Fuzz introspector: bndiv
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
438 880 5 :

['CRYPTO_free', 'CRYPTO_FREE_REF.6938', 'EVP_RAND_CTX_free', 'EVP_RAND_free', 'CRYPTO_DOWN_REF.6937']

438 880 EVP_RAND_CTX_free call site: 00000 /src/openssl/crypto/evp/evp_rand.c:390
266 266 3 :

['ERR_new', 'ERR_set_debug', 'ERR_set_error']

266 266 BN_usub call site: 00247 /src/openssl/crypto/bn/bn_add.c:138
266 266 3 :

['ERR_new', 'ERR_set_debug', 'ERR_set_error']

266 266 BN_CTX_get call site: 00109 /src/openssl/crypto/bn/bn_ctx.c:219
266 266 3 :

['ERR_new', 'ERR_set_debug', 'ERR_set_error']

266 266 BN_div call site: 00097 /src/openssl/crypto/bn/bn_div.c:224
266 266 3 :

['ERR_new', 'ERR_set_debug', 'ERR_set_error']

266 266 bn_expand_internal call site: 00076 /src/openssl/crypto/bn/bn_lib.c:274
266 266 3 :

['ERR_new', 'ERR_set_debug', 'ERR_set_error']

266 266 do_init_module_list_lock call site: 00000 /src/openssl/crypto/conf/conf_mod.c:103
266 266 3 :

['ERR_new', 'ERR_set_debug', 'ERR_set_error']

266 266 OPENSSL_sk_insert call site: 00000 /src/openssl/crypto/stack/stack.c:273
266 266 3 :

['ERR_new', 'ERR_set_debug', 'ERR_set_error']

266 266 sk_reserve call site: 00000 /src/openssl/crypto/stack/stack.c:210
46 51 6 :

['lh_OBJ_NAME_get_down_load', 'lh_OBJ_NAME_doall', 'CRYPTO_THREAD_lock_free', 'lh_OBJ_NAME_set_down_load', 'lh_OBJ_NAME_free', 'sk_NAME_FUNCS_pop_free']

46 51 OBJ_NAME_cleanup call site: 00000 /src/openssl/crypto/objects/o_names.c:371
40 40 2 :

['ossl_strtouint64', 'ossl_strchr']

44 44 OPENSSL_cpuid_setup call site: 00000 /src/openssl/crypto/cpuid.c:107
20 20 2 :

['constant_time_select_int', 'constant_time_lt_bn']

20 20 BN_ucmp call site: 00239 /src/openssl/crypto/bn/bn_lib.c:716
14 14 1 :

['async_deinit']

14 2924 OPENSSL_cleanup call site: 00000 /src/openssl/crypto/init.c:431

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 FuzzerTestOneInput [function] [call site] 00001
2 BN_bin2bn [function] [call site] 00002
3 bin2bn [function] [call site] 00003
4 BN_new [function] [call site] 00004
4 BN_clear [function] [call site] 00005
5 OPENSSL_cleanse [call site] 00006
4 bn_wexpand [function] [call site] 00007
5 bn_expand2 [function] [call site] 00008
6 bn_expand_internal [function] [call site] 00009
7 ERR_new [function] [call site] 00010
8 err_get_slot [function] [call site] 00011
8 err_clear [function] [call site] 00012
9 err_clear_data [function] [call site] 00013
7 ERR_set_debug [function] [call site] 00014
8 err_set_debug [function] [call site] 00015
9 strlen [call site] 00016
9 strcpy [call site] 00017
9 strlen [call site] 00018
9 strcpy [call site] 00019
7 ERR_set_error [function] [call site] 00020
8 ERR_vset_error [function] [call site] 00021
9 BIO_vsnprintf [function] [call site] 00022
10 _dopr [function] [call site] 00023
11 doapr_outch [function] [call site] 00024
12 ossl_assert_int [function] [call site] 00025
12 ossl_assert_int [function] [call site] 00026
12 ossl_assert_int [function] [call site] 00027
11 ossl_isdigit [function] [call site] 00028
11 ossl_isdigit [function] [call site] 00029
11 fmtint [function] [call site] 00030
12 strlen [call site] 00031
12 doapr_outch [function] [call site] 00032
12 doapr_outch [function] [call site] 00033
12 doapr_outch [function] [call site] 00034
12 doapr_outch [function] [call site] 00035
12 doapr_outch [function] [call site] 00036
12 doapr_outch [function] [call site] 00037
11 fmtint [function] [call site] 00038
11 fmtfp [function] [call site] 00039
12 abs_val [function] [call site] 00040
12 pow_10 [function] [call site] 00041
12 doapr_outch [function] [call site] 00042
12 doapr_outch [function] [call site] 00043
12 pow_10 [function] [call site] 00044
12 roundv [function] [call site] 00045
12 pow_10 [function] [call site] 00046
12 roundv [function] [call site] 00047
12 doapr_outch [function] [call site] 00048
12 doapr_outch [function] [call site] 00049
12 doapr_outch [function] [call site] 00050
12 doapr_outch [function] [call site] 00051
12 doapr_outch [function] [call site] 00052
12 doapr_outch [function] [call site] 00053
12 doapr_outch [function] [call site] 00054
12 doapr_outch [function] [call site] 00055
12 doapr_outch [function] [call site] 00056
12 doapr_outch [function] [call site] 00057
12 doapr_outch [function] [call site] 00058
12 doapr_outch [function] [call site] 00059
12 doapr_outch [function] [call site] 00060
12 doapr_outch [function] [call site] 00061
11 fmtfp [function] [call site] 00062
11 fmtfp [function] [call site] 00063
11 doapr_outch [function] [call site] 00064
11 fmtstr [function] [call site] 00065
12 OPENSSL_strnlen [function] [call site] 00066
12 doapr_outch [function] [call site] 00067
12 doapr_outch [function] [call site] 00068
12 doapr_outch [function] [call site] 00069
11 fmtint [function] [call site] 00070
11 doapr_outch [function] [call site] 00071
11 doapr_outch [function] [call site] 00072
9 err_clear_data [function] [call site] 00073
9 err_set_error [function] [call site] 00074
9 err_set_data [function] [call site] 00075
7 BN_get_flags [function] [call site] 00076
7 ERR_new [function] [call site] 00077
7 ERR_set_debug [function] [call site] 00078
7 ERR_set_error [function] [call site] 00079
7 BN_get_flags [function] [call site] 00080
7 __assert_fail [call site] 00081
6 bn_free_d [function] [call site] 00082
7 BN_get_flags [function] [call site] 00083
4 BN_free [function] [call site] 00084
5 BN_get_flags [function] [call site] 00085
5 bn_free_d [function] [call site] 00086
4 bn_correct_top [function] [call site] 00087
2 BN_set_negative [function] [call site] 00088
3 BN_is_zero [function] [call site] 00089
2 BN_bin2bn [function] [call site] 00090
2 BN_set_negative [function] [call site] 00091
2 BN_is_zero [function] [call site] 00092
2 BN_div [function] [call site] 00093
3 BN_is_zero [function] [call site] 00094
3 ERR_new [function] [call site] 00095
3 ERR_set_debug [function] [call site] 00096
3 ERR_set_error [function] [call site] 00097
3 ERR_new [function] [call site] 00098
3 ERR_set_debug [function] [call site] 00099
3 ERR_set_error [function] [call site] 00100
3 bn_div_fixed_top [function] [call site] 00101
4 __assert_fail [call site] 00102
4 BN_CTX_start [function] [call site] 00103
5 BN_STACK_push [function] [call site] 00104
5 ERR_new [function] [call site] 00105
5 ERR_set_debug [function] [call site] 00106
5 ERR_set_error [function] [call site] 00107
4 BN_CTX_get [function] [call site] 00108
5 BN_POOL_get [function] [call site] 00109
6 bn_init [function] [call site] 00110
6 BN_set_flags [function] [call site] 00111
5 BN_zero_ex [function] [call site] 00112
4 BN_CTX_get [function] [call site] 00113
4 BN_CTX_get [function] [call site] 00114
4 BN_CTX_get [function] [call site] 00115
4 BN_copy [function] [call site] 00116
5 BN_get_flags [function] [call site] 00117
5 bn_wexpand [function] [call site] 00118
4 bn_left_align [function] [call site] 00119
5 BN_num_bits_word [function] [call site] 00120
4 bn_lshift_fixed_top [function] [call site] 00121
5 __assert_fail [call site] 00122
5 bn_wexpand [function] [call site] 00123
4 bn_wexpand [function] [call site] 00124
4 bn_wexpand [function] [call site] 00125
4 bn_wexpand [function] [call site] 00126
4 bn_div_words [function] [call site] 00127
4 bn_mul_words [function] [call site] 00128
4 bn_sub_words [function] [call site] 00129
4 bn_add_words [function] [call site] 00130
4 __assert_fail [call site] 00131
4 bn_rshift_fixed_top [function] [call site] 00132
5 __assert_fail [call site] 00133
5 BN_zero_ex [function] [call site] 00134
5 bn_wexpand [function] [call site] 00135
4 BN_CTX_end [function] [call site] 00136
5 BN_STACK_pop [function] [call site] 00137
5 BN_POOL_release [function] [call site] 00138
4 BN_CTX_end [function] [call site] 00139
3 bn_correct_top [function] [call site] 00140
3 bn_correct_top [function] [call site] 00141
2 BN_is_zero [function] [call site] 00142
2 BN_is_zero [function] [call site] 00143
2 BN_is_negative [function] [call site] 00144
2 BN_is_negative [function] [call site] 00145
2 BN_is_zero [function] [call site] 00146
2 BN_is_negative [function] [call site] 00147
2 BN_is_zero [function] [call site] 00148
2 BN_is_negative [function] [call site] 00149
2 BN_is_zero [function] [call site] 00150
2 BN_is_negative [function] [call site] 00151
2 BN_is_zero [function] [call site] 00152
2 BN_mul [function] [call site] 00153
3 bn_mul_fixed_top [function] [call site] 00154
4 BN_zero_ex [function] [call site] 00155
4 BN_CTX_start [function] [call site] 00156
4 BN_CTX_get [function] [call site] 00157
4 bn_wexpand [function] [call site] 00158
4 bn_mul_comba8 [function] [call site] 00159
4 BN_num_bits_word [function] [call site] 00160
4 BN_num_bits_word [function] [call site] 00161
4 __assert_fail [call site] 00162
4 BN_CTX_get [function] [call site] 00163
4 bn_wexpand [function] [call site] 00164
4 bn_wexpand [function] [call site] 00165
4 bn_mul_part_recursive [function] [call site] 00166
5 bn_mul_normal [function] [call site] 00167
6 bn_mul_words [function] [call site] 00168
6 bn_mul_words [function] [call site] 00169
6 bn_mul_add_words [function] [call site] 00170
6 bn_mul_add_words [function] [call site] 00171
6 bn_mul_add_words [function] [call site] 00172
6 bn_mul_add_words [function] [call site] 00173
5 bn_cmp_part_words [function] [call site] 00174
6 bn_cmp_words [function] [call site] 00175
5 bn_cmp_part_words [function] [call site] 00176
5 bn_sub_part_words [function] [call site] 00177
6 __assert_fail [call site] 00178
6 bn_sub_words [function] [call site] 00179
5 bn_sub_part_words [function] [call site] 00180
5 bn_sub_part_words [function] [call site] 00181
5 bn_sub_part_words [function] [call site] 00182
5 bn_sub_part_words [function] [call site] 00183
5 bn_sub_part_words [function] [call site] 00184
5 bn_sub_part_words [function] [call site] 00185
5 bn_sub_part_words [function] [call site] 00186
5 bn_mul_comba8 [function] [call site] 00187
5 bn_mul_comba8 [function] [call site] 00188
5 bn_mul_normal [function] [call site] 00189
5 bn_mul_recursive [function] [call site] 00190
6 bn_mul_comba8 [function] [call site] 00191
6 bn_mul_normal [function] [call site] 00192
6 bn_cmp_part_words [function] [call site] 00193
6 bn_cmp_part_words [function] [call site] 00194
6 bn_sub_part_words [function] [call site] 00195
6 bn_sub_part_words [function] [call site] 00196
6 bn_sub_part_words [function] [call site] 00197
6 bn_sub_part_words [function] [call site] 00198
6 bn_sub_part_words [function] [call site] 00199
6 bn_sub_part_words [function] [call site] 00200
6 bn_sub_part_words [function] [call site] 00201
6 bn_sub_part_words [function] [call site] 00202
6 bn_mul_comba4 [function] [call site] 00203
6 bn_mul_comba4 [function] [call site] 00204
6 bn_mul_comba4 [function] [call site] 00205
6 bn_mul_comba8 [function] [call site] 00206
6 bn_mul_comba8 [function] [call site] 00207
6 bn_mul_comba8 [function] [call site] 00208
6 bn_mul_recursive [function] [call site] 00209
7 bn_mul_recursive [function] [call site] 00210
8 bn_mul_recursive [function] [call site] 00211
9 bn_add_words [function] [call site] 00212
9 bn_sub_words [function] [call site] 00213
9 bn_add_words [function] [call site] 00214
9 bn_add_words [function] [call site] 00215
5 bn_mul_recursive [function] [call site] 00216
5 bn_mul_recursive [function] [call site] 00217
5 bn_mul_part_recursive [function] [call site] 00218
6 bn_mul_normal [function] [call site] 00219
6 bn_mul_part_recursive [function] [call site] 00220
7 bn_mul_recursive [function] [call site] 00221
7 bn_add_words [function] [call site] 00222
7 bn_sub_words [function] [call site] 00223
7 bn_add_words [function] [call site] 00224
7 bn_add_words [function] [call site] 00225
4 bn_wexpand [function] [call site] 00226
4 bn_wexpand [function] [call site] 00227
4 bn_mul_recursive [function] [call site] 00228
4 bn_wexpand [function] [call site] 00229
4 bn_mul_normal [function] [call site] 00230
4 BN_copy [function] [call site] 00231
4 BN_CTX_end [function] [call site] 00232
3 bn_correct_top [function] [call site] 00233
2 BN_add [function] [call site] 00234
3 BN_uadd [function] [call site] 00235
4 bn_wexpand [function] [call site] 00236
4 bn_add_words [function] [call site] 00237
3 BN_ucmp [function] [call site] 00238
4 BN_get_flags [function] [call site] 00239
4 constant_time_lt_bn [function] [call site] 00240
5 constant_time_msb_bn [function] [call site] 00241
4 constant_time_select_int [function] [call site] 00242
5 constant_time_select [function] [call site] 00243
6 value_barrier [function] [call site] 00244
4 constant_time_lt_bn [function] [call site] 00245
4 constant_time_select_int [function] [call site] 00246
3 BN_usub [function] [call site] 00247
4 ERR_new [function] [call site] 00248
4 ERR_set_debug [function] [call site] 00249
4 ERR_set_error [function] [call site] 00250
4 bn_wexpand [function] [call site] 00251
4 bn_sub_words [function] [call site] 00252
3 BN_usub [function] [call site] 00253
3 BN_zero_ex [function] [call site] 00254
2 BN_cmp [function] [call site] 00255
2 BN_print_fp [function] [call site] 00256
3 BIO_s_file [function] [call site] 00257
3 BIO_new [function] [call site] 00258
4 BIO_new_ex [function] [call site] 00259
5 CRYPTO_NEW_REF [function] [call site] 00260
5 CRYPTO_new_ex_data [function] [call site] 00261
6 ossl_crypto_new_ex_data_ex [function] [call site] 00262
7 ossl_lib_ctx_get_ex_data_global [function] [call site] 00263
8 ossl_lib_ctx_get_concrete [function] [call site] 00264
9 get_default_context [function] [call site] 00265
10 get_thread_default_context [function] [call site] 00266
11 CRYPTO_THREAD_get_local [function] [call site] 00267
12 pthread_getspecific [call site] 00268
7 get_and_lock [function] [call site] 00269
8 ERR_new [function] [call site] 00270
8 ERR_set_debug [function] [call site] 00271
8 ERR_set_error [function] [call site] 00272
8 CRYPTO_THREAD_read_lock [function] [call site] 00273
9 pthread_rwlock_rdlock [call site] 00274
9 ossl_assert_int [function] [call site] 00275
8 CRYPTO_THREAD_write_lock [function] [call site] 00276
9 pthread_rwlock_wrlock [call site] 00277
9 ossl_assert_int [function] [call site] 00278
7 sk_EX_CALLBACK_num [function] [call site] 00279
8 OPENSSL_sk_num [function] [call site] 00280
7 sk_EX_CALLBACK_value [function] [call site] 00281
8 OPENSSL_sk_value [function] [call site] 00282
7 CRYPTO_THREAD_unlock [function] [call site] 00283
8 pthread_rwlock_unlock [call site] 00284
7 CRYPTO_get_ex_data [function] [call site] 00285
8 ossl_check_const_void_sk_type [function] [call site] 00286
8 OPENSSL_sk_num [function] [call site] 00287
8 ossl_check_const_void_sk_type [function] [call site] 00288
8 OPENSSL_sk_value [function] [call site] 00289
5 ERR_new [function] [call site] 00290
5 ERR_set_debug [function] [call site] 00291
5 ERR_set_error [function] [call site] 00292
5 CRYPTO_free_ex_data [function] [call site] 00293
6 ossl_lib_ctx_get_ex_data_global [function] [call site] 00294
6 get_and_lock [function] [call site] 00295
6 sk_EX_CALLBACK_num [function] [call site] 00296
6 sk_EX_CALLBACK_value [function] [call site] 00297
6 CRYPTO_THREAD_unlock [function] [call site] 00298
6 qsort [call site] 00299
6 ex_callback_compare [function] [call site] 00300
6 CRYPTO_get_ex_data [function] [call site] 00301
6 ossl_check_void_sk_type [function] [call site] 00302
6 OPENSSL_sk_free [function] [call site] 00303
5 CRYPTO_FREE_REF [function] [call site] 00304
3 BIO_ctrl [function] [call site] 00305
4 ERR_new [function] [call site] 00306
4 ERR_set_debug [function] [call site] 00307
4 ERR_set_error [function] [call site] 00308
4 bio_call_callback [function] [call site] 00309
4 bio_call_callback [function] [call site] 00310
3 BN_print [function] [call site] 00311
4 BIO_write [function] [call site] 00312
5 bio_write_intern [function] [call site] 00313
6 ERR_new [function] [call site] 00314
6 ERR_set_debug [function] [call site] 00315
6 ERR_set_error [function] [call site] 00316
6 bio_call_callback [function] [call site] 00317
6 ERR_new [function] [call site] 00318
6 ERR_set_debug [function] [call site] 00319
6 ERR_set_error [function] [call site] 00320
6 bio_call_callback [function] [call site] 00321
4 BN_is_zero [function] [call site] 00322
4 BIO_write [function] [call site] 00323
4 BIO_write [function] [call site] 00324
3 BIO_free [function] [call site] 00325
4 CRYPTO_DOWN_REF [function] [call site] 00326
4 bio_call_callback [function] [call site] 00327
4 CRYPTO_free_ex_data [function] [call site] 00328
4 CRYPTO_FREE_REF [function] [call site] 00329
2 putchar [call site] 00330
2 BN_print_fp [function] [call site] 00331
2 putchar [call site] 00332
2 BN_print_fp [function] [call site] 00333
2 putchar [call site] 00334
2 BN_print_fp [function] [call site] 00335
2 putchar [call site] 00336
2 BN_print_fp [function] [call site] 00337
2 putchar [call site] 00338
2 BN_is_negative [function] [call site] 00339
2 BN_is_negative [function] [call site] 00340
2 BN_is_negative [function] [call site] 00341
2 BN_is_zero [function] [call site] 00342
2 BN_is_negative [function] [call site] 00343
2 BN_is_negative [function] [call site] 00344
2 BN_is_zero [function] [call site] 00345
2 BN_cmp [function] [call site] 00346
2 printf [call site] 00347
2 puts [call site] 00348