589	provider_deactivate	call site: 00000	/src/openssl/crypto/provider_core.c:1152

Runtime coverage analysis

Covered functions

1650

Functions that are reachable but not covered

32

Reachable functions

285

Percentage of reachable functions covered

88.77%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/smime.c	1
crypto/pkcs7/pk7_mime.c	2
crypto/pkcs7/pk7_asn1.c	2
crypto/asn1/asn_mime.c	13
crypto/asn1/asn1_local.h	14
crypto/stack/stack.c	16
crypto/err/err_blocks.c	1
crypto/err/err_local.h	3
crypto/bio/bio_lib.c	14
crypto/ctype.c	1
include/openssl/bio.h	2
include/internal/refcount.h	4
crypto/ex_data.c	6
crypto/context.c	4
crypto/threads_pthread.c	6
include/internal/cryptlib.h	2
include/openssl/crypto.h	2
crypto/evp/bio_b64.c	1
crypto/asn1/a_d2i_fp.c	2
crypto/err/err_mark.c	3
crypto/asn1/asn1_lib.c	13
include/openssl/err.h	1
crypto/asn1/tasn_dec.c	14
include/openssl/asn1t.h	2
crypto/asn1/tasn_fre.c	5
crypto/asn1/a_object.c	3
crypto/asn1/tasn_utl.c	13
crypto/objects/obj_dat.c	11
crypto/bsearch.c	1
crypto/objects/obj_local.h	1
crypto/lhash/lhash.c	2
crypto/asn1/a_int.c	11
crypto/asn1/tasn_typ.c	7
crypto/asn1/tasn_new.c	9
crypto/asn1/a_type.c	1
crypto/asn1/a_bitstr.c	2
crypto/pkcs7/pk7_lib.c	8
include/openssl/x509.h	2
crypto/x509/x_x509.c	1
crypto/o_str.c	1
include/openssl/pkcs7.h	2
crypto/x509/x509_cmp.c	3
crypto/x509/x_name.c	2
crypto/asn1/tasn_enc.c	8
crypto/pkcs7/pk7_attr.c	1
crypto/pkcs7/pk7_doit.c	2
crypto/x509/x509_att.c	3
crypto/objects/obj_lib.c	1
crypto/asn1/x_algor.c	3
include/openssl/asn1.h	1

Fuzzer: punycode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	13	100.%
All colors	13	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
37	37	2 : View List ['ossl_strtouint64', 'ossl_strchr']	41	41	OPENSSL_cpuid_setup	call site: 00000	/src/openssl/crypto/cpuid.c:106
0	0	None	6	41	ossl_a2ulabel	call site: 00007	/src/openssl/crypto/punycode.c:263
0	0	None	6	41	ossl_a2ulabel	call site: 00007	/src/openssl/crypto/punycode.c:266
0	0	None	0	0	OPENSSL_cpuid_setup	call site: 00000	/src/openssl/crypto/cpuid.c:102
0	0	None	0	0	ossl_punycode_decode	call site: 00004	/src/openssl/crypto/punycode.c:173
0	0	None	0	0	ossl_assert_int	call site: 00007	/src/openssl/include/internal/common.h:46

Runtime coverage analysis

Covered functions

25

Functions that are reachable but not covered

3

Reachable functions

12

Percentage of reachable functions covered

75.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/punycode.c	1
crypto/punycode.c	6
include/internal/common.h	1

Fuzzer: quic-lcidm

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	8	9.52%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	76	90.4%
All colors	84	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
3263	3281	2 : View List ['OSSL_LIB_CTX_get_conf_diagnostics', 'CONF_modules_load']	3270	3305	CONF_modules_load_file_ex	call site: 00000	/src/openssl/crypto/conf/conf_mod.c:217
2002	3617	14 : View List ['DSO_ctrl', 'CRYPTO_strdup', 'CRYPTO_free', 'DSO_free', 'DSO_new', 'ossl_safe_getenv', 'ossl_get_modulesdir', 'CRYPTO_THREAD_read_lock', 'DSO_bind_func', 'DSO_load', 'DSO_merge', 'DSO_convert_filename', 'get_provider_store', 'CRYPTO_THREAD_unlock']	2014	4416	provider_init	call site: 00000	/src/openssl/crypto/provider_core.c:890
1591	3190	5 : View List ['CRYPTO_free', 'CRYPTO_FREE_REF.9603', 'EVP_RAND_free', 'CRYPTO_DOWN_REF.9602', 'EVP_RAND_CTX_free']	1591	3190	EVP_RAND_CTX_free	call site: 00000	/src/openssl/crypto/evp/evp_rand.c:390
1589	3181	2 : View List ['ossl_provider_up_ref_parent', 'ossl_provider_free']	1589	3181	ossl_provider_up_ref	call site: 00000	/src/openssl/crypto/provider_core.c:483
1589	1589	1 : View List ['ossl_provider_free_parent']	1589	1589	provider_deactivate	call site: 00000	/src/openssl/crypto/provider_core.c:1152
1587	1587	1 : View List ['ossl_rand_crng_ctx_free']	1587	1625	context_deinit_objs	call site: 00000	/src/openssl/crypto/context.c:331
1235	1235	2 : View List ['BIO_free', 'def_load_bio']	1235	1235	def_load	call site: 00000	/src/openssl/crypto/conf/conf_def.c:177
650	650	5 : View List ['fclose', 'BIO_clear_flags', 'BIO_ctrl', 'BIO_new', 'BIO_s_file']	650	650	BIO_new_file	call site: 00000	/src/openssl/crypto/bio/bss_file.c:66
639	664	8 : View List ['CRYPTO_free', 'DSO_free', 'sk_INFOPAIR_pop_free', 'ERR_unload_strings', 'ossl_init_thread_deregister', 'CRYPTO_THREAD_lock_free', 'ossl_provider_teardown', 'CRYPTO_FREE_REF.12511']	639	664	ossl_provider_free	call site: 00000	/src/openssl/crypto/provider_core.c:719
629	629	2 : View List ['ossl_provider_info_add_parameter', 'sk_INFOPAIR_new_null']	629	3847	ossl_provider_new	call site: 00000	/src/openssl/crypto/provider_core.c:557
37	37	2 : View List ['ossl_strtouint64', 'ossl_strchr']	41	41	OPENSSL_cpuid_setup	call site: 00000	/src/openssl/crypto/cpuid.c:106
20	39	6 : View List ['OPENSSL_LH_set_down_load', 'ossl_check_CONF_VALUE_lh_doallfunc_type', 'ossl_check_CONF_VALUE_lh_type', 'OPENSSL_LH_free', 'lh_CONF_VALUE_doall_LH_CONF_VALUE', 'OPENSSL_LH_doall']	20	39	_CONF_free_data	call site: 00000	/src/openssl/crypto/conf/conf_api.c:142

Runtime coverage analysis

Covered functions

673

Functions that are reachable but not covered

4

Reachable functions

78

Percentage of reachable functions covered

94.87%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/quic-lcidm.c	2
include/internal/packet.h	9
ssl/quic/quic_lcidm.c	35
crypto/lhash/lhash.c	1
include/internal/quic_types.h	1

Fuzzer: quic-rcidm

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5	4.67%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	102	95.3%
All colors	107	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
3263	3281	2 : View List ['OSSL_LIB_CTX_get_conf_diagnostics', 'CONF_modules_load']	3270	3305	CONF_modules_load_file_ex	call site: 00000	/src/openssl/crypto/conf/conf_mod.c:217
2002	3617	14 : View List ['DSO_ctrl', 'CRYPTO_strdup', 'CRYPTO_free', 'DSO_free', 'DSO_new', 'ossl_safe_getenv', 'ossl_get_modulesdir', 'CRYPTO_THREAD_read_lock', 'DSO_bind_func', 'DSO_load', 'DSO_merge', 'DSO_convert_filename', 'get_provider_store', 'CRYPTO_THREAD_unlock']	2014	4416	provider_init	call site: 00000	/src/openssl/crypto/provider_core.c:890
1591	3190	5 : View List ['CRYPTO_free', 'CRYPTO_FREE_REF.9603', 'EVP_RAND_free', 'CRYPTO_DOWN_REF.9602', 'EVP_RAND_CTX_free']	1591	3190	EVP_RAND_CTX_free	call site: 00000	/src/openssl/crypto/evp/evp_rand.c:390
1589	3181	2 : View List ['ossl_provider_up_ref_parent', 'ossl_provider_free']	1589	3181	ossl_provider_up_ref	call site: 00000	/src/openssl/crypto/provider_core.c:483
1589	1589	1 : View List ['ossl_provider_free_parent']	1589	1589	provider_deactivate	call site: 00000	/src/openssl/crypto/provider_core.c:1152
1587	1587	1 : View List ['ossl_rand_crng_ctx_free']	1587	1625	context_deinit_objs	call site: 00000	/src/openssl/crypto/context.c:331
1235	1235	2 : View List ['BIO_free', 'def_load_bio']	1235	1235	def_load	call site: 00000	/src/openssl/crypto/conf/conf_def.c:177
650	650	5 : View List ['fclose', 'BIO_clear_flags', 'BIO_ctrl', 'BIO_new', 'BIO_s_file']	650	650	BIO_new_file	call site: 00000	/src/openssl/crypto/bio/bss_file.c:66
639	664	8 : View List ['CRYPTO_free', 'DSO_free', 'sk_INFOPAIR_pop_free', 'ERR_unload_strings', 'ossl_init_thread_deregister', 'CRYPTO_THREAD_lock_free', 'ossl_provider_teardown', 'CRYPTO_FREE_REF.12511']	639	664	ossl_provider_free	call site: 00000	/src/openssl/crypto/provider_core.c:719
629	629	2 : View List ['ossl_provider_info_add_parameter', 'sk_INFOPAIR_new_null']	629	3847	ossl_provider_new	call site: 00000	/src/openssl/crypto/provider_core.c:557
37	37	2 : View List ['ossl_strtouint64', 'ossl_strchr']	41	41	OPENSSL_cpuid_setup	call site: 00000	/src/openssl/crypto/cpuid.c:106
20	39	6 : View List ['OPENSSL_LH_set_down_load', 'ossl_check_CONF_VALUE_lh_doallfunc_type', 'ossl_check_CONF_VALUE_lh_type', 'OPENSSL_LH_free', 'lh_CONF_VALUE_doall_LH_CONF_VALUE', 'OPENSSL_LH_doall']	20	39	_CONF_free_data	call site: 00000	/src/openssl/crypto/conf/conf_api.c:142

Runtime coverage analysis

Covered functions

677

Functions that are reachable but not covered

11

Reachable functions

93

Percentage of reachable functions covered

88.17%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/quic-rcidm.c	2
include/internal/packet.h	9
ssl/quic/quic_rcidm.c	34
ssl/priority_queue.c	3
include/internal/quic_types.h	1

Fuzzer: dtlsserver

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2859	57.5%
gold	[1:9]	323	6.50%
yellow	[10:29]	88	1.77%
greenyellow	[30:49]	20	0.40%
lawngreen	50+	1677	33.7%
All colors	4967	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
11643	20438	15 : View List ['OPENSSL_sk_pop', 'X509_add_cert', 'OPENSSL_sk_push', 'ossl_assert_int.17648', 'check_dane_issuer', 'find_issuer', 'get1_trusted_issuer', 'X509_cmp', 'ERR_set_debug', 'ERR_new', 'ossl_check_X509_type.17647', 'X509_free', 'ERR_set_error', 'OPENSSL_sk_delete_ptr', 'OPENSSL_sk_set']	15636	50143	build_chain	call site: 00000	/src/openssl/crypto/x509/x509_vfy.c:3441
9434	9445	6 : View List ['verify_cb_cert', 'X509_chain_check_suiteb', 'check_name_constraints', 'X509v3_asid_validate_path', 'internal_verify', 'X509v3_addr_validate_path']	9434	9445	verify_chain	call site: 00000	/src/openssl/crypto/x509/x509_vfy.c:240
8566	8828	6 : View List ['ssl_get_auto_dh', 'EVP_PKEY_get_security_bits', 'ssl_security', 'ssl_generate_pkey', 'ssl_dh_to_pkey', 'EVP_PKEY_get_bn_param']	8568	68572	tls_construct_server_key_exchange	call site: 00000	/src/openssl/ssl/statem/statem_srvr.c:2546
5886	5886	2 : View List ['EVP_DigestVerifyInit', 'EVP_DigestSignInit']	5886	6147	evp_md_init_internal	call site: 02477	/src/openssl/crypto/evp/digest.c:166
5688	6013	9 : View List ['EVP_DecryptFinal', 'CRYPTO_free', 'ssl_hmac_update', 'ssl_hmac_final', 'd2i_SSL_SESSION_ex', 'EVP_DecryptUpdate', 'ERR_clear_error', 'CRYPTO_malloc', 'memcmp']	5688	15581	tls_decrypt_ticket	call site: 00000	/src/openssl/ssl/t1_lib.c:2361
4980	4984	3 : View List ['find_sig_alg', 'tls1_lookup_sigalg', 'tls1_check_sig_alg']	6208	17105	tls1_check_chain	call site: 00000	/src/openssl/ssl/t1_lib.c:3204
4699	4699	1 : View List ['ossl_ecdsa_deterministic_sign']	4699	4699	ecdsa_sign	call site: 00000	/src/openssl/providers/implementations/signature/ecdsa_sig.c:209
4526	57333	26 : View List ['dtls1_read_failed', 'SSL_CTX_remove_session', 'ssl_release_record', 'ossl_tls_handle_rlayer_return', 'ossl_statem_set_in_init', 'dtls_unbuffer_record', 'ossl_statem_fatal', 'PACKET_get_1.4074', 'BIO_set_flags', 'PACKET_remaining.4070', 'dtls1_retransmit_buffered_messages', 'PACKET_buf_init.4075', 'SSL_get_rbio', 'dtls1_handle_timeout', 'ossl_statem_get_in_handshake', 'ERR_set_debug', 'dtls_buffer_record', 'SSL_is_init_finished', 'dtls1_check_timeout_num', 'BIO_clear_flags', 'ERR_new', 'ossl_statem_app_data_allowed', 'dtls1_get_message_header', 'ossl_assert_int.4073', 'ossl_statem_in_error', 'SSL_in_init']	4526	57333	dtls1_read_bytes	call site: 00000	/src/openssl/ssl/record/rec_layer_d1.c:264
4455	4455	1 : View List ['d2i_ECParameters']	4455	5256	ossl_ec_key_param_from_x509_algor	call site: 00000	/src/openssl/crypto/ec/ec_backend.c:780
4385	4461	3 : View List ['EC_GROUP_free', 'EC_GROUP_get_curve_name', 'd2i_ECPKParameters']	4385	4461	ossl_x509_algor_is_sm2	call site: 00000	/src/openssl/crypto/ec/ec_backend.c:744
4335	8465	4 : View List ['ERR_set_debug', 'ERR_new', 'ossl_statem_fatal', 'ssl_srp_server_param_with_username_intern']	4335	8465	ssl_check_srp_ext_ClientHello	call site: 00000	/src/openssl/ssl/statem/statem_srvr.c:1339
4077	4083	4 : View List ['OPENSSL_sk_value', 'ossl_check_const_X509_sk_type.16655', 'OPENSSL_sk_num', 'X509_cmp']	4077	8950	X509_add_cert	call site: 00000	/src/openssl/crypto/x509/x509_cmp.c:199

Runtime coverage analysis

Covered functions

3763

Functions that are reachable but not covered

736

Reachable functions

1940

Percentage of reachable functions covered

62.06%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/dtlsserver.c	1
ssl/methods.c	1
ssl/ssl_lib.c	40
crypto/err/err_blocks.c	4
crypto/err/err_local.h	6
ssl/ssl_init.c	7
ssl/ssl_ciph.c	16
crypto/context.c	12
crypto/threads_pthread.c	8
providers/implementations/rands/crngt.c	1
crypto/evp/digest.c	20
crypto/evp/evp_fetch.c	10
crypto/core_namemap.c	19
crypto/objects/o_names.c	8
crypto/lhash/lhash.c	8
crypto/objects/obj_local.h	9
crypto/stack/stack.c	22
crypto/evp/evp_lib.c	22
crypto/objects/obj_dat.c	26
crypto/asn1/a_object.c	6
crypto/o_str.c	11
crypto/bsearch.c	1
crypto/bn/bn_word.c	4
crypto/bn/bn_lib.c	19
crypto/bn/bn_local.h	1
crypto/bn/bn_shift.c	2
crypto/bn/bn_conv.c	1
include/internal/constant_time.h	4
crypto/bn/asm/x86_64-gcc.c	2
crypto/bio/bio_print.c	11
include/internal/common.h	2
crypto/ctype.c	3
crypto/asn1/ameth_lib.c	9
include/crypto/asn1.h	3
crypto/property/property.c	23
crypto/sparse_array.c	1
crypto/core_fetch.c	3
crypto/core_algorithm.c	4
crypto/provider_core.c	28
include/internal/refcount.h	5
crypto/initthread.c	13
crypto/dso/dso_lib.c	9
include/openssl/crypto.h	2
crypto/provider_local.h	2
crypto/provider_child.c	2
crypto/dso/dso_dlfcn.c	1
crypto/getenv.c	1
crypto/defaults.c	4
include/openssl/core_dispatch.h	107
include/openssl/err.h	2
crypto/encode_decode/decoder_pkey.c	23
crypto/params.c	32
crypto/evp/evp_utils.c	5
ssl/s3_lib.c	2
ssl/ssl_cert.c	12
crypto/ex_data.c	9
include/internal/cryptlib.h	6
ssl/ssl_local.h	10
crypto/x509/x509_lu.c	7
include/openssl/x509_vfy.h	4
crypto/x509/x509_cmp.c	9
crypto/x509/x_name.c	7
crypto/asn1/tasn_enc.c	8
crypto/asn1/asn1_local.h	3
crypto/asn1/a_bitstr.c	2
crypto/asn1/a_int.c	11
crypto/asn1/asn1_lib.c	15
crypto/asn1/tasn_utl.c	13
crypto/x509/x509_vpm.c	3
include/openssl/asn1.h	4
include/openssl/safestack.h	1
crypto/ct/ct_log.c	3
include/openssl/ct.h	1
crypto/evp/p_lib.c	32
crypto/evp/keymgmt_lib.c	16
include/crypto/evp.h	7
crypto/evp/keymgmt_meth.c	25
crypto/engine/tb_asnmth.c	5
crypto/engine/eng_table.c	6
crypto/err/err_mark.c	4
crypto/engine/eng_local.h	5
crypto/engine/eng_init.c	4
crypto/engine/eng_lib.c	4
crypto/engine/tb_pkmeth.c	4
crypto/evp/pmeth_lib.c	28
crypto/engine/eng_list.c	1
include/openssl/x509.h	6
crypto/x509/x_attrib.c	2
crypto/asn1/tasn_fre.c	5
include/openssl/asn1t.h	2
ssl/tls_depr.c	3
crypto/engine/tb_cipher.c	3
crypto/evp/evp_enc.c	27
crypto/engine/tb_digest.c	3
crypto/evp/signature.c	9
crypto/evp/exchange.c	5
ssl/t1_lib.c	17
crypto/provider.c	3
crypto/objects/obj_lib.c	2
crypto/objects/obj_xref.c	10
crypto/objects/obj_xref.h	5
crypto/evp/kem.c	2
crypto/evp/asymcipher.c	2
crypto/bio/bio_lib.c	23
include/openssl/ssl.h	3
crypto/rand/rand_lib.c	12
providers/implementations/rands/seeding/rand_unix.c	1
crypto/engine/tb_rand.c	2
crypto/rand/rand_meth.c	1
crypto/property/property_parse.c	18
crypto/evp/evp_rand.c	20
ssl/tls_srp.c	2
ssl/ssl_mcnf.c	2
crypto/conf/conf_ssl.c	3
ssl/ssl_conf.c	13
ssl/ssl_rsa.c	7
crypto/bio/bss_file.c	3
crypto/pem/pem_pkey.c	5
crypto/bio/bf_readbuff.c	1
crypto/passphrase.c	9
crypto/encode_decode/decoder_meth.c	19
crypto/encode_decode/decoder_lib.c	28
crypto/encode_decode/encoder_local.h	6
crypto/bio/ossl_core_bio.c	3
crypto/ui/ui_util.c	8
crypto/ui/ui_lib.c	28
crypto/ui/ui_openssl.c	1
crypto/ui/ui_null.c	1
include/openssl/ui.h	2
crypto/err/err_prn.c	2
crypto/pem/pem_lib.c	15
crypto/evp/encode.c	7
crypto/evp/names.c	6
crypto/evp/evp_key.c	3
crypto/evp/legacy_md5.c	1
crypto/evp/m_sigver.c	6
crypto/evp/ctrl_params_translate.c	8
crypto/asn1/p8_pkey.c	4
crypto/asn1/tasn_dec.c	14
crypto/asn1/tasn_typ.c	9
crypto/asn1/tasn_new.c	9
crypto/asn1/a_type.c	1
crypto/evp/evp_pkey.c	1
crypto/asn1/x_sig.c	3
crypto/pkcs12/p12_p8d.c	2
crypto/pkcs12/p12_decr.c	2
crypto/evp/evp_pbe.c	4
crypto/evp/evp_local.h	3
crypto/asn1/d2i_pr.c	4
crypto/x509/x_pubkey.c	7
crypto/x509/x_all.c	2
crypto/asn1/a_d2i_fp.c	1
ssl/ssl_sess.c	9
include/internal/time.h	14
crypto/x509/x_x509.c	3
crypto/x509/t_x509.c	1
crypto/x509/x_crl.c	2
ssl/statem/extensions_cust.c	4
crypto/conf/conf_mod.c	1
ssl/statem/statem_lib.c	1
crypto/pem/pem_all.c	6
crypto/evp/p_legacy.c	4
crypto/rsa/rsa_lib.c	3
crypto/rsa/rsa_asn1.c	2
crypto/rsa/rsa_local.h	1
crypto/rsa/rsa_mp.c	2
crypto/bn/bn_blind.c	1
crypto/ec/ec_key.c	4
crypto/ec/ec_lib.c	4
crypto/rsa/rsa_backend.c	1
crypto/rsa/rsa_ossl.c	1
crypto/ec/ec_backend.c	1
crypto/ec/ec_kmeth.c	1
crypto/dsa/dsa_backend.c	1
crypto/dsa/dsa_lib.c	2
crypto/dsa/dsa_ossl.c	1
crypto/dh/dh_backend.c	1
crypto/dh/dh_lib.c	1
crypto/dh/dh_key.c	1
crypto/pem/pem_x509.c	1
crypto/pem/pem_oth.c	1
crypto/x509/v3_purp.c	12
crypto/evp/legacy_sha.c	1
crypto/asn1/a_digest.c	1
crypto/x509/x509_set.c	6
crypto/x509/x509_ext.c	4
crypto/x509/v3_lib.c	6
crypto/x509/x509_v3.c	7
include/openssl/x509v3.h	6
crypto/x509/v3_bcons.c	2
crypto/x509/v3_pcia.c	2
crypto/asn1/a_octet.c	1
crypto/x509/v3_crld.c	1
crypto/asn1/a_dup.c	1
crypto/x509/x509name.c	1
crypto/ec/ecp_nistz256.c	1
crypto/ec/ecp_nistp224.c	1
crypto/ec/ecp_nistp256.c	1
crypto/ec/ecp_nistp384.c	1
crypto/ec/ecp_nistp521.c	1
crypto/ec/ec_mult.c	1
crypto/bn/bn_mont.c	1
crypto/ffc/ffc_params.c	2
ssl/quic/quic_impl.c	34
ssl/quic/quic_channel.c	23
ssl/quic/quic_port.c	11
crypto/err/err_save.c	4
ssl/quic/quic_reactor.c	12
ssl/quic/quic_record_tx.c	3
ssl/quic/quic_engine.c	4
ssl/quic/quic_demux.c	2
ssl/statem/statem.c	6
ssl/record/rec_layer_s3.c	10
ssl/s3_msg.c	1
ssl/tls13_enc.c	2
ssl/t1_enc.c	1
ssl/record/rec_layer_d1.c	2
ssl/pqueue.c	3
crypto/bio/bss_dgram_pair.c	1
crypto/thread/arch/thread_posix.c	8
crypto/bio/bio_addr.c	2
ssl/quic/quic_txp.c	3
ssl/quic/quic_record_util.c	11
crypto/evp/kdf_meth.c	7
crypto/evp/kdf_lib.c	3
ssl/quic/quic_record_rx.c	2
ssl/quic/quic_record_shared.c	7
ssl/quic/quic_wire_pkt.c	2
include/internal/quic_demux.h	3
ssl/quic/quic_wire.c	5
include/internal/quic_vlint.h	1
ssl/quic/quic_fc.c	1
ssl/quic/quic_tls.c	5
ssl/quic/qlog.c	34
ssl/quic/json_enc.c	42
crypto/o_fopen.c	1
crypto/cversion.c	1
crypto/info.c	3
ssl/quic/qlog_event_helpers.c	5
ssl/quic/quic_rstream.c	1
ssl/quic/quic_sstream.c	1
crypto/bio/bss_null.c	1
crypto/async/async.c	13
crypto/async/async_wait.c	2
crypto/async/async_local.h	4
crypto/async/arch/async_posix.c	3
crypto/async/arch/async_posix.h	1
crypto/time.c	1
ssl/quic/quic_ackm.c	1
ssl/quic/quic_statm.c	1
ssl/quic/quic_thread_assist.c	2
crypto/thread/arch.c	1

Fuzzer: acert

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	280	29.0%
gold	[1:9]	30	3.11%
yellow	[10:29]	26	2.69%
greenyellow	[30:49]	13	1.34%
lawngreen	50+	615	63.7%
All colors	964	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
3263	3281	2 : View List ['OSSL_LIB_CTX_get_conf_diagnostics', 'CONF_modules_load']	3270	3305	CONF_modules_load_file_ex	call site: 00000	/src/openssl/crypto/conf/conf_mod.c:217
1591	3190	5 : View List ['CRYPTO_free', 'CRYPTO_FREE_REF.9603', 'EVP_RAND_free', 'CRYPTO_DOWN_REF.9602', 'EVP_RAND_CTX_free']	1591	3190	EVP_RAND_CTX_free	call site: 00000	/src/openssl/crypto/evp/evp_rand.c:390
1587	1587	1 : View List ['ossl_rand_crng_ctx_free']	1587	1625	context_deinit_objs	call site: 00000	/src/openssl/crypto/context.c:331
995	2205	2 : View List ['i2a_ASN1_OBJECT', 'ossl_x509_algor_mgf1_decode']	995	6112	rsa_pss_param_print	call site: 00000	/src/openssl/crypto/rsa/rsa_ameth.c:251
995	1474	2 : View List ['ossl_x509_algor_mgf1_decode', 'RSA_PSS_PARAMS_free']	995	1474	ossl_rsa_pss_decode	call site: 00000	/src/openssl/crypto/rsa/rsa_backend.c:571
871	1235	2 : View List ['BIO_free', 'def_load_bio']	871	1235	def_load	call site: 00000	/src/openssl/crypto/conf/conf_def.c:177
726	726	2 : View List ['ENGINE_get_pkey_asn1_meth', 'ENGINE_get_pkey_asn1_meth_engine']	726	726	EVP_PKEY_asn1_find	call site: 00915	/src/openssl/crypto/asn1/ameth_lib.c:91
663	1695	2 : View List ['x509_name_canon', 'x509_name_encode']	663	1695	x509_name_ex_i2d	call site: 00000	/src/openssl/crypto/x509/x_name.c:220
261	265	2 : View List ['sk_const_ASN1_VALUE_set', 'sk_const_ASN1_VALUE_num']	261	265	asn1_set_seq_out	call site: 00612	/src/openssl/crypto/asn1/tasn_enc.c:451
43	48	6 : View List ['lh_OBJ_NAME_set_down_load', 'lh_OBJ_NAME_free', 'CRYPTO_THREAD_lock_free', 'sk_NAME_FUNCS_pop_free', 'lh_OBJ_NAME_doall', 'lh_OBJ_NAME_get_down_load']	43	48	OBJ_NAME_cleanup	call site: 00000	/src/openssl/crypto/objects/o_names.c:371
43	43	2 : View List ['sk_EVP_PKEY_ASN1_METHOD_value', 'sk_EVP_PKEY_ASN1_METHOD_find']	43	65	pkey_asn1_find	call site: 00915	/src/openssl/crypto/asn1/ameth_lib.c:63
43	43	2 : View List ['sk_nid_triple_find', 'sk_nid_triple_value']	43	48	ossl_obj_find_sigid_algs	call site: 00909	/src/openssl/crypto/objects/obj_xref.c:85

Runtime coverage analysis

Covered functions

827

Functions that are reachable but not covered

66

Reachable functions

393

Percentage of reachable functions covered

83.21%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/acert.c	1
crypto/x509/x509_acert.c	19
crypto/asn1/tasn_dec.c	14
crypto/err/err_blocks.c	1
crypto/err/err_local.h	3
crypto/asn1/asn1_lib.c	14
crypto/stack/stack.c	17
include/openssl/asn1t.h	2
crypto/asn1/tasn_fre.c	5
crypto/asn1/a_object.c	6
crypto/asn1/tasn_utl.c	13
include/internal/refcount.h	4
crypto/threads_pthread.c	6
crypto/objects/obj_dat.c	14
crypto/bsearch.c	1
crypto/objects/obj_local.h	1
crypto/lhash/lhash.c	3
crypto/asn1/a_int.c	10
crypto/asn1/tasn_typ.c	16
crypto/asn1/tasn_new.c	9
crypto/asn1/a_type.c	1
crypto/asn1/a_bitstr.c	2
crypto/bio/bss_null.c	1
crypto/bio/bio_lib.c	11
crypto/ex_data.c	6
crypto/context.c	4
include/internal/cryptlib.h	2
include/openssl/crypto.h	2
crypto/x509/t_acert.c	3
crypto/bio/bio_print.c	11
include/internal/common.h	1
crypto/ctype.c	3
crypto/o_str.c	3
crypto/asn1/f_int.c	1
include/openssl/x509v3.h	3
crypto/x509/v3_san.c	1
crypto/asn1/a_print.c	1
crypto/asn1/a_strex.c	8
crypto/x509/x_name.c	1
crypto/x509/x509_obj.c	1
include/openssl/x509.h	3
crypto/bn/bn_word.c	3
crypto/bn/bn_lib.c	17
crypto/bn/bn_local.h	1
crypto/bn/bn_shift.c	2
crypto/bn/bn_conv.c	1
include/internal/constant_time.h	4
crypto/bn/asm/x86_64-gcc.c	1
crypto/x509/x509name.c	5
crypto/asn1/asn1_parse.c	4
crypto/asn1/tasn_enc.c	8
crypto/asn1/asn1_local.h	3
crypto/asn1/a_utf8.c	2
include/internal/unicode.h	1
crypto/x509/v3_utl.c	2
crypto/bio/bio_dump.c	4
crypto/x509/t_x509.c	2
crypto/asn1/a_gentm.c	1
crypto/asn1/a_time.c	6
crypto/o_time.c	4
crypto/x509/x509_att.c	5
include/openssl/asn1.h	1
crypto/bio/bf_prefix.c	1
crypto/x509/x509_v3.c	3
crypto/x509/v3_prn.c	3
crypto/x509/v3_lib.c	4
include/openssl/conf.h	2
crypto/objects/obj_xref.c	7
crypto/objects/obj_xref.h	2
crypto/asn1/ameth_lib.c	5
include/crypto/asn1.h	2
crypto/engine/tb_asnmth.c	3
crypto/engine/eng_table.c	3
crypto/err/err_mark.c	2
crypto/engine/eng_local.h	4
crypto/engine/eng_init.c	2
crypto/engine/eng_lib.c	1
crypto/engine/tb_pkmeth.c	1
crypto/evp/pmeth_lib.c	1
crypto/engine/eng_list.c	1

Fuzzer: bignum

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	356	44.4%
gold	[1:9]	11	1.37%
yellow	[10:29]	2	0.24%
greenyellow	[30:49]	1	0.12%
lawngreen	50+	431	53.8%
All colors	801	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1591	3190	5 : View List ['CRYPTO_free', 'CRYPTO_FREE_REF.9603', 'EVP_RAND_free', 'CRYPTO_DOWN_REF.9602', 'EVP_RAND_CTX_free']	1591	3190	EVP_RAND_CTX_free	call site: 00000	/src/openssl/crypto/evp/evp_rand.c:390
1587	1587	1 : View List ['ossl_rand_crng_ctx_free']	1587	1625	context_deinit_objs	call site: 00000	/src/openssl/crypto/context.c:331
612	612	1 : View List ['bn_mod_inverse_no_branch']	612	612	int_bn_mod_inverse	call site: 00102	/src/openssl/crypto/bn/bn_gcd.c:214
582	4188	9 : View List ['BN_div', 'BN_set_word', 'BN_num_bits', 'BN_add', 'BN_lshift', 'BN_lshift1', 'BN_is_word', 'BN_mul_word', 'BN_mul']	582	6849	int_bn_mod_inverse	call site: 00272	/src/openssl/crypto/bn/bn_gcd.c:261
261	261	3 : View List ['ERR_set_debug', 'ERR_new', 'ERR_set_error']	261	261	BN_usub	call site: 00244	/src/openssl/crypto/bn/bn_add.c:138
261	261	3 : View List ['ERR_set_debug', 'ERR_new', 'ERR_set_error']	261	261	BN_CTX_get	call site: 00070	/src/openssl/crypto/bn/bn_ctx.c:219
261	261	3 : View List ['ERR_set_debug', 'ERR_new', 'ERR_set_error']	261	261	BN_div	call site: 00125	/src/openssl/crypto/bn/bn_div.c:224
261	261	3 : View List ['ERR_set_debug', 'ERR_new', 'ERR_set_error']	261	261	BN_mod_exp_recp	call site: 00635	/src/openssl/crypto/bn/bn_exp.c:179
261	261	3 : View List ['ERR_set_debug', 'ERR_new', 'ERR_set_error']	261	261	BN_mod_exp_simple	call site: 00701	/src/openssl/crypto/bn/bn_exp.c:1328
261	261	3 : View List ['ERR_set_debug', 'ERR_new', 'ERR_set_error']	261	261	bn_expand_internal	call site: 00023	/src/openssl/crypto/bn/bn_lib.c:273
261	261	3 : View List ['ERR_set_debug', 'ERR_new', 'ERR_set_error']	261	261	BN_nnmod	call site: 00122	/src/openssl/crypto/bn/bn_mod.c:21
261	261	3 : View List ['ERR_set_debug', 'ERR_new', 'ERR_set_error']	261	261	BN_lshift	call site: 00313	/src/openssl/crypto/bn/bn_shift.c:85

Runtime coverage analysis

Covered functions

397

Functions that are reachable but not covered

98

Reachable functions

219

Percentage of reachable functions covered

55.25%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/bignum.c	1
crypto/bn/bn_lib.c	34
crypto/bn/bn_ctx.c	14
crypto/err/err_blocks.c	1
crypto/err/err_local.h	3
crypto/bn/bn_exp.c	9
include/internal/constant_time.h	7
crypto/bn/bn_local.h	1
crypto/bn/bn_mont.c	10
crypto/bn/bn_gcd.c	3
crypto/bn/bn_mod.c	2
crypto/bn/bn_div.c	3
crypto/bn/bn_shift.c	6
crypto/bn/asm/x86_64-gcc.c	10
crypto/bn/bn_mul.c	6
crypto/bn/bn_add.c	4
crypto/bn/bn_word.c	3
crypto/bn/bn_sqr.c	4
crypto/bn/rsaz_exp.c	2
crypto/bn/rsaz_exp.h	2
crypto/bn/bn_recp.c	6
crypto/bn/bn_print.c	2
crypto/bio/bss_file.c	1
crypto/bio/bio_lib.c	7
include/internal/refcount.h	3
crypto/ex_data.c	6
crypto/context.c	4
crypto/threads_pthread.c	4
include/internal/cryptlib.h	2
crypto/stack/stack.c	3
include/openssl/crypto.h	2

Fuzzer: quic-srtm

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	616	53.7%
gold	[1:9]	245	21.3%
yellow	[10:29]	18	1.56%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	268	23.3%
All colors	1147	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
3263	3281	2 : View List ['OSSL_LIB_CTX_get_conf_diagnostics', 'CONF_modules_load']	3270	3305	CONF_modules_load_file_ex	call site: 00000	/src/openssl/crypto/conf/conf_mod.c:217
2186	2186	2 : View List ['CRYPTO_free', 'ossl_cipher_tlsunpadblock']	2186	3752	ossl_cipher_generic_block_update	call site: 00000	/src/openssl/providers/implementations/ciphers/ciphercommon.c:261
1729	3617	14 : View List ['DSO_ctrl', 'CRYPTO_strdup', 'CRYPTO_free', 'DSO_free', 'DSO_new', 'ossl_safe_getenv', 'ossl_get_modulesdir', 'CRYPTO_THREAD_read_lock', 'DSO_bind_func', 'DSO_load', 'DSO_merge', 'DSO_convert_filename', 'get_provider_store', 'CRYPTO_THREAD_unlock']	1735	4416	provider_init	call site: 00413	/src/openssl/crypto/provider_core.c:890
1589	3181	2 : View List ['ossl_provider_up_ref_parent', 'ossl_provider_free']	1589	3181	ossl_provider_up_ref	call site: 00632	/src/openssl/crypto/provider_core.c:483
1589	1589	1 : View List ['ossl_provider_free_parent']	1589	1589	provider_deactivate	call site: 00534	/src/openssl/crypto/provider_core.c:1152
1587	1587	1 : View List ['ossl_rand_crng_ctx_free']	1587	1625	context_deinit_objs	call site: 00000	/src/openssl/crypto/context.c:331
1447	2802	6 : View List ['ERR_new', 'ERR_set_debug', 'ERR_set_error', 'OSSL_PARAM_get_size_t', 'OSSL_PARAM_locate_const', 'OSSL_PARAM_get_uint']	1447	2802	ossl_cipher_generic_set_ctx_params	call site: 00000	/src/openssl/providers/implementations/ciphers/ciphercommon.c:627
1235	1235	2 : View List ['BIO_free', 'def_load_bio']	1235	1235	def_load	call site: 00000	/src/openssl/crypto/conf/conf_def.c:177
870	870	8 : View List ['CRYPTO_zalloc', 'EVP_CIPHER_get_mode', 'EVP_CIPHER_CTX_ctrl', 'EVP_CIPHER_CTX_get0_cipher', 'ENGINE_get_cipher', 'OPENSSL_die', 'ENGINE_init', 'EVP_CIPHER_get_flags']	1582	6436	evp_cipher_init_internal	call site: 00923	/src/openssl/crypto/evp/evp_enc.c:143
650	650	5 : View List ['fclose', 'BIO_clear_flags', 'BIO_ctrl', 'BIO_new', 'BIO_s_file']	650	650	BIO_new_file	call site: 00000	/src/openssl/crypto/bio/bss_file.c:66
629	629	2 : View List ['ossl_provider_info_add_parameter', 'sk_INFOPAIR_new_null']	629	3847	ossl_provider_new	call site: 00000	/src/openssl/crypto/provider_core.c:557
383	654	6 : View List ['ERR_new', 'CRYPTO_THREAD_write_lock', 'ERR_set_debug', 'ERR_set_error', 'CRYPTO_THREAD_unlock', 'engine_unlocked_finish']	383	654	ENGINE_finish	call site: 00081	/src/openssl/crypto/engine/eng_init.c:110

Runtime coverage analysis

Covered functions

1139

Functions that are reachable but not covered

201

Reachable functions

578

Percentage of reachable functions covered

65.22%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/quic-srtm.c	1
ssl/quic/quic_srtm.c	22
crypto/rand/rand_lib.c	10
crypto/threads_pthread.c	8
providers/implementations/rands/seeding/rand_unix.c	1
crypto/engine/tb_rand.c	2
crypto/engine/eng_table.c	3
crypto/err/err_mark.c	2
crypto/engine/eng_local.h	4
crypto/lhash/lhash.c	7
crypto/engine/eng_init.c	4
include/internal/refcount.h	4
crypto/stack/stack.c	13
crypto/engine/eng_lib.c	3
crypto/engine/tb_pkmeth.c	1
crypto/evp/pmeth_lib.c	1
crypto/engine/tb_asnmth.c	1
crypto/asn1/ameth_lib.c	4
crypto/engine/eng_list.c	1
crypto/ex_data.c	4
crypto/context.c	8
crypto/err/err_blocks.c	1
crypto/err/err_local.h	3
include/internal/cryptlib.h	2
include/openssl/crypto.h	2
crypto/rand/rand_meth.c	1
providers/implementations/rands/crngt.c	1
crypto/evp/digest.c	6
crypto/evp/evp_fetch.c	6
crypto/core_namemap.c	19
crypto/objects/o_names.c	8
crypto/objects/obj_local.h	6
crypto/evp/evp_lib.c	12
crypto/objects/obj_dat.c	15
crypto/asn1/a_object.c	1
crypto/o_str.c	5
crypto/bsearch.c	1
crypto/bn/bn_word.c	3
crypto/bn/bn_lib.c	17
crypto/bn/bn_local.h	1
crypto/bn/bn_shift.c	2
crypto/bn/bn_conv.c	1
include/internal/constant_time.h	4
crypto/bn/asm/x86_64-gcc.c	1
crypto/bio/bio_print.c	9
include/internal/common.h	1
crypto/ctype.c	3
include/crypto/asn1.h	2
crypto/property/property.c	15
crypto/sparse_array.c	1
crypto/core_fetch.c	3
crypto/core_algorithm.c	4
crypto/provider_core.c	27
crypto/initthread.c	13
crypto/dso/dso_lib.c	9
crypto/provider_local.h	2
crypto/provider_child.c	2
crypto/dso/dso_dlfcn.c	1
crypto/getenv.c	1
crypto/defaults.c	1
include/openssl/core_dispatch.h	55
include/openssl/err.h	1
crypto/encode_decode/decoder_pkey.c	3
crypto/params.c	19
crypto/evp/evp_utils.c	5
crypto/property/property_parse.c	18
crypto/evp/evp_rand.c	20
crypto/evp/evp_enc.c	22
crypto/engine/tb_cipher.c	3
include/internal/packet.h	9

Fuzzer: cms

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	122	25.3%
gold	[1:9]	5	1.03%
yellow	[10:29]	4	0.82%
greenyellow	[30:49]	7	1.45%
lawngreen	50+	344	71.3%
All colors	482	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
5886	5886	2 : View List ['EVP_DigestVerifyInit', 'EVP_DigestSignInit']	5886	6147	evp_md_init_internal	call site: 00000	/src/openssl/crypto/evp/digest.c:166
3843	3917	2 : View List ['EC_GROUP_free', 'EC_GROUP_new_from_ecpkparameters']	3843	4875	d2i_ECPKParameters	call site: 00000	/src/openssl/crypto/ec/ec_asn1.c:891
3263	3281	2 : View List ['OSSL_LIB_CTX_get_conf_diagnostics', 'CONF_modules_load']	3263	3305	CONF_modules_load_file_ex	call site: 00000	/src/openssl/crypto/conf/conf_mod.c:217
2423	2425	8 : View List ['RSA_get0_iqmp', 'sk_BIGNUM_const_push', 'RSA_get0_dmp1', 'RSA_get0_dmq1', 'RSA_get_multi_prime_extra_count', 'RSA_get0_q', 'sk_RSA_PRIME_INFO_value.14742', 'RSA_get0_p']	2423	2425	ossl_rsa_get0_all_params	call site: 00000	/src/openssl/crypto/rsa/rsa_lib.c:887
2369	4307	4 : View List ['ossl_evp_pkey_get1_ED448', 'ossl_ecx_key_free', 'EVP_PKEY_get_id', 'EVP_PKEY_free']	2369	4307	ossl_d2i_ED448_PUBKEY	call site: 00000	/src/openssl/crypto/x509/x_pubkey.c:890
2369	4307	4 : View List ['ossl_ecx_key_free', 'ossl_evp_pkey_get1_X25519', 'EVP_PKEY_get_id', 'EVP_PKEY_free']	2369	4307	ossl_d2i_X25519_PUBKEY	call site: 00000	/src/openssl/crypto/x509/x_pubkey.c:932
2369	4307	4 : View List ['ossl_evp_pkey_get1_X448', 'ossl_ecx_key_free', 'EVP_PKEY_get_id', 'EVP_PKEY_free']	2369	4307	ossl_d2i_X448_PUBKEY	call site: 00000	/src/openssl/crypto/x509/x_pubkey.c:974
2369	4305	3 : View List ['ossl_evp_pkey_get1_ED25519', 'ossl_ecx_key_free', 'EVP_PKEY_free']	2369	4305	ossl_d2i_ED25519_PUBKEY	call site: 00000	/src/openssl/crypto/x509/x_pubkey.c:849
2186	2186	2 : View List ['CRYPTO_free', 'ossl_cipher_tlsunpadblock']	2186	3752	ossl_cipher_generic_block_update	call site: 00000	/src/openssl/providers/implementations/ciphers/ciphercommon.c:261
2125	2125	1 : View List ['RAND_bytes_ex']	2125	2441	bnrand	call site: 00000	/src/openssl/crypto/bn/bn_rand.c:53
1729	3617	14 : View List ['DSO_ctrl', 'CRYPTO_strdup', 'CRYPTO_free', 'DSO_free', 'DSO_new', 'ossl_safe_getenv', 'ossl_get_modulesdir', 'CRYPTO_THREAD_read_lock', 'DSO_bind_func', 'DSO_load', 'DSO_merge', 'DSO_convert_filename', 'get_provider_store', 'CRYPTO_THREAD_unlock']	1735	4416	provider_init	call site: 00000	/src/openssl/crypto/provider_core.c:890
1670	1670	1 : View List ['rand_drbg_restart']	1672	5477	ossl_prov_drbg_generate	call site: 00000	/src/openssl/providers/implementations/rands/drbg.c:648

Runtime coverage analysis

Covered functions

2319

Functions that are reachable but not covered

27

Reachable functions

219

Percentage of reachable functions covered

87.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/cms.c	1
crypto/bio/bio_lib.c	8
include/internal/refcount.h	4
crypto/ex_data.c	6
crypto/context.c	4
crypto/threads_pthread.c	6
crypto/err/err_blocks.c	1
crypto/err/err_local.h	3
include/internal/cryptlib.h	2
crypto/stack/stack.c	13
include/openssl/crypto.h	2
crypto/cms/cms_io.c	2
crypto/cms/cms_lib.c	5
crypto/cms/cms_asn1.c	1
crypto/asn1/a_d2i_fp.c	2
crypto/err/err_mark.c	3
crypto/asn1/asn1_lib.c	12
include/openssl/err.h	1
crypto/asn1/tasn_dec.c	13
include/openssl/asn1t.h	2
crypto/asn1/tasn_fre.c	5
crypto/asn1/a_object.c	3
crypto/asn1/tasn_utl.c	13
crypto/objects/obj_dat.c	11
crypto/bsearch.c	1
crypto/objects/obj_local.h	1
crypto/lhash/lhash.c	2
crypto/asn1/a_int.c	10
crypto/asn1/tasn_typ.c	7
crypto/asn1/tasn_new.c	9
crypto/asn1/a_type.c	1
crypto/asn1/a_bitstr.c	2
crypto/cms/cms_sd.c	3
include/openssl/cms.h	2
crypto/cms/cms_env.c	4
crypto/x509/x_x509.c	1
crypto/o_str.c	1
crypto/cms/cms_local.h	2
crypto/bio/bss_null.c	1
crypto/asn1/a_i2d_fp.c	1
crypto/asn1/tasn_enc.c	8
crypto/asn1/asn1_local.h	3

Fuzzer: server

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2793	56.5%
gold	[1:9]	327	6.62%
yellow	[10:29]	96	1.94%
greenyellow	[30:49]	25	0.50%
lawngreen	50+	1694	34.3%
All colors	4935	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
11643	20438	15 : View List ['OPENSSL_sk_pop', 'X509_add_cert', 'OPENSSL_sk_push', 'ossl_assert_int.17648', 'check_dane_issuer', 'find_issuer', 'get1_trusted_issuer', 'X509_cmp', 'ERR_set_debug', 'ERR_new', 'ossl_check_X509_type.17647', 'X509_free', 'ERR_set_error', 'OPENSSL_sk_delete_ptr', 'OPENSSL_sk_set']	15636	50143	build_chain	call site: 00000	/src/openssl/crypto/x509/x509_vfy.c:3441
9434	9445	6 : View List ['verify_cb_cert', 'X509_chain_check_suiteb', 'check_name_constraints', 'X509v3_asid_validate_path', 'internal_verify', 'X509v3_addr_validate_path']	9434	9445	verify_chain	call site: 00000	/src/openssl/crypto/x509/x509_vfy.c:240
8089	8647	11 : View List ['ossl_ffc_set_digest', 'BN_GENCB_new', 'ossl_ffc_params_set_seed', 'ossl_ffc_params_set_gindex', 'ossl_ffc_params_set_pcounter', 'DH_generate_parameters_ex', 'ossl_dh_generate_ffc_parameters', 'BN_GENCB_set', 'ossl_dh_new_ex', 'ossl_ffc_params_copy', 'ossl_ffc_params_set_h']	8093	9084	dh_gen	call site: 00000	/src/openssl/providers/implementations/keymgmt/dh_kmgmt.c:727
5886	5886	2 : View List ['EVP_DigestVerifyInit', 'EVP_DigestSignInit']	5886	6147	evp_md_init_internal	call site: 02477	/src/openssl/crypto/evp/digest.c:166
5876	8828	6 : View List ['ssl_get_auto_dh', 'EVP_PKEY_get_security_bits', 'ssl_security', 'ssl_generate_pkey', 'ssl_dh_to_pkey', 'EVP_PKEY_get_bn_param']	5878	68572	tls_construct_server_key_exchange	call site: 00000	/src/openssl/ssl/statem/statem_srvr.c:2546
4699	4699	1 : View List ['ossl_ecdsa_deterministic_sign']	4699	4699	ecdsa_sign	call site: 00000	/src/openssl/providers/implementations/signature/ecdsa_sig.c:209
4455	4455	1 : View List ['d2i_ECParameters']	4455	5256	ossl_ec_key_param_from_x509_algor	call site: 00000	/src/openssl/crypto/ec/ec_backend.c:780
4385	4461	3 : View List ['EC_GROUP_free', 'EC_GROUP_get_curve_name', 'd2i_ECPKParameters']	4385	4461	ossl_x509_algor_is_sm2	call site: 00000	/src/openssl/crypto/ec/ec_backend.c:744
4335	8465	4 : View List ['ERR_set_debug', 'ERR_new', 'ossl_statem_fatal', 'ssl_srp_server_param_with_username_intern']	4335	8465	ssl_check_srp_ext_ClientHello	call site: 00000	/src/openssl/ssl/statem/statem_srvr.c:1339
4077	4083	4 : View List ['OPENSSL_sk_value', 'ossl_check_const_X509_sk_type.16655', 'OPENSSL_sk_num', 'X509_cmp']	4077	8950	X509_add_cert	call site: 00000	/src/openssl/crypto/x509/x509_cmp.c:199
3586	8491	12 : View List ['PEM_def_callback', 'EVP_CIPHER_CTX_free', 'EVP_DecryptInit_ex', 'EVP_md5', 'EVP_DecryptFinal_ex', 'ERR_new', 'EVP_CIPHER_CTX_new', 'EVP_BytesToKey', 'ERR_set_debug', 'ERR_set_error', 'EVP_DecryptUpdate', 'OPENSSL_cleanse']	3586	8491	PEM_do_header	call site: 02457	/src/openssl/crypto/pem/pem_lib.c:438
3546	3546	2 : View List ['ecx_key_pairwise_check', 'ecd_key_pairwise_check']	3546	3546	ecx_validate	call site: 00000	/src/openssl/providers/implementations/keymgmt/ecx_kmgmt.c:918

Runtime coverage analysis

Covered functions

3974

Functions that are reachable but not covered

726

Reachable functions

1933

Percentage of reachable functions covered

62.44%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/server.c	1
ssl/methods.c	1
ssl/ssl_lib.c	43
crypto/err/err_blocks.c	4
crypto/err/err_local.h	6
ssl/ssl_init.c	7
ssl/ssl_ciph.c	16
crypto/context.c	12
crypto/threads_pthread.c	8
providers/implementations/rands/crngt.c	1
crypto/evp/digest.c	20
crypto/evp/evp_fetch.c	10
crypto/core_namemap.c	19
crypto/objects/o_names.c	8
crypto/lhash/lhash.c	8
crypto/objects/obj_local.h	9
crypto/stack/stack.c	22
crypto/evp/evp_lib.c	22
crypto/objects/obj_dat.c	26
crypto/asn1/a_object.c	6
crypto/o_str.c	11
crypto/bsearch.c	1
crypto/bn/bn_word.c	4
crypto/bn/bn_lib.c	19
crypto/bn/bn_local.h	1
crypto/bn/bn_shift.c	2
crypto/bn/bn_conv.c	1
include/internal/constant_time.h	4
crypto/bn/asm/x86_64-gcc.c	2
crypto/bio/bio_print.c	11
include/internal/common.h	2
crypto/ctype.c	3
crypto/asn1/ameth_lib.c	9
include/crypto/asn1.h	3
crypto/property/property.c	23
crypto/sparse_array.c	1
crypto/core_fetch.c	3
crypto/core_algorithm.c	4
crypto/provider_core.c	28
include/internal/refcount.h	5
crypto/initthread.c	13
crypto/dso/dso_lib.c	9
include/openssl/crypto.h	2
crypto/provider_local.h	2
crypto/provider_child.c	2
crypto/dso/dso_dlfcn.c	1
crypto/getenv.c	1
crypto/defaults.c	4
include/openssl/core_dispatch.h	107
include/openssl/err.h	2
crypto/encode_decode/decoder_pkey.c	23
crypto/params.c	32
crypto/evp/evp_utils.c	5
ssl/s3_lib.c	2
ssl/ssl_cert.c	12
crypto/ex_data.c	9
include/internal/cryptlib.h	6
ssl/ssl_local.h	10
crypto/x509/x509_lu.c	7
include/openssl/x509_vfy.h	4
crypto/x509/x509_cmp.c	9
crypto/x509/x_name.c	7
crypto/asn1/tasn_enc.c	8
crypto/asn1/asn1_local.h	3
crypto/asn1/a_bitstr.c	2
crypto/asn1/a_int.c	11
crypto/asn1/asn1_lib.c	15
crypto/asn1/tasn_utl.c	13
crypto/x509/x509_vpm.c	3
include/openssl/asn1.h	4
include/openssl/safestack.h	1
crypto/ct/ct_log.c	3
include/openssl/ct.h	1
crypto/evp/p_lib.c	32
crypto/evp/keymgmt_lib.c	16
include/crypto/evp.h	7
crypto/evp/keymgmt_meth.c	25
crypto/engine/tb_asnmth.c	5
crypto/engine/eng_table.c	6
crypto/err/err_mark.c	4
crypto/engine/eng_local.h	5
crypto/engine/eng_init.c	4
crypto/engine/eng_lib.c	4
crypto/engine/tb_pkmeth.c	4
crypto/evp/pmeth_lib.c	28
crypto/engine/eng_list.c	1
include/openssl/x509.h	6
crypto/x509/x_attrib.c	2
crypto/asn1/tasn_fre.c	5
include/openssl/asn1t.h	2
ssl/tls_depr.c	3
crypto/engine/tb_cipher.c	3
crypto/evp/evp_enc.c	27
crypto/engine/tb_digest.c	3
crypto/evp/signature.c	9
crypto/evp/exchange.c	5
ssl/t1_lib.c	17
crypto/provider.c	3
crypto/objects/obj_lib.c	2
crypto/objects/obj_xref.c	10
crypto/objects/obj_xref.h	5
crypto/evp/kem.c	2
crypto/evp/asymcipher.c	2
crypto/bio/bio_lib.c	23
include/openssl/ssl.h	3
crypto/rand/rand_lib.c	12
providers/implementations/rands/seeding/rand_unix.c	1
crypto/engine/tb_rand.c	2
crypto/rand/rand_meth.c	1
crypto/property/property_parse.c	18
crypto/evp/evp_rand.c	20
ssl/tls_srp.c	2
ssl/ssl_mcnf.c	2
crypto/conf/conf_ssl.c	3
ssl/ssl_conf.c	13
ssl/ssl_rsa.c	7
crypto/bio/bss_file.c	3
crypto/pem/pem_pkey.c	5
crypto/bio/bf_readbuff.c	1
crypto/passphrase.c	9
crypto/encode_decode/decoder_meth.c	19
crypto/encode_decode/decoder_lib.c	28
crypto/encode_decode/encoder_local.h	6
crypto/bio/ossl_core_bio.c	3
crypto/ui/ui_util.c	8
crypto/ui/ui_lib.c	28
crypto/ui/ui_openssl.c	1
crypto/ui/ui_null.c	1
include/openssl/ui.h	2
crypto/err/err_prn.c	2
crypto/pem/pem_lib.c	15
crypto/evp/encode.c	7
crypto/evp/names.c	6
crypto/evp/evp_key.c	3
crypto/evp/legacy_md5.c	1
crypto/evp/m_sigver.c	6
crypto/evp/ctrl_params_translate.c	8
crypto/asn1/p8_pkey.c	4
crypto/asn1/tasn_dec.c	14
crypto/asn1/tasn_typ.c	9
crypto/asn1/tasn_new.c	9
crypto/asn1/a_type.c	1
crypto/evp/evp_pkey.c	1
crypto/asn1/x_sig.c	3
crypto/pkcs12/p12_p8d.c	2
crypto/pkcs12/p12_decr.c	2
crypto/evp/evp_pbe.c	4
crypto/evp/evp_local.h	3
crypto/asn1/d2i_pr.c	4
crypto/x509/x_pubkey.c	7
crypto/x509/x_all.c	2
crypto/asn1/a_d2i_fp.c	1
ssl/ssl_sess.c	9
include/internal/time.h	14
crypto/x509/x_x509.c	3
crypto/x509/t_x509.c	1
crypto/x509/x_crl.c	2
ssl/statem/extensions_cust.c	4
crypto/conf/conf_mod.c	1
ssl/statem/statem_lib.c	1
crypto/rsa/rsa_asn1.c	2
crypto/ec/ec_key.c	4
crypto/ec/ec_lib.c	4
crypto/rsa/rsa_backend.c	1
crypto/rsa/rsa_lib.c	1
crypto/rsa/rsa_ossl.c	1
crypto/ec/ec_backend.c	1
crypto/ec/ec_kmeth.c	1
crypto/dsa/dsa_backend.c	1
crypto/dsa/dsa_lib.c	2
crypto/dsa/dsa_ossl.c	1
crypto/dh/dh_backend.c	1
crypto/dh/dh_lib.c	1
crypto/dh/dh_key.c	1
crypto/x509/v3_purp.c	12
crypto/evp/legacy_sha.c	1
crypto/asn1/a_digest.c	1
crypto/x509/x509_set.c	6
crypto/x509/x509_ext.c	4
crypto/x509/v3_lib.c	6
crypto/x509/x509_v3.c	7
include/openssl/x509v3.h	6
crypto/x509/v3_bcons.c	2
crypto/x509/v3_pcia.c	2
crypto/asn1/a_octet.c	1
crypto/x509/v3_crld.c	1
crypto/asn1/a_dup.c	1
crypto/x509/x509name.c	1
crypto/pem/pem_all.c	4
crypto/evp/p_legacy.c	2
crypto/ec/ecp_nistz256.c	1
crypto/ec/ecp_nistp224.c	1
crypto/ec/ecp_nistp256.c	1
crypto/ec/ecp_nistp384.c	1
crypto/ec/ecp_nistp521.c	1
crypto/ec/ec_mult.c	1
crypto/bn/bn_mont.c	1
crypto/pem/pem_x509.c	1
crypto/pem/pem_oth.c	1
crypto/ffc/ffc_params.c	2
ssl/quic/quic_impl.c	34
ssl/quic/quic_channel.c	23
ssl/quic/quic_port.c	11
crypto/err/err_save.c	4
ssl/quic/quic_reactor.c	12
ssl/quic/quic_record_tx.c	3
ssl/quic/quic_engine.c	4
ssl/quic/quic_demux.c	2
ssl/statem/statem.c	7
ssl/record/rec_layer_s3.c	10
ssl/s3_msg.c	1
ssl/tls13_enc.c	2
ssl/t1_enc.c	1
ssl/record/rec_layer_d1.c	2
ssl/pqueue.c	3
crypto/bio/bss_dgram_pair.c	1
crypto/thread/arch/thread_posix.c	8
crypto/bio/bio_addr.c	2
ssl/quic/quic_txp.c	3
ssl/quic/quic_record_util.c	11
crypto/evp/kdf_meth.c	7
crypto/evp/kdf_lib.c	3
ssl/quic/quic_record_rx.c	2
ssl/quic/quic_record_shared.c	7
ssl/quic/quic_wire_pkt.c	2
include/internal/quic_demux.h	3
ssl/quic/quic_wire.c	5
include/internal/quic_vlint.h	1
ssl/quic/quic_fc.c	1
ssl/quic/quic_tls.c	5
ssl/quic/qlog.c	34
ssl/quic/json_enc.c	42
crypto/o_fopen.c	1
crypto/cversion.c	1
crypto/info.c	3
ssl/quic/qlog_event_helpers.c	5
ssl/quic/quic_rstream.c	1
ssl/quic/quic_sstream.c	1
crypto/bio/bss_null.c	1
crypto/async/async.c	13
crypto/async/async_wait.c	2
crypto/async/async_local.h	4
crypto/async/arch/async_posix.c	3
crypto/async/arch/async_posix.h	1
crypto/time.c	1
ssl/quic/quic_ackm.c	1
ssl/quic/quic_statm.c	1
ssl/quic/quic_thread_assist.c	2
crypto/thread/arch.c	1