High level conclusions

Fuzzers reach 30.84% of cyclomatic complexity.

Fuzzers reach 27.52% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

4863 / 17670

Cyclomatic complexity statically reachable by fuzzers

27405 / 88854

Runtime code coverage of functions

8522 / 17670

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: bndiv

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	183	52.4%
gold	[1:9]	6	1.71%
yellow	[10:29]	3	0.85%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	157	44.9%
All colors	349	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
438	880	5 : View List ['CRYPTO_free', 'CRYPTO_FREE_REF.6938', 'EVP_RAND_CTX_free', 'EVP_RAND_free', 'CRYPTO_DOWN_REF.6937']	438	880	EVP_RAND_CTX_free	call site: 00000	/src/openssl/crypto/evp/evp_rand.c:390
266	266	3 : View List ['ERR_new', 'ERR_set_debug', 'ERR_set_error']	266	266	BN_usub	call site: 00247	/src/openssl/crypto/bn/bn_add.c:138
266	266	3 : View List ['ERR_new', 'ERR_set_debug', 'ERR_set_error']	266	266	BN_CTX_get	call site: 00109	/src/openssl/crypto/bn/bn_ctx.c:219
266	266	3 : View List ['ERR_new', 'ERR_set_debug', 'ERR_set_error']	266	266	BN_div	call site: 00097	/src/openssl/crypto/bn/bn_div.c:224
266	266	3 : View List ['ERR_new', 'ERR_set_debug', 'ERR_set_error']	266	266	bn_expand_internal	call site: 00076	/src/openssl/crypto/bn/bn_lib.c:274
266	266	3 : View List ['ERR_new', 'ERR_set_debug', 'ERR_set_error']	266	266	do_init_module_list_lock	call site: 00000	/src/openssl/crypto/conf/conf_mod.c:103
266	266	3 : View List ['ERR_new', 'ERR_set_debug', 'ERR_set_error']	266	266	OPENSSL_sk_insert	call site: 00000	/src/openssl/crypto/stack/stack.c:273
266	266	3 : View List ['ERR_new', 'ERR_set_debug', 'ERR_set_error']	266	266	sk_reserve	call site: 00000	/src/openssl/crypto/stack/stack.c:210
46	51	6 : View List ['lh_OBJ_NAME_get_down_load', 'lh_OBJ_NAME_doall', 'CRYPTO_THREAD_lock_free', 'lh_OBJ_NAME_set_down_load', 'lh_OBJ_NAME_free', 'sk_NAME_FUNCS_pop_free']	46	51	OBJ_NAME_cleanup	call site: 00000	/src/openssl/crypto/objects/o_names.c:371
40	40	2 : View List ['ossl_strtouint64', 'ossl_strchr']	44	44	OPENSSL_cpuid_setup	call site: 00000	/src/openssl/crypto/cpuid.c:107
20	20	2 : View List ['constant_time_select_int', 'constant_time_lt_bn']	20	20	BN_ucmp	call site: 00239	/src/openssl/crypto/bn/bn_lib.c:716
14	14	1 : View List ['async_deinit']	14	2924	OPENSSL_cleanup	call site: 00000	/src/openssl/crypto/init.c:431

Runtime coverage analysis

Covered functions

355

Functions that are reachable but not covered

61

Reachable functions

126

Percentage of reachable functions covered

51.59%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/bndiv.c	1
crypto/bn/bn_lib.c	23
crypto/err/err_blocks.c	4
crypto/err/err_local.h	6
crypto/bio/bio_print.c	9
include/internal/common.h	1
crypto/ctype.c	1
crypto/o_str.c	1
crypto/bn/bn_div.c	3
crypto/bn/bn_ctx.c	7
crypto/bn/bn_shift.c	2
crypto/bn/asm/x86_64-gcc.c	7
crypto/bn/bn_mul.c	6
crypto/bn/bn_add.c	3
include/internal/constant_time.h	5
crypto/bn/bn_print.c	2
crypto/bio/bss_file.c	1
crypto/bio/bio_lib.c	7
include/internal/refcount.h	3
crypto/ex_data.c	6
crypto/context.c	4
crypto/threads_pthread.c	4
include/internal/cryptlib.h	2
crypto/stack/stack.c	3
include/openssl/crypto.h	2

Fuzzer: slh-dsa

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	3	100.%
All colors	3	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
6320	6320	2 : View List ['EVP_DigestSignInit', 'EVP_DigestVerifyInit']	6320	6586	evp_md_init_internal	call site: 00000	/src/openssl/crypto/evp/digest.c:165
3344	3346	2 : View List ['ssl3_cbc_digest_record', 'ossl_prov_digest_md']	3344	3346	hmac_update	call site: 00000	/src/openssl/providers/implementations/macs/hmac_prov.c:218
2719	2738	2 : View List ['CONF_modules_load', 'OSSL_LIB_CTX_get_conf_diagnostics']	2719	2762	CONF_modules_load_file_ex	call site: 00000	/src/openssl/crypto/conf/conf_mod.c:217
2407	3647	5 : View List ['ERR_set_debug', 'EVP_MD_CTX_reset', 'ERR_set_error', 'ERR_new', 'EVP_PKEY_CTX_dup']	2407	3647	EVP_MD_CTX_copy_ex	call site: 00000	/src/openssl/crypto/evp/digest.c:657
2058	2058	2 : View List ['CRYPTO_free', 'ossl_cipher_tlsunpadblock']	2058	3654	ossl_cipher_generic_block_update	call site: 00000	/src/openssl/providers/implementations/ciphers/ciphercommon.c:435
1904	2298	5 : View List ['EVP_PKEY_CTX_ctrl', 'ENGINE_init', 'ENGINE_get_digest', 'CRYPTO_zalloc', 'ENGINE_finish']	1904	3544	evp_md_init_internal	call site: 00000	/src/openssl/crypto/evp/digest.c:225
1767	4461	8 : View List ['evp_signature_fetch_from_prov', 'ossl_assert_int.7785', 'EVP_SIGNATURE_fetch', 'ERR_pop_to_mark', 'EVP_SIGNATURE_free', 'ERR_set_mark', 'ERR_clear_last_mark', 'EVP_KEYMGMT_get0_provider']	1774	16791	evp_pkey_signature_init	call site: 00000	/src/openssl/crypto/evp/signature.c:592
1759	2346	14 : View List ['CRYPTO_THREAD_unlock', 'CRYPTO_free', 'DSO_ctrl', 'DSO_load', 'DSO_free', 'DSO_bind_func', 'CRYPTO_THREAD_read_lock', 'ossl_safe_getenv', 'DSO_merge', 'CRYPTO_strdup', 'DSO_new', 'get_provider_store', 'DSO_convert_filename', 'ossl_get_modulesdir']	1767	3162	provider_init	call site: 00000	/src/openssl/crypto/provider_core.c:959
1745	2062	2 : View List ['EVP_CIPHER_fetch', 'OBJ_nid2sn']	2340	7490	evp_cipher_init_internal	call site: 00000	/src/openssl/crypto/evp/evp_enc.c:186
1745	1759	2 : View List ['EVP_CIPHER_fetch', 'ERR_pop_to_mark']	1745	5385	drbg_ctr_set_ctx_params_locked	call site: 00000	/src/openssl/providers/implementations/rands/drbg_ctr.c:783
1725	1725	1 : View List ['EVP_get_digestbyname']	1725	1746	ossl_prov_digest_load_from_params	call site: 00000	/src/openssl/providers/common/provider_util.c:198
1590	1590	3 : View List ['ENGINE_free', 'ENGINE_init', 'ENGINE_by_id']	1590	1590	load_common	call site: 00000	/src/openssl/providers/common/provider_util.c:71

Runtime coverage analysis

Covered functions

1696

Functions that are reachable but not covered

0

Reachable functions

3

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/slh-dsa.c	2

Fuzzer: hashtable

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	124	55.8%
gold	[1:9]	70	31.5%
yellow	[10:29]	20	9.00%
greenyellow	[30:49]	3	1.35%
lawngreen	50+	5	2.25%
All colors	222	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
438	880	5 : View List ['CRYPTO_free', 'CRYPTO_FREE_REF.6938', 'EVP_RAND_CTX_free', 'EVP_RAND_free', 'CRYPTO_DOWN_REF.6937']	438	880	EVP_RAND_CTX_free	call site: 00000	/src/openssl/crypto/evp/evp_rand.c:390
266	266	3 : View List ['ERR_new', 'ERR_set_debug', 'ERR_set_error']	266	266	do_init_module_list_lock	call site: 00000	/src/openssl/crypto/conf/conf_mod.c:103
266	266	3 : View List ['ERR_new', 'ERR_set_debug', 'ERR_set_error']	266	266	OPENSSL_sk_insert	call site: 00171	/src/openssl/crypto/stack/stack.c:273
266	266	3 : View List ['ERR_new', 'ERR_set_debug', 'ERR_set_error']	266	266	sk_reserve	call site: 00147	/src/openssl/crypto/stack/stack.c:210
46	51	6 : View List ['lh_OBJ_NAME_get_down_load', 'lh_OBJ_NAME_doall', 'CRYPTO_THREAD_lock_free', 'lh_OBJ_NAME_set_down_load', 'lh_OBJ_NAME_free', 'sk_NAME_FUNCS_pop_free']	46	51	OBJ_NAME_cleanup	call site: 00000	/src/openssl/crypto/objects/o_names.c:371
40	40	2 : View List ['ossl_strtouint64', 'ossl_strchr']	44	44	OPENSSL_cpuid_setup	call site: 00000	/src/openssl/crypto/cpuid.c:107
14	14	1 : View List ['async_deinit']	14	2924	OPENSSL_cleanup	call site: 00000	/src/openssl/crypto/init.c:431
0	621	1 : View List ['ossl_provider_store_free']	0	621	ossl_provider_store_new	call site: 00000	/src/openssl/crypto/provider_core.c:313
0	297	2 : View List ['sk_reserve', 'OPENSSL_sk_free']	0	297	OPENSSL_sk_new_reserve	call site: 00079	/src/openssl/crypto/stack/stack.c:236
0	96	1 : View List ['ossl_method_store_free']	0	96	ossl_method_store_new	call site: 00000	/src/openssl/crypto/property/property.c:250
0	87	1 : View List ['ossl_namemap_free']	0	87	ossl_namemap_new	call site: 00000	/src/openssl/crypto/core_namemap.c:537
0	28	3 : View List ['CRYPTO_free', 'CRYPTO_THREAD_lock_free', 'ossl_rcu_lock_free']	0	28	ossl_ht_new	call site: 00000	/src/openssl/crypto/hashtable/hashtable.c:217

Runtime coverage analysis

Covered functions

324

Functions that are reachable but not covered

46

Reachable functions

114

Percentage of reachable functions covered

59.65%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/hashtable.c	8
crypto/hashtable/hashtable.c	23
crypto/threads_pthread.c	20
crypto/context.c	4
crypto/initthread.c	9
crypto/stack/stack.c	12
crypto/err/err_blocks.c	4
crypto/err/err_local.h	6
crypto/bio/bio_print.c	9
include/internal/common.h	1
crypto/ctype.c	1
crypto/o_str.c	1

Fuzzer: ml-dsa

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	3	100.%
All colors	3	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
6320	6320	2 : View List ['EVP_DigestSignInit', 'EVP_DigestVerifyInit']	6320	6586	evp_md_init_internal	call site: 00000	/src/openssl/crypto/evp/digest.c:165
2719	2738	2 : View List ['CONF_modules_load', 'OSSL_LIB_CTX_get_conf_diagnostics']	2719	2762	CONF_modules_load_file_ex	call site: 00000	/src/openssl/crypto/conf/conf_mod.c:217
2246	2246	1 : View List ['EVP_PKEY_CTX_new']	22020	40164	do_sigver_init	call site: 00000	/src/openssl/crypto/evp/m_sigver.c:58
2058	2058	2 : View List ['CRYPTO_free', 'ossl_cipher_tlsunpadblock']	2058	3654	ossl_cipher_generic_block_update	call site: 00000	/src/openssl/providers/implementations/ciphers/ciphercommon.c:435
1904	2298	5 : View List ['EVP_PKEY_CTX_ctrl', 'ENGINE_init', 'ENGINE_get_digest', 'CRYPTO_zalloc', 'ENGINE_finish']	1904	3544	evp_md_init_internal	call site: 00000	/src/openssl/crypto/evp/digest.c:225
1767	4461	8 : View List ['evp_signature_fetch_from_prov', 'ossl_assert_int.7785', 'EVP_SIGNATURE_fetch', 'ERR_pop_to_mark', 'EVP_SIGNATURE_free', 'ERR_set_mark', 'ERR_clear_last_mark', 'EVP_KEYMGMT_get0_provider']	1767	16791	evp_pkey_signature_init	call site: 00000	/src/openssl/crypto/evp/signature.c:592
1759	2346	14 : View List ['CRYPTO_THREAD_unlock', 'CRYPTO_free', 'DSO_ctrl', 'DSO_load', 'DSO_free', 'DSO_bind_func', 'CRYPTO_THREAD_read_lock', 'ossl_safe_getenv', 'DSO_merge', 'CRYPTO_strdup', 'DSO_new', 'get_provider_store', 'DSO_convert_filename', 'ossl_get_modulesdir']	1767	3162	provider_init	call site: 00000	/src/openssl/crypto/provider_core.c:959
1745	2062	2 : View List ['EVP_CIPHER_fetch', 'OBJ_nid2sn']	2340	7490	evp_cipher_init_internal	call site: 00000	/src/openssl/crypto/evp/evp_enc.c:186
1745	1759	2 : View List ['EVP_CIPHER_fetch', 'ERR_pop_to_mark']	1745	5385	drbg_ctr_set_ctx_params_locked	call site: 00000	/src/openssl/providers/implementations/rands/drbg_ctr.c:783
1247	1247	2 : View List ['def_load_bio', 'BIO_free']	1247	1247	def_load	call site: 00000	/src/openssl/crypto/conf/conf_def.c:177
1149	1149	1 : View List ['EVP_PKEY_CTX_is_a']	1149	6793	evp_pkey_signature_init	call site: 00000	/src/openssl/crypto/evp/signature.c:634
1140	1457	6 : View List ['evp_pkey_meth_find_added_by_application', 'EVP_PKEY_meth_find', 'ENGINE_init', 'ENGINE_get_pkey_meth_engine', 'OBJ_nid2sn', 'ENGINE_get_pkey_meth']	1140	8074	int_ctx_new	call site: 00000	/src/openssl/crypto/evp/pmeth_lib.c:188

Runtime coverage analysis

Covered functions

1660

Functions that are reachable but not covered

0

Reachable functions

3

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/ml-dsa.c	2

Fuzzer: cms

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	293	36.6%
gold	[1:9]	5	0.62%
yellow	[10:29]	18	2.25%
greenyellow	[30:49]	12	1.5%
lawngreen	50+	472	59.0%
All colors	800	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
6320	6320	2 : View List ['EVP_DigestSignInit', 'EVP_DigestVerifyInit']	6320	6586	evp_md_init_internal	call site: 00000	/src/openssl/crypto/evp/digest.c:165
5068	5786	6 : View List ['ossl_ml_kem_key_free', 'ERR_set_debug', 'ERR_set_error', 'ERR_new', 'ossl_ml_kem_key_new', 'ossl_ml_kem_parse_public_key']	5068	5786	ossl_ml_kem_d2i_PUBKEY	call site: 00000	/src/openssl/providers/implementations/encode_decode/ml_kem_codecs.c:117
4994	5713	6 : View List ['ossl_ml_dsa_pk_decode', 'ERR_set_debug', 'ERR_new', 'ERR_set_error', 'ossl_ml_dsa_key_new', 'ossl_ml_dsa_key_free']	4994	5713	ossl_ml_dsa_d2i_PUBKEY	call site: 00000	/src/openssl/providers/implementations/encode_decode/ml_dsa_codecs.c:118
3720	3794	2 : View List ['EC_GROUP_new_from_ecpkparameters', 'EC_GROUP_free']	3720	4762	d2i_ECPKParameters	call site: 00000	/src/openssl/crypto/ec/ec_asn1.c:891
2719	2738	2 : View List ['CONF_modules_load', 'OSSL_LIB_CTX_get_conf_diagnostics']	2719	2762	CONF_modules_load_file_ex	call site: 00000	/src/openssl/crypto/conf/conf_mod.c:217
2463	2465	8 : View List ['RSA_get0_q', 'RSA_get0_iqmp', 'RSA_get_multi_prime_extra_count', 'RSA_get0_p', 'sk_BIGNUM_const_push', 'sk_RSA_PRIME_INFO_value.38562', 'RSA_get0_dmp1', 'RSA_get0_dmq1']	2463	2465	ossl_rsa_get0_all_params	call site: 00000	/src/openssl/crypto/rsa/rsa_lib.c:887
2390	3269	4 : View List ['ossl_evp_pkey_get1_ED448', 'EVP_PKEY_free', 'ossl_ecx_key_free', 'EVP_PKEY_get_id']	2390	3269	ossl_d2i_ED448_PUBKEY	call site: 00000	/src/openssl/crypto/x509/x_pubkey.c:890
2390	3269	4 : View List ['EVP_PKEY_free', 'ossl_evp_pkey_get1_X25519', 'ossl_ecx_key_free', 'EVP_PKEY_get_id']	2390	3269	ossl_d2i_X25519_PUBKEY	call site: 00000	/src/openssl/crypto/x509/x_pubkey.c:932
2390	3269	4 : View List ['EVP_PKEY_free', 'ossl_evp_pkey_get1_X448', 'ossl_ecx_key_free', 'EVP_PKEY_get_id']	2390	3269	ossl_d2i_X448_PUBKEY	call site: 00000	/src/openssl/crypto/x509/x_pubkey.c:974
2390	3267	3 : View List ['ossl_evp_pkey_get1_ED25519', 'EVP_PKEY_free', 'ossl_ecx_key_free']	2390	3267	ossl_d2i_ED25519_PUBKEY	call site: 00000	/src/openssl/crypto/x509/x_pubkey.c:849
2058	2058	2 : View List ['CRYPTO_free', 'ossl_cipher_tlsunpadblock']	2058	3654	ossl_cipher_generic_block_update	call site: 00000	/src/openssl/providers/implementations/ciphers/ciphercommon.c:435
1997	1997	1 : View List ['RAND_bytes_ex']	1997	2318	bnrand	call site: 00000	/src/openssl/crypto/bn/bn_rand.c:53

Runtime coverage analysis

Covered functions

2477

Functions that are reachable but not covered

27

Reachable functions

219

Percentage of reachable functions covered

87.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/cms.c	1
crypto/bio/bio_lib.c	8
include/internal/refcount.h	4
crypto/ex_data.c	6
crypto/context.c	4
crypto/threads_pthread.c	6
crypto/err/err_blocks.c	4
crypto/err/err_local.h	6
crypto/bio/bio_print.c	9
include/internal/common.h	1
crypto/ctype.c	1
crypto/o_str.c	2
include/internal/cryptlib.h	2
crypto/stack/stack.c	17
include/openssl/crypto.h	2
crypto/cms/cms_io.c	2
crypto/cms/cms_lib.c	6
crypto/cms/cms_asn1.c	1
crypto/asn1/a_d2i_fp.c	2
crypto/err/err_mark.c	3
crypto/asn1/asn1_lib.c	12
include/openssl/err.h	1
crypto/asn1/tasn_dec.c	13
include/openssl/asn1t.h	3
crypto/asn1/tasn_fre.c	5
crypto/asn1/a_object.c	3
crypto/asn1/tasn_utl.c	13
crypto/objects/obj_dat.c	13
crypto/bsearch.c	1
crypto/objects/obj_local.h	1
crypto/lhash/lhash.c	2
crypto/asn1/a_int.c	10
crypto/asn1/tasn_typ.c	7
crypto/asn1/tasn_new.c	9
crypto/asn1/a_type.c	1
crypto/asn1/a_bitstr.c	2
crypto/cms/cms_sd.c	3
include/openssl/cms.h	2
crypto/cms/cms_env.c	4
crypto/x509/x_x509.c	1
crypto/cms/cms_local.h	2
crypto/bio/bss_null.c	1
crypto/asn1/a_i2d_fp.c	1
crypto/asn1/tasn_enc.c	8
crypto/asn1/asn1_local.h	3

Fuzzer: asn1parse

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	517	65.1%
gold	[1:9]	8	1.00%
yellow	[10:29]	3	0.37%
greenyellow	[30:49]	2	0.25%
lawngreen	50+	263	33.1%
All colors	793	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2719	2738	2 : View List ['CONF_modules_load', 'OSSL_LIB_CTX_get_conf_diagnostics']	2726	2762	CONF_modules_load_file_ex	call site: 00000	/src/openssl/crypto/conf/conf_mod.c:217
976	1242	5 : View List ['ERR_set_debug', 'ERR_new', 'ERR_set_error', 'ERR_add_error_data', 'asn1_template_ex_d2i']	976	1242	asn1_item_embed_d2i	call site: 00363	/src/openssl/crypto/asn1/tasn_dec.c:202
877	1247	2 : View List ['def_load_bio', 'BIO_free']	877	1247	def_load	call site: 00000	/src/openssl/crypto/conf/conf_def.c:177
641	641	2 : View List ['ASN1_TYPE_set', 'ASN1_TYPE_new']	935	4524	asn1_ex_c2i	call site: 00541	/src/openssl/crypto/asn1/tasn_dec.c:845
478	478	1 : View List ['ossl_asn1_template_free']	478	478	ossl_asn1_item_embed_free	call site: 00415	/src/openssl/crypto/asn1/tasn_fre.c:48
438	880	5 : View List ['CRYPTO_free', 'CRYPTO_FREE_REF.6938', 'EVP_RAND_CTX_free', 'EVP_RAND_free', 'CRYPTO_DOWN_REF.6937']	438	880	EVP_RAND_CTX_free	call site: 00000	/src/openssl/crypto/evp/evp_rand.c:390
326	858	5 : View List ['ERR_set_debug', 'ERR_set_error', 'ERR_new', 'BUF_MEM_grow_clean', 'asn1_collect']	326	1600	asn1_d2i_ex_primitive	call site: 00503	/src/openssl/crypto/asn1/tasn_dec.c:783
318	318	1 : View List ['asn1_find_end']	318	1326	asn1_d2i_ex_primitive	call site: 00499	/src/openssl/crypto/asn1/tasn_dec.c:758
317	317	1 : View List ['OBJ_nid2sn']	323	1952	OBJ_obj2txt	call site: 00245	/src/openssl/crypto/objects/obj_dat.c:486
46	51	6 : View List ['lh_OBJ_NAME_get_down_load', 'lh_OBJ_NAME_doall', 'CRYPTO_THREAD_lock_free', 'lh_OBJ_NAME_set_down_load', 'lh_OBJ_NAME_free', 'sk_NAME_FUNCS_pop_free']	46	51	OBJ_NAME_cleanup	call site: 00000	/src/openssl/crypto/objects/o_names.c:371
40	40	2 : View List ['ossl_strtouint64', 'ossl_strchr']	44	44	OPENSSL_cpuid_setup	call site: 00000	/src/openssl/crypto/cpuid.c:107
20	37	6 : View List ['OPENSSL_LH_set_down_load', 'lh_CONF_VALUE_doall_LH_CONF_VALUE', 'OPENSSL_LH_free', 'OPENSSL_LH_doall', 'ossl_check_CONF_VALUE_lh_type', 'ossl_check_CONF_VALUE_lh_doallfunc_type']	20	37	_CONF_free_data	call site: 00000	/src/openssl/crypto/conf/conf_api.c:142

Runtime coverage analysis

Covered functions

466

Functions that are reachable but not covered

75

Reachable functions

228

Percentage of reachable functions covered

67.11%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/asn1parse.c	1
crypto/asn1/asn1_parse.c	4
crypto/bio/bio_lib.c	10
crypto/err/err_blocks.c	4
crypto/err/err_local.h	6
crypto/bio/bio_print.c	12
include/internal/common.h	1
crypto/ctype.c	1
crypto/o_str.c	2
crypto/asn1/asn1_lib.c	8
crypto/bio/bf_prefix.c	1
include/internal/refcount.h	4
crypto/ex_data.c	6
crypto/context.c	4
crypto/threads_pthread.c	6
include/internal/cryptlib.h	2
crypto/stack/stack.c	16
include/openssl/crypto.h	2
crypto/asn1/a_object.c	6
crypto/objects/obj_dat.c	16
crypto/bsearch.c	1
crypto/objects/obj_local.h	1
crypto/lhash/lhash.c	2
crypto/bn/bn_word.c	3
crypto/bn/bn_lib.c	18
crypto/bn/bn_local.h	1
crypto/bn/bn_shift.c	2
crypto/bn/bn_conv.c	1
include/internal/constant_time.h	4
crypto/bn/asm/x86_64-gcc.c	1
crypto/bio/bio_dump.c	5
crypto/asn1/tasn_typ.c	15
crypto/asn1/tasn_dec.c	14
include/openssl/asn1t.h	3
crypto/asn1/tasn_fre.c	5
crypto/asn1/tasn_utl.c	9
crypto/asn1/a_int.c	8
crypto/asn1/tasn_new.c	9
crypto/asn1/a_type.c	1
crypto/asn1/a_bitstr.c	1

Fuzzer: ct

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	595	68.1%
gold	[1:9]	10	1.14%
yellow	[10:29]	12	1.37%
greenyellow	[30:49]	5	0.57%
lawngreen	50+	251	28.7%
All colors	873	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
976	1242	5 : View List ['ERR_set_debug', 'ERR_new', 'ERR_set_error', 'ERR_add_error_data', 'asn1_template_ex_d2i']	976	1242	asn1_item_embed_d2i	call site: 00083	/src/openssl/crypto/asn1/tasn_dec.c:202
641	641	2 : View List ['ASN1_TYPE_set', 'ASN1_TYPE_new']	2113	4524	asn1_ex_c2i	call site: 00300	/src/openssl/crypto/asn1/tasn_dec.c:845
584	584	1 : View List ['asn1_template_ex_i2d']	584	584	ASN1_item_ex_i2d	call site: 00790	/src/openssl/crypto/asn1/tasn_enc.c:101
478	478	1 : View List ['ossl_asn1_template_free']	478	478	ossl_asn1_item_embed_free	call site: 00145	/src/openssl/crypto/asn1/tasn_fre.c:48
438	880	5 : View List ['CRYPTO_free', 'CRYPTO_FREE_REF.6938', 'EVP_RAND_CTX_free', 'EVP_RAND_free', 'CRYPTO_DOWN_REF.6937']	438	880	EVP_RAND_CTX_free	call site: 00000	/src/openssl/crypto/evp/evp_rand.c:390
318	318	1 : View List ['asn1_find_end']	318	1326	asn1_d2i_ex_primitive	call site: 00258	/src/openssl/crypto/asn1/tasn_dec.c:758
46	51	6 : View List ['lh_OBJ_NAME_get_down_load', 'lh_OBJ_NAME_doall', 'CRYPTO_THREAD_lock_free', 'lh_OBJ_NAME_set_down_load', 'lh_OBJ_NAME_free', 'sk_NAME_FUNCS_pop_free']	46	51	OBJ_NAME_cleanup	call site: 00000	/src/openssl/crypto/objects/o_names.c:371
40	40	2 : View List ['ossl_strtouint64', 'ossl_strchr']	44	44	OPENSSL_cpuid_setup	call site: 00000	/src/openssl/crypto/cpuid.c:107
14	14	1 : View List ['CTLOG_STORE_get0_log_by_id']	16	2065	SCT_print	call site: 00656	/src/openssl/crypto/ct/ct_prn.c:75
14	14	1 : View List ['async_deinit']	14	2924	OPENSSL_cleanup	call site: 00000	/src/openssl/crypto/init.c:431
14	14	2 : View List ['qsort', 'CRYPTO_get_ex_data']	14	17	CRYPTO_free_ex_data	call site: 00644	/src/openssl/crypto/ex_data.c:398
6	6	2 : View List ['sk_EX_CALLBACK_value', 'CRYPTO_malloc']	20	28	CRYPTO_free_ex_data	call site: 00642	/src/openssl/crypto/ex_data.c:385

Runtime coverage analysis

Covered functions

421

Functions that are reachable but not covered

107

Reachable functions

251

Percentage of reachable functions covered

57.37%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/ct.c	1
crypto/ct/ct_oct.c	8
crypto/asn1/tasn_typ.c	13
crypto/asn1/tasn_dec.c	14
crypto/err/err_blocks.c	4
crypto/err/err_local.h	6
crypto/bio/bio_print.c	12
include/internal/common.h	1
crypto/ctype.c	2
crypto/o_str.c	2
crypto/asn1/asn1_lib.c	15
crypto/stack/stack.c	18
include/openssl/asn1t.h	3
crypto/asn1/tasn_fre.c	5
crypto/asn1/a_object.c	3
crypto/asn1/tasn_utl.c	13
include/internal/refcount.h	4
crypto/threads_pthread.c	6
crypto/objects/obj_dat.c	14
crypto/bsearch.c	1
crypto/objects/obj_local.h	1
crypto/lhash/lhash.c	2
crypto/asn1/a_int.c	10
crypto/asn1/tasn_new.c	9
crypto/asn1/a_type.c	1
crypto/asn1/a_bitstr.c	2
include/openssl/ct.h	5
crypto/ct/ct_sct.c	7
crypto/bio/bss_null.c	1
crypto/bio/bio_lib.c	6
crypto/ex_data.c	6
crypto/context.c	4
include/internal/cryptlib.h	2
include/openssl/crypto.h	2
crypto/ct/ct_prn.c	4
crypto/ct/ct_log.c	2
crypto/bio/bio_dump.c	1
crypto/asn1/a_gentm.c	5
crypto/o_time.c	5
crypto/asn1/a_time.c	8
crypto/asn1/tasn_enc.c	8
crypto/asn1/asn1_local.h	3

Fuzzer: quic-client

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3886	57.7%
gold	[1:9]	344	5.11%
yellow	[10:29]	105	1.55%
greenyellow	[30:49]	39	0.57%
lawngreen	50+	2357	35.0%
All colors	6731	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
9084	9095	6 : View List ['X509_chain_check_suiteb', 'internal_verify', 'X509v3_asid_validate_path', 'verify_cb_cert', 'X509v3_addr_validate_path', 'check_name_constraints']	9084	9095	verify_chain	call site: 00000	/src/openssl/crypto/x509/x509_vfy.c:238
8618	8618	2 : View List ['memcmp', 'X509_check_purpose']	8618	8618	X509_cmp	call site: 00000	/src/openssl/crypto/x509/x509_cmp.c:159
7559	7559	1 : View List ['tls_post_process_server_rpk']	7559	7559	tls_post_process_server_certificate	call site: 00000	/src/openssl/ssl/statem/statem_clnt.c:2099
6320	6320	2 : View List ['EVP_DigestSignInit', 'EVP_DigestVerifyInit']	6320	6586	evp_md_init_internal	call site: 03592	/src/openssl/crypto/evp/digest.c:165
5383	10415	5 : View List ['OSSL_STACK_OF_X509_free', 'get0_best_issuer_sk', 'X509_up_ref', 'ossl_x509_check_cert_time', 'X509_STORE_CTX_get1_certs']	5383	10907	X509_STORE_CTX_get1_issuer	call site: 00000	/src/openssl/crypto/x509/x509_vfy.c:444
5370	6579	2 : View List ['ssl3_do_write', 'dtls1_do_write']	5370	6579	statem_do_write	call site: 00000	/src/openssl/ssl/statem/statem.c:755
5284	5284	1 : View List ['ssl_validate_ct']	5284	5284	tls_process_initial_server_flight	call site: 00000	/src/openssl/ssl/statem/statem_clnt.c:2985
5249	5249	1 : View List ['SSL_set_accept_state']	5249	16951	ossl_quic_tls_tick	call site: 06052	/src/openssl/ssl/quic/quic_tls.c:809
4994	5713	6 : View List ['ossl_ml_dsa_pk_decode', 'ERR_set_debug', 'ERR_new', 'ERR_set_error', 'ossl_ml_dsa_key_new', 'ossl_ml_dsa_key_free']	4994	5713	ossl_ml_dsa_d2i_PUBKEY	call site: 00000	/src/openssl/providers/implementations/encode_decode/ml_dsa_codecs.c:118
4332	4332	1 : View List ['d2i_ECParameters']	4332	5144	ossl_ec_key_param_from_x509_algor	call site: 00000	/src/openssl/crypto/ec/ec_backend.c:774
4264	4338	3 : View List ['EC_GROUP_get_curve_name', 'EC_GROUP_free', 'd2i_ECPKParameters']	4264	4338	ossl_x509_algor_is_sm2	call site: 00000	/src/openssl/crypto/ec/ec_backend.c:741
3975	3975	4 : View List ['tls1_get_group_id', 'tls1_check_group_id', 'tls1_check_pkey_comp', 'ssl_get_EC_curve_nid']	3975	11396	tls12_check_peer_sigalg	call site: 00000	/src/openssl/ssl/t1_lib.c:2756

Runtime coverage analysis

Covered functions

4225

Functions that are reachable but not covered

636

Reachable functions

2040

Percentage of reachable functions covered

68.82%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/quic-client.c	2
ssl/quic/quic_method.c	3
ssl/ssl_lib.c	54
crypto/err/err_blocks.c	4
crypto/err/err_local.h	6
crypto/bio/bio_print.c	12
include/internal/common.h	3
crypto/ctype.c	3
crypto/o_str.c	12
ssl/ssl_init.c	3
ssl/ssl_ciph.c	20
crypto/context.c	12
crypto/threads_pthread.c	14
ssl/s3_lib.c	3
ssl/ssl_cert.c	10
crypto/ex_data.c	9
include/internal/cryptlib.h	6
crypto/stack/stack.c	28
include/internal/refcount.h	5
ssl/ssl_local.h	13
crypto/lhash/lhash.c	19
crypto/x509/x509_lu.c	7
include/openssl/x509_vfy.h	5
crypto/x509/x509_cmp.c	6
crypto/x509/x_name.c	3
crypto/asn1/tasn_enc.c	8
crypto/asn1/asn1_local.h	3
crypto/asn1/a_bitstr.c	2
crypto/asn1/a_int.c	10
crypto/asn1/asn1_lib.c	14
crypto/asn1/tasn_utl.c	13
crypto/objects/obj_dat.c	33
crypto/bsearch.c	1
crypto/objects/obj_local.h	17
crypto/x509/x509_vpm.c	3
include/openssl/crypto.h	3
include/openssl/asn1.h	5
crypto/asn1/a_object.c	6
include/openssl/safestack.h	4
crypto/ct/ct_log.c	3
include/openssl/ct.h	2
crypto/evp/p_lib.c	23
crypto/evp/keymgmt_lib.c	15
include/crypto/evp.h	7
crypto/evp/keymgmt_meth.c	28
crypto/provider_core.c	31
crypto/initthread.c	13
crypto/dso/dso_lib.c	9
crypto/provider_local.h	2
crypto/provider_child.c	2
crypto/asn1/ameth_lib.c	10
include/crypto/asn1.h	3
crypto/engine/tb_asnmth.c	6
crypto/engine/eng_table.c	8
crypto/err/err_mark.c	4
crypto/engine/eng_local.h	8
crypto/engine/eng_init.c	4
crypto/engine/eng_lib.c	4
crypto/engine/tb_pkmeth.c	4
crypto/evp/pmeth_lib.c	30
crypto/engine/eng_list.c	1
include/openssl/x509.h	6
crypto/x509/x_attrib.c	2
crypto/asn1/tasn_fre.c	5
include/openssl/asn1t.h	3
ssl/tls_depr.c	3
crypto/engine/tb_cipher.c	3
crypto/evp/evp_enc.c	33
crypto/evp/evp_fetch.c	10
crypto/core_namemap.c	16
crypto/objects/o_names.c	10
crypto/evp/evp_lib.c	25
crypto/bn/bn_word.c	4
crypto/bn/bn_lib.c	19
crypto/bn/bn_local.h	1
crypto/bn/bn_shift.c	2
crypto/bn/bn_conv.c	1
include/internal/constant_time.h	4
crypto/bn/asm/x86_64-gcc.c	2
include/internal/hashtable.h	1
crypto/hashtable/hashtable.c	11
crypto/property/property.c	38
crypto/sparse_array.c	8
crypto/core_fetch.c	7
crypto/core_algorithm.c	4
crypto/dso/dso_dlfcn.c	1
crypto/getenv.c	1
crypto/defaults.c	4
include/openssl/core_dispatch.h	142
include/openssl/err.h	2
crypto/rand/rand_lib.c	14
crypto/provider.c	4
crypto/encode_decode/decoder_pkey.c	24
crypto/encode_decode/decoder_meth.c	20
crypto/encode_decode/encoder_local.h	6
crypto/encode_decode/decoder_lib.c	30
crypto/passphrase.c	9
crypto/params.c	31
crypto/evp/evp_utils.c	6
crypto/engine/tb_digest.c	3
crypto/evp/digest.c	22
crypto/evp/signature.c	13
crypto/evp/exchange.c	8
ssl/t1_lib.c	15
crypto/conf/conf_mod.c	1
ssl/statem/statem_lib.c	1
crypto/objects/obj_lib.c	1
crypto/objects/obj_xref.c	10
crypto/objects/obj_xref.h	5
crypto/evp/kem.c	2
crypto/evp/asymcipher.c	2
include/openssl/ssl.h	5
crypto/bio/bio_lib.c	22
providers/implementations/rands/seeding/rand_unix.c	1
crypto/engine/tb_rand.c	2
crypto/rand/rand_meth.c	1
crypto/evp/evp_rand.c	20
ssl/tls_srp.c	2
ssl/quic/quic_impl.c	88
crypto/hashtable/hashfunc.c	1
crypto/thread/arch/thread_posix.c	11
ssl/ssl_mcnf.c	2
crypto/conf/conf_ssl.c	3
ssl/ssl_conf.c	14
ssl/quic/quic_obj.c	6
ssl/ssl_rsa.c	5
crypto/bio/bss_file.c	2
crypto/pem/pem_pkey.c	4
crypto/bio/bf_readbuff.c	1
crypto/bio/ossl_core_bio.c	3
crypto/ui/ui_util.c	10
crypto/ui/ui_lib.c	29
crypto/ui/ui_openssl.c	1
crypto/ui/ui_null.c	1
include/openssl/ui.h	4
crypto/err/err_prn.c	1
include/internal/to_hex.h	1
crypto/pem/pem_lib.c	15
crypto/evp/encode.c	7
crypto/evp/names.c	6
crypto/evp/evp_key.c	3
crypto/evp/legacy_md5.c	1
crypto/evp/m_sigver.c	6
crypto/evp/ctrl_params_translate.c	8
crypto/asn1/p8_pkey.c	4
crypto/asn1/tasn_dec.c	14
crypto/asn1/tasn_typ.c	9
crypto/asn1/tasn_new.c	9
crypto/asn1/a_type.c	1
crypto/evp/evp_pkey.c	1
crypto/asn1/x_sig.c	4
crypto/pkcs12/p12_p8d.c	2
crypto/pkcs12/p12_decr.c	2
crypto/evp/evp_pbe.c	5
crypto/evp/evp_local.h	3
crypto/asn1/d2i_pr.c	4
crypto/x509/x_pubkey.c	8
crypto/x509/x_all.c	1
crypto/asn1/a_d2i_fp.c	1
ssl/ssl_sess.c	9
include/internal/time.h	19
crypto/x509/x_x509.c	2
crypto/x509/t_x509.c	1
crypto/x509/x_crl.c	2
ssl/statem/extensions_cust.c	4
ssl/quic/quic_channel.c	32
ssl/quic/quic_port.c	17
crypto/err/err_save.c	4
ssl/quic/quic_obj_local.h	4
ssl/quic/quic_engine.c	9
crypto/bio/bio_addr.c	9
ssl/quic/quic_txp.c	5
ssl/quic/quic_record_tx.c	3
ssl/quic/quic_record_util.c	11
crypto/evp/kdf_meth.c	7
crypto/evp/kdf_lib.c	3
ssl/tls13_enc.c	2
ssl/quic/quic_record_rx.c	7
ssl/quic/quic_record_shared.c	7
ssl/quic/quic_wire_pkt.c	2
include/internal/quic_demux.h	3
ssl/quic/quic_wire.c	5
include/internal/quic_vlint.h	1
ssl/quic/quic_fc.c	19
ssl/quic/quic_tls.c	8
ssl/quic/qlog.c	35
ssl/quic/json_enc.c	44
crypto/o_fopen.c	1
crypto/cversion.c	1
crypto/info.c	3
ssl/quic/qlog_event_helpers.c	5
ssl/statem/statem.c	8
crypto/bio/bss_null.c	1
ssl/quic/quic_stream_map.c	23
ssl/quic/quic_reactor.c	18
ssl/rio/rio_notifier.c	2
include/internal/rio_notifier.h	1
crypto/time.c	1
crypto/bio/bss_fd.c	1
ssl/quic/quic_statm.c	1
include/internal/quic_stream_map.h	8
ssl/quic/quic_rstream.c	3
ssl/quic/quic_sstream.c	12
include/internal/ring_buf.h	7
ssl/quic/uint_set.c	8
include/internal/uint_set.h	12
ssl/quic/quic_sf_list.c	3
ssl/quic/quic_demux.c	2
ssl/record/rec_layer_s3.c	10
ssl/s3_msg.c	1
ssl/t1_enc.c	1
ssl/record/rec_layer_d1.c	2
ssl/pqueue.c	3
crypto/bio/bss_dgram_pair.c	1
crypto/async/async.c	13
crypto/async/async_wait.c	2
crypto/async/async_local.h	4
crypto/async/arch/async_posix.c	3
crypto/async/arch/async_posix.h	1
ssl/quic/quic_ackm.c	1
ssl/quic/quic_thread_assist.c	2
crypto/thread/arch.c	1

Fuzzer: acert

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	434	34.0%
gold	[1:9]	62	4.86%
yellow	[10:29]	50	3.92%
greenyellow	[30:49]	8	0.62%
lawngreen	50+	720	56.5%
All colors	1274	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2719	2738	2 : View List ['CONF_modules_load', 'OSSL_LIB_CTX_get_conf_diagnostics']	2726	2762	CONF_modules_load_file_ex	call site: 00000	/src/openssl/crypto/conf/conf_mod.c:217
1000	2222	2 : View List ['i2a_ASN1_OBJECT', 'ossl_x509_algor_mgf1_decode']	1000	6202	rsa_pss_param_print	call site: 00000	/src/openssl/crypto/rsa/rsa_ameth.c:251
1000	1484	2 : View List ['ossl_x509_algor_mgf1_decode', 'RSA_PSS_PARAMS_free']	1000	1484	ossl_rsa_pss_decode	call site: 00000	/src/openssl/crypto/rsa/rsa_backend.c:577
877	1247	2 : View List ['def_load_bio', 'BIO_free']	877	1247	def_load	call site: 00000	/src/openssl/crypto/conf/conf_def.c:177
737	737	2 : View List ['ENGINE_get_pkey_asn1_meth_engine', 'ENGINE_get_pkey_asn1_meth']	737	737	EVP_PKEY_asn1_find	call site: 01208	/src/openssl/crypto/asn1/ameth_lib.c:91
672	1713	2 : View List ['x509_name_encode', 'x509_name_canon']	672	1713	x509_name_ex_i2d	call site: 00000	/src/openssl/crypto/x509/x_name.c:220
438	880	5 : View List ['CRYPTO_free', 'CRYPTO_FREE_REF.6938', 'EVP_RAND_CTX_free', 'EVP_RAND_free', 'CRYPTO_DOWN_REF.6937']	438	880	EVP_RAND_CTX_free	call site: 00000	/src/openssl/crypto/evp/evp_rand.c:390
323	323	1 : View List ['i2r_OSSL_DAY_TIME']	323	323	i2r_OSSL_DAY_TIME_BAND	call site: 00000	/src/openssl/crypto/x509/v3_timespec.c:188
266	270	2 : View List ['sk_const_ASN1_VALUE_set', 'sk_const_ASN1_VALUE_num']	266	270	asn1_set_seq_out	call site: 00859	/src/openssl/crypto/asn1/tasn_enc.c:451
46	51	6 : View List ['lh_OBJ_NAME_get_down_load', 'lh_OBJ_NAME_doall', 'CRYPTO_THREAD_lock_free', 'lh_OBJ_NAME_set_down_load', 'lh_OBJ_NAME_free', 'sk_NAME_FUNCS_pop_free']	46	51	OBJ_NAME_cleanup	call site: 00000	/src/openssl/crypto/objects/o_names.c:371
43	43	2 : View List ['sk_EVP_PKEY_ASN1_METHOD_find', 'sk_EVP_PKEY_ASN1_METHOD_value']	43	63	pkey_asn1_find	call site: 01208	/src/openssl/crypto/asn1/ameth_lib.c:63
43	43	2 : View List ['sk_nid_triple_find', 'sk_nid_triple_value']	43	48	ossl_obj_find_sigid_algs	call site: 01201	/src/openssl/crypto/objects/obj_xref.c:85

Runtime coverage analysis

Covered functions

901

Functions that are reachable but not covered

66

Reachable functions

395

Percentage of reachable functions covered

83.29%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/acert.c	1
crypto/x509/x509_acert.c	19
crypto/asn1/tasn_dec.c	14
crypto/err/err_blocks.c	4
crypto/err/err_local.h	6
crypto/bio/bio_print.c	12
include/internal/common.h	1
crypto/ctype.c	3
crypto/o_str.c	4
crypto/asn1/asn1_lib.c	14
crypto/stack/stack.c	21
include/openssl/asn1t.h	3
crypto/asn1/tasn_fre.c	5
crypto/asn1/a_object.c	6
crypto/asn1/tasn_utl.c	13
include/internal/refcount.h	4
crypto/threads_pthread.c	6
crypto/objects/obj_dat.c	16
crypto/bsearch.c	1
crypto/objects/obj_local.h	1
crypto/lhash/lhash.c	4
crypto/asn1/a_int.c	10
crypto/asn1/tasn_typ.c	16
crypto/asn1/tasn_new.c	9
crypto/asn1/a_type.c	1
crypto/asn1/a_bitstr.c	2
crypto/bio/bss_null.c	1
crypto/bio/bio_lib.c	11
crypto/ex_data.c	6
crypto/context.c	4
include/internal/cryptlib.h	2
include/openssl/crypto.h	2
crypto/x509/t_acert.c	3
crypto/asn1/f_int.c	1
include/internal/to_hex.h	1
include/openssl/x509v3.h	4
crypto/x509/v3_san.c	1
crypto/asn1/a_print.c	1
crypto/asn1/a_strex.c	9
crypto/x509/x_name.c	1
crypto/x509/x509_obj.c	1
include/openssl/x509.h	3
crypto/bn/bn_word.c	3
crypto/bn/bn_lib.c	18
crypto/bn/bn_local.h	1
crypto/bn/bn_shift.c	2
crypto/bn/bn_conv.c	1
include/internal/constant_time.h	4
crypto/bn/asm/x86_64-gcc.c	1
crypto/x509/x509name.c	5
crypto/asn1/asn1_parse.c	4
crypto/asn1/tasn_enc.c	8
crypto/asn1/asn1_local.h	3
crypto/asn1/a_utf8.c	2
include/internal/unicode.h	1
crypto/x509/v3_utl.c	2
crypto/bio/bio_dump.c	5
crypto/x509/t_x509.c	2
crypto/asn1/a_gentm.c	1
crypto/asn1/a_time.c	6
crypto/o_time.c	4
crypto/x509/x509_att.c	5
include/openssl/asn1.h	1
crypto/bio/bf_prefix.c	1
crypto/x509/x509_v3.c	3
crypto/x509/v3_prn.c	3
crypto/x509/v3_lib.c	5
include/openssl/conf.h	3
crypto/objects/obj_xref.c	8
crypto/objects/obj_xref.h	2
crypto/asn1/ameth_lib.c	6
include/crypto/asn1.h	2
crypto/engine/tb_asnmth.c	4
crypto/engine/eng_table.c	4
crypto/err/err_mark.c	2
crypto/engine/eng_local.h	7
crypto/engine/eng_init.c	2
crypto/engine/eng_lib.c	1
crypto/engine/tb_pkmeth.c	1
crypto/evp/pmeth_lib.c	1
crypto/engine/eng_list.c	1

Fuzzer: asn1

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2286	39.2%
gold	[1:9]	322	5.53%
yellow	[10:29]	130	2.23%
greenyellow	[30:49]	94	1.61%
lawngreen	50+	2988	51.3%
All colors	5820	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
9043	11232	9 : View List ['BN_is_bit_set', 'ossl_ffc_generate_private_key', 'ossl_ifc_ffc_compute_security_bits', 'DH_get_nid', 'BN_num_bits', 'BN_clear_bit', 'BN_is_word', 'ossl_ffc_params_simple_validate', 'BN_priv_rand_ex']	9043	12400	generate_key	call site: 00000	/src/openssl/crypto/dh/dh_key.c:311
6320	6320	2 : View List ['EVP_DigestSignInit', 'EVP_DigestVerifyInit']	6320	6586	evp_md_init_internal	call site: 00000	/src/openssl/crypto/evp/digest.c:165
5068	5786	6 : View List ['ossl_ml_kem_key_free', 'ERR_set_debug', 'ERR_set_error', 'ERR_new', 'ossl_ml_kem_key_new', 'ossl_ml_kem_parse_public_key']	5068	5786	ossl_ml_kem_d2i_PUBKEY	call site: 00000	/src/openssl/providers/implementations/encode_decode/ml_kem_codecs.c:117
4994	5713	6 : View List ['ossl_ml_dsa_pk_decode', 'ERR_set_debug', 'ERR_new', 'ERR_set_error', 'ossl_ml_dsa_key_new', 'ossl_ml_dsa_key_free']	4994	5713	ossl_ml_dsa_d2i_PUBKEY	call site: 00000	/src/openssl/providers/implementations/encode_decode/ml_dsa_codecs.c:118
4067	4067	1 : View List ['key_to_epki_der_priv_bio']	4067	4067	key_to_pki_der_priv_bio	call site: 00000	/src/openssl/providers/implementations/encode_decode/encode_key2any.c:262
4050	7032	15 : View List ['BN_CTX_start', 'BN_is_bit_set', 'BN_set_word', 'BN_CTX_get', 'BN_CTX_end', 'BN_mod_mul_reciprocal', 'BN_abs_is_word', 'BN_num_bits', 'BN_RECP_CTX_free', 'BN_copy', 'BN_RECP_CTX_set', 'BN_zero_ex', 'BN_is_zero', 'BN_nnmod', 'BN_RECP_CTX_init']	4050	7032	BN_mod_exp_recp	call site: 02698	/src/openssl/crypto/bn/bn_exp.c:179
2719	2738	2 : View List ['CONF_modules_load', 'OSSL_LIB_CTX_get_conf_diagnostics']	2719	2762	CONF_modules_load_file_ex	call site: 00000	/src/openssl/crypto/conf/conf_mod.c:217
2654	2654	1 : View List ['i2d_PUBKEY']	2654	3284	i2d_SSL_SESSION	call site: 05794	/src/openssl/ssl/ssl_asn1.c:179
1997	1997	1 : View List ['RAND_bytes_ex']	1997	2318	bnrand	call site: 03516	/src/openssl/crypto/bn/bn_rand.c:53
1904	2298	5 : View List ['EVP_PKEY_CTX_ctrl', 'ENGINE_init', 'ENGINE_get_digest', 'CRYPTO_zalloc', 'ENGINE_finish']	1904	3544	evp_md_init_internal	call site: 00000	/src/openssl/crypto/evp/digest.c:225
1808	1808	4 : View List ['OPENSSL_load_u16_be', 'ossl_prov_ml_dsa_new', 'ossl_ml_dsa_set_prekey', 'OPENSSL_load_u32_be']	1808	3011	ossl_ml_dsa_d2i_PKCS8	call site: 00000	/src/openssl/providers/implementations/encode_decode/ml_dsa_codecs.c:183
1767	1767	5 : View List ['OPENSSL_load_u32_be.18987', 'ossl_ml_kem_set_seed', 'CRYPTO_malloc', 'ossl_prov_ml_kem_new', 'OPENSSL_load_u16_be.18986']	1767	3501	ossl_ml_kem_d2i_PKCS8	call site: 00000	/src/openssl/providers/implementations/encode_decode/ml_kem_codecs.c:180

Runtime coverage analysis

Covered functions

3343

Functions that are reachable but not covered

300

Reachable functions

1527

Percentage of reachable functions covered

80.35%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/asn1.c	1
crypto/asn1/tasn_dec.c	14
crypto/err/err_blocks.c	4
crypto/err/err_local.h	6
crypto/bio/bio_print.c	12
include/internal/common.h	1
crypto/ctype.c	3
crypto/o_str.c	11
crypto/asn1/asn1_lib.c	14
crypto/stack/stack.c	25
include/openssl/asn1t.h	3
crypto/asn1/tasn_fre.c	5
crypto/asn1/a_object.c	6
crypto/asn1/tasn_utl.c	13
include/internal/refcount.h	4
crypto/threads_pthread.c	14
crypto/objects/obj_dat.c	26
crypto/bsearch.c	1
crypto/objects/obj_local.h	9
crypto/lhash/lhash.c	17
crypto/asn1/a_int.c	18
crypto/asn1/tasn_typ.c	21
crypto/asn1/tasn_new.c	9
crypto/asn1/a_type.c	1
crypto/asn1/a_bitstr.c	4
crypto/bio/bss_null.c	1
crypto/bio/bio_lib.c	12
crypto/ex_data.c	9
crypto/context.c	9
include/internal/cryptlib.h	6
include/openssl/crypto.h	3
crypto/asn1/tasn_prn.c	9
crypto/asn1/asn1_local.h	3
crypto/asn1/asn1_parse.c	4
crypto/x509/v3_utl.c	7
crypto/bn/bn_lib.c	42
include/internal/constant_time.h	11
crypto/bn/bn_conv.c	2
crypto/bn/bn_word.c	4
crypto/bn/bn_shift.c	6
crypto/bn/asm/x86_64-gcc.c	10
include/internal/to_hex.h	1
crypto/asn1/a_utctm.c	1
crypto/asn1/a_time.c	6
crypto/o_time.c	4
crypto/asn1/a_gentm.c	1
crypto/bn/bn_local.h	1
crypto/bio/bio_dump.c	5
crypto/bio/bf_prefix.c	1
crypto/asn1/a_strex.c	7
crypto/asn1/tasn_enc.c	8
crypto/asn1/a_utf8.c	2
include/internal/unicode.h	1
crypto/ts/ts_asn1.c	24
crypto/ts/ts_req_print.c	1
crypto/ts/ts_req_utils.c	2
crypto/ts/ts_lib.c	5
crypto/x509/x509_v3.c	5
include/openssl/x509.h	6
crypto/x509/v3_prn.c	3
crypto/x509/v3_lib.c	5
include/openssl/x509v3.h	3
include/openssl/conf.h	4
crypto/asn1/a_print.c	1
crypto/ts/ts_rsp_print.c	5
include/openssl/asn1.h	4
crypto/x509/v3_san.c	1
crypto/x509/x509_obj.c	1
crypto/ess/ess_asn1.c	20
crypto/dh/dh_asn1.c	8
crypto/dh/dh_lib.c	6
crypto/engine/eng_init.c	4
crypto/engine/eng_lib.c	4
crypto/engine/tb_pkmeth.c	1
crypto/evp/pmeth_lib.c	1
crypto/engine/tb_asnmth.c	6
crypto/asn1/ameth_lib.c	10
crypto/engine/eng_list.c	1
crypto/ffc/ffc_params.c	8
crypto/dh/dh_key.c	1
crypto/engine/tb_dh.c	2
crypto/engine/eng_table.c	8
crypto/err/err_mark.c	3
crypto/engine/eng_local.h	8
crypto/dh/dh_group_params.c	1
crypto/ffc/ffc_dh.c	4
crypto/dsa/dsa_sign.c	4
crypto/asn1_dsa.c	6
include/internal/packet.h	14
crypto/dsa/dsa_asn1.c	9
crypto/dsa/dsa_lib.c	1
crypto/rsa/rsa_asn1.c	5
crypto/rsa/rsa_lib.c	1
crypto/rsa/rsa_local.h	1
crypto/rsa/rsa_mp.c	2
crypto/bn/bn_blind.c	1
crypto/ec/ec_asn1.c	33
crypto/ec/ec_curve.c	6
crypto/ec/ec_lib.c	38
crypto/bn/bn_ctx.c	15
crypto/ec/ec_cvt.c	2
crypto/ec/ecp_mont.c	1
crypto/ec/ecp_nistz256.c	2
crypto/ec/ecp_nistp224.c	2
crypto/ec/ecp_nistp256.c	2
crypto/ec/ecp_nistp384.c	2
crypto/ec/ecp_nistp521.c	2
crypto/ec/ec_mult.c	2
crypto/bn/bn_mont.c	11
crypto/ec/ec2_smpl.c	1
crypto/ec/ec_local.h	1
crypto/bn/bn_add.c	4
crypto/bn/bn_div.c	3
crypto/bn/bn_gcd.c	3
crypto/bn/bn_mod.c	7
crypto/bn/bn_mul.c	6
crypto/ec/ec_oct.c	4
crypto/ec/ecp_oct.c	3
crypto/bn/bn_sqr.c	4
crypto/bn/bn_sqrt.c	1
crypto/bn/bn_exp.c	9
crypto/bn/rsaz_exp.c	2
crypto/bn/rsaz_exp.h	2
crypto/bn/bn_recp.c	6
crypto/bn/bn_rand.c	2
crypto/rand/rand_lib.c	14
providers/implementations/rands/seeding/rand_unix.c	1
crypto/engine/tb_rand.c	2
crypto/rand/rand_meth.c	1
crypto/provider_core.c	30
crypto/evp/evp_rand.c	20
crypto/evp/evp_fetch.c	9
crypto/core_namemap.c	16
crypto/objects/o_names.c	10
crypto/evp/evp_lib.c	8
include/crypto/asn1.h	3
include/internal/hashtable.h	1
crypto/hashtable/hashtable.c	11
include/openssl/safestack.h	7
crypto/property/property.c	38
crypto/sparse_array.c	8
crypto/core_fetch.c	7
crypto/core_algorithm.c	4
crypto/initthread.c	13
crypto/dso/dso_lib.c	9
crypto/provider_local.h	2
crypto/provider_child.c	2
crypto/dso/dso_dlfcn.c	1
crypto/getenv.c	1
crypto/defaults.c	1
include/openssl/core_dispatch.h	74
include/openssl/err.h	2
crypto/provider.c	2
crypto/encode_decode/decoder_pkey.c	23
crypto/encode_decode/decoder_meth.c	20
crypto/encode_decode/encoder_local.h	11
crypto/encode_decode/decoder_lib.c	30
crypto/passphrase.c	7
crypto/params.c	15
crypto/bn/bn_kron.c	1
crypto/ec/ec2_oct.c	3
crypto/bn/bn_gf2m.c	7
crypto/ec/eck_prn.c	2
crypto/evp/ec_support.c	1
crypto/asn1/t_pkey.c	2
crypto/bn/bn_intern.c	1
crypto/asn1/a_octet.c	1
crypto/ec/ec_key.c	12
crypto/ec/ec_kmeth.c	2
crypto/engine/tb_eckey.c	2
crypto/ec/ec_ameth.c	3
crypto/asn1/d2i_pr.c	5
crypto/evp/p_lib.c	18
crypto/asn1/p8_pkey.c	6
crypto/evp/keymgmt_meth.c	21
crypto/evp/keymgmt_lib.c	7
include/crypto/evp.h	1
crypto/x509/x_attrib.c	2
crypto/bio/bf_readbuff.c	1
crypto/bio/ossl_core_bio.c	3
crypto/ui/ui_util.c	10
crypto/ui/ui_lib.c	29
crypto/ui/ui_openssl.c	1
crypto/ui/ui_null.c	1
include/openssl/ui.h	4
crypto/err/err_prn.c	1
crypto/evp/evp_pkey.c	2
crypto/encode_decode/encoder_pkey.c	7
crypto/encode_decode/encoder_meth.c	17
crypto/encode_decode/encoder_lib.c	19
crypto/asn1/i2d_evp.c	3
ssl/ssl_asn1.c	10
ssl/ssl_sess.c	3
ssl/ssl_init.c	3
ssl/ssl_ciph.c	5
ssl/s3_lib.c	3
include/internal/time.h	10
crypto/time.c	1
ssl/ssl_lib.c	9
crypto/x509/x_x509.c	2
crypto/x509/x_pubkey.c	11
crypto/x509/t_x509.c	1
ssl/ssl_txt.c	1
include/openssl/comp.h	3
crypto/evp/evp_enc.c	11
crypto/evp/evp_utils.c	2
crypto/evp/digest.c	2
ssl/tls_depr.c	1
crypto/engine/tb_cipher.c	3
crypto/x509/x509_txt.c	1

Fuzzer: quic-rcidm

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	61	28.9%
gold	[1:9]	15	7.10%
yellow	[10:29]	3	1.42%
greenyellow	[30:49]	1	0.47%
lawngreen	50+	131	62.0%
All colors	211	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2719	2738	2 : View List ['CONF_modules_load', 'OSSL_LIB_CTX_get_conf_diagnostics']	2726	2762	CONF_modules_load_file_ex	call site: 00000	/src/openssl/crypto/conf/conf_mod.c:217
2037	2346	14 : View List ['CRYPTO_THREAD_unlock', 'CRYPTO_free', 'DSO_ctrl', 'DSO_load', 'DSO_free', 'DSO_bind_func', 'CRYPTO_THREAD_read_lock', 'ossl_safe_getenv', 'DSO_merge', 'CRYPTO_strdup', 'DSO_new', 'get_provider_store', 'DSO_convert_filename', 'ossl_get_modulesdir']	2051	3162	provider_init	call site: 00000	/src/openssl/crypto/provider_core.c:959
1247	1247	2 : View List ['def_load_bio', 'BIO_free']	1247	1247	def_load	call site: 00000	/src/openssl/crypto/conf/conf_def.c:177
661	661	5 : View List ['BIO_s_file', 'fclose', 'BIO_ctrl', 'BIO_clear_flags', 'BIO_new']	661	661	BIO_new_file	call site: 00000	/src/openssl/crypto/bio/bss_file.c:66
649	677	8 : View List ['CRYPTO_free', 'ERR_unload_strings', 'sk_INFOPAIR_pop_free', 'ossl_init_thread_deregister', 'ossl_provider_teardown', 'DSO_free', 'CRYPTO_FREE_REF.9121', 'CRYPTO_THREAD_lock_free']	649	677	ossl_provider_free	call site: 00000	/src/openssl/crypto/provider_core.c:739
639	639	2 : View List ['sk_INFOPAIR_new_null', 'ossl_provider_info_add_parameter']	639	1578	ossl_provider_new	call site: 00000	/src/openssl/crypto/provider_core.c:574
438	880	5 : View List ['CRYPTO_free', 'CRYPTO_FREE_REF.6938', 'EVP_RAND_CTX_free', 'EVP_RAND_free', 'CRYPTO_DOWN_REF.6937']	438	880	EVP_RAND_CTX_free	call site: 00000	/src/openssl/crypto/evp/evp_rand.c:390
40	40	2 : View List ['ossl_strtouint64', 'ossl_strchr']	44	44	OPENSSL_cpuid_setup	call site: 00000	/src/openssl/crypto/cpuid.c:107
26	458	2 : View List ['ossl_provider_up_ref_parent', 'ossl_provider_free']	26	458	ossl_provider_up_ref	call site: 00000	/src/openssl/crypto/provider_core.c:484
26	26	1 : View List ['ossl_provider_free_parent']	26	26	provider_deactivate	call site: 00000	/src/openssl/crypto/provider_core.c:1244
18	37	6 : View List ['OPENSSL_LH_set_down_load', 'lh_CONF_VALUE_doall_LH_CONF_VALUE', 'OPENSSL_LH_free', 'OPENSSL_LH_doall', 'ossl_check_CONF_VALUE_lh_type', 'ossl_check_CONF_VALUE_lh_doallfunc_type']	18	37	_CONF_free_data	call site: 00000	/src/openssl/crypto/conf/conf_api.c:142
7	7	1 : View List ['pqueue_force_bottom']	7	26	ossl_pqueue_remove	call site: 00034	/src/openssl/ssl/priority_queue.c:275

Runtime coverage analysis

Covered functions

687

Functions that are reachable but not covered

11

Reachable functions

93

Percentage of reachable functions covered

88.17%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/quic-rcidm.c	2
include/internal/packet.h	9
ssl/quic/quic_rcidm.c	36
ssl/priority_queue.c	18
include/internal/quic_types.h	1
crypto/err/err_blocks.c	4
crypto/err/err_local.h	6
crypto/bio/bio_print.c	9
include/internal/common.h	1
crypto/ctype.c	1
crypto/o_str.c	1

Fuzzer: dtlsclient

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4816	74.3%
gold	[1:9]	341	5.26%
yellow	[10:29]	72	1.11%
greenyellow	[30:49]	52	0.80%
lawngreen	50+	1199	18.5%
All colors	6480	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
14088	14097	15 : View List ['CRYPTO_free', 'EVP_MD_get0_name', 'EVP_PKEY_CTX_set_rsa_pss_saltlen', 'PACKET_get_net_2.6259', 'EVP_MD_CTX_new', 'construct_key_exchange_tbs', 'EVP_DigestVerify', 'tls12_check_peer_sigalg', 'EVP_DigestVerifyInit_ex', 'tls1_set_peer_legacy_sigalg', 'tls1_lookup_md', 'PACKET_data.6261', 'PACKET_get_sub_packet.6258', 'EVP_PKEY_CTX_set_rsa_padding', 'PACKET_get_length_prefixed_2.6263']	14088	25204	tls_process_key_exchange	call site: 00000	/src/openssl/ssl/statem/statem_clnt.c:2485
11692	56359	26 : View List ['dtls1_check_timeout_num', 'PACKET_remaining.9968', 'ossl_statem_app_data_allowed', 'SSL_get_rbio', 'ssl_release_record', 'SSL_in_init', 'ossl_statem_fatal', 'dtls_unbuffer_record', 'ossl_statem_in_error', 'ossl_statem_set_in_init', 'BIO_set_flags', 'ossl_tls_handle_rlayer_return', 'PACKET_get_1.9978', 'dtls1_retransmit_buffered_messages', 'ossl_assert_int.9977', 'ERR_set_debug', 'ERR_new', 'ossl_statem_get_in_handshake', 'SSL_is_init_finished', 'dtls_buffer_record', 'dtls1_get_message_header', 'BIO_clear_flags', 'dtls1_read_failed', 'PACKET_buf_init.9979', 'dtls1_handle_timeout', 'SSL_CTX_remove_session']	11692	56359	dtls1_read_bytes	call site: 00000	/src/openssl/ssl/record/rec_layer_d1.c:265
8725	10995	11 : View List ['ossl_ecx_dhkem_derive_private', 'ossl_x25519_public_from_private', 'ERR_set_debug', 'ERR_new', 'ERR_set_error', 'ossl_ed25519_public_from_private', 'ossl_x448_public_from_private', 'ossl_ecx_key_allocate_privkey', 'ossl_ecx_key_free', 'ossl_ed448_public_from_private', 'RAND_priv_bytes_ex']	8725	10995	ecx_gen	call site: 00000	/src/openssl/providers/implementations/keymgmt/ecx_kmgmt.c:702
6800	6803	5 : View List ['BN_is_bit_set', 'BN_clear_bit', 'BN_is_word', 'ossl_ffc_params_simple_validate', 'BN_priv_rand_ex']	6800	10186	generate_key	call site: 00000	/src/openssl/crypto/dh/dh_key.c:313
6068	6940	2 : View List ['EVP_PKEY_Q_keygen', 'mlx_kem_key_free']	6068	6940	mlx_kem_gen	call site: 00000	/src/openssl/providers/implementations/keymgmt/mlx_kmgmt.c:710
5284	5284	1 : View List ['ssl_validate_ct']	5284	5284	tls_process_initial_server_flight	call site: 00000	/src/openssl/ssl/statem/statem_clnt.c:2985
3964	3964	1 : View List ['tls13_change_cipher_state']	3964	3964	ossl_statem_client_post_work	call site: 00000	/src/openssl/ssl/statem/statem_clnt.c:809
3790	3790	1 : View List ['tls_process_as_hello_retry_request']	3790	4837	tls_process_server_hello	call site: 00000	/src/openssl/ssl/statem/statem_clnt.c:1578
3569	3569	1 : View List ['tls_construct_cke_dhe']	3569	3569	tls_construct_client_key_exchange	call site: 00000	/src/openssl/ssl/statem/statem_clnt.c:3581
3282	3282	1 : View List ['ossl_ec_GF2m_simple_oct2point']	3282	3282	EC_POINT_oct2point	call site: 00000	/src/openssl/crypto/ec/ec_oct.c:122
3246	5072	10 : View List ['BN_CTX_start', 'BN_CTX_get', 'BN_bin2bn', 'BN_CTX_end', 'BN_ucmp', 'BN_CTX_free', 'BN_is_odd', 'EC_POINT_set_affine_coordinates', 'BN_CTX_new_ex', 'EC_POINT_set_compressed_coordinates']	3246	5870	ossl_ec_GFp_simple_oct2point	call site: 00000	/src/openssl/crypto/ec/ecp_oct.c:317
3115	3115	1 : View List ['DH_check_ex']	4359	5641	dh_validate	call site: 00000	/src/openssl/providers/implementations/keymgmt/dh_kmgmt.c:433

Runtime coverage analysis

Covered functions

2488

Functions that are reachable but not covered

1071

Reachable functions

1950

Percentage of reachable functions covered

45.08%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/dtlsclient.c	1
ssl/methods.c	1
ssl/ssl_lib.c	46
crypto/err/err_blocks.c	4
crypto/err/err_local.h	6
crypto/bio/bio_print.c	12
include/internal/common.h	3
crypto/ctype.c	3
crypto/o_str.c	12
ssl/ssl_init.c	3
ssl/ssl_ciph.c	20
crypto/context.c	12
crypto/threads_pthread.c	14
ssl/s3_lib.c	3
ssl/ssl_cert.c	10
crypto/ex_data.c	9
include/internal/cryptlib.h	6
crypto/stack/stack.c	28
include/internal/refcount.h	5
ssl/ssl_local.h	13
crypto/lhash/lhash.c	19
crypto/x509/x509_lu.c	7
include/openssl/x509_vfy.h	5
crypto/x509/x509_cmp.c	6
crypto/x509/x_name.c	3
crypto/asn1/tasn_enc.c	8
crypto/asn1/asn1_local.h	3
crypto/asn1/a_bitstr.c	2
crypto/asn1/a_int.c	10
crypto/asn1/asn1_lib.c	14
crypto/asn1/tasn_utl.c	13
crypto/objects/obj_dat.c	33
crypto/bsearch.c	1
crypto/objects/obj_local.h	17
crypto/x509/x509_vpm.c	3
include/openssl/crypto.h	3
include/openssl/asn1.h	5
crypto/asn1/a_object.c	6
include/openssl/safestack.h	4
crypto/ct/ct_log.c	3
include/openssl/ct.h	2
crypto/evp/p_lib.c	23
crypto/evp/keymgmt_lib.c	15
include/crypto/evp.h	7
crypto/evp/keymgmt_meth.c	28
crypto/provider_core.c	31
crypto/initthread.c	13
crypto/dso/dso_lib.c	9
crypto/provider_local.h	2
crypto/provider_child.c	2
crypto/asn1/ameth_lib.c	10
include/crypto/asn1.h	3
crypto/engine/tb_asnmth.c	6
crypto/engine/eng_table.c	8
crypto/err/err_mark.c	4
crypto/engine/eng_local.h	8
crypto/engine/eng_init.c	4
crypto/engine/eng_lib.c	4
crypto/engine/tb_pkmeth.c	4
crypto/evp/pmeth_lib.c	30
crypto/engine/eng_list.c	1
include/openssl/x509.h	6
crypto/x509/x_attrib.c	2
crypto/asn1/tasn_fre.c	5
include/openssl/asn1t.h	3
ssl/tls_depr.c	3
crypto/engine/tb_cipher.c	3
crypto/evp/evp_enc.c	33
crypto/evp/evp_fetch.c	10
crypto/core_namemap.c	16
crypto/objects/o_names.c	10
crypto/evp/evp_lib.c	25
crypto/bn/bn_word.c	4
crypto/bn/bn_lib.c	19
crypto/bn/bn_local.h	1
crypto/bn/bn_shift.c	2
crypto/bn/bn_conv.c	1
include/internal/constant_time.h	4
crypto/bn/asm/x86_64-gcc.c	2
include/internal/hashtable.h	1
crypto/hashtable/hashtable.c	11
crypto/property/property.c	38
crypto/sparse_array.c	8
crypto/core_fetch.c	7
crypto/core_algorithm.c	4
crypto/dso/dso_dlfcn.c	1
crypto/getenv.c	1
crypto/defaults.c	4
include/openssl/core_dispatch.h	142
include/openssl/err.h	2
crypto/rand/rand_lib.c	14
crypto/provider.c	4
crypto/encode_decode/decoder_pkey.c	24
crypto/encode_decode/decoder_meth.c	20
crypto/encode_decode/encoder_local.h	6
crypto/encode_decode/decoder_lib.c	30
crypto/passphrase.c	9
crypto/params.c	31
crypto/evp/evp_utils.c	6
crypto/engine/tb_digest.c	3
crypto/evp/digest.c	22
crypto/evp/signature.c	13
crypto/evp/exchange.c	8
ssl/t1_lib.c	15
crypto/conf/conf_mod.c	1
ssl/statem/statem_lib.c	1
crypto/objects/obj_lib.c	1
crypto/objects/obj_xref.c	10
crypto/objects/obj_xref.h	5
crypto/evp/kem.c	2
crypto/evp/asymcipher.c	2
include/openssl/ssl.h	5
crypto/bio/bio_lib.c	22
providers/implementations/rands/seeding/rand_unix.c	1
crypto/engine/tb_rand.c	2
crypto/rand/rand_meth.c	1
crypto/evp/evp_rand.c	20
ssl/tls_srp.c	2
ssl/quic/quic_method.c	3
ssl/quic/quic_impl.c	66
crypto/hashtable/hashfunc.c	1
crypto/thread/arch/thread_posix.c	11
ssl/ssl_mcnf.c	2
crypto/conf/conf_ssl.c	3
ssl/ssl_conf.c	14
ssl/quic/quic_obj.c	6
ssl/ssl_rsa.c	5
crypto/bio/bss_file.c	2
crypto/pem/pem_pkey.c	4
crypto/bio/bf_readbuff.c	1
crypto/bio/ossl_core_bio.c	3
crypto/ui/ui_util.c	10
crypto/ui/ui_lib.c	29
crypto/ui/ui_openssl.c	1
crypto/ui/ui_null.c	1
include/openssl/ui.h	4
crypto/err/err_prn.c	1
include/internal/to_hex.h	1
crypto/pem/pem_lib.c	15
crypto/evp/encode.c	7
crypto/evp/names.c	6
crypto/evp/evp_key.c	3
crypto/evp/legacy_md5.c	1
crypto/evp/m_sigver.c	6
crypto/evp/ctrl_params_translate.c	8
crypto/asn1/p8_pkey.c	4
crypto/asn1/tasn_dec.c	14
crypto/asn1/tasn_typ.c	9
crypto/asn1/tasn_new.c	9
crypto/asn1/a_type.c	1
crypto/evp/evp_pkey.c	1
crypto/asn1/x_sig.c	4
crypto/pkcs12/p12_p8d.c	2
crypto/pkcs12/p12_decr.c	2
crypto/evp/evp_pbe.c	5
crypto/evp/evp_local.h	3
crypto/asn1/d2i_pr.c	4
crypto/x509/x_pubkey.c	8
crypto/x509/x_all.c	1
crypto/asn1/a_d2i_fp.c	1
ssl/ssl_sess.c	9
include/internal/time.h	17
crypto/x509/x_x509.c	2
crypto/x509/t_x509.c	1
crypto/x509/x_crl.c	2
ssl/statem/extensions_cust.c	4
ssl/statem/statem.c	8
ssl/quic/quic_channel.c	32
ssl/quic/quic_port.c	17
crypto/err/err_save.c	4
ssl/quic/quic_obj_local.h	4
ssl/quic/quic_engine.c	8
crypto/bio/bio_addr.c	6
ssl/quic/quic_txp.c	5
ssl/quic/quic_record_tx.c	3
ssl/quic/quic_record_util.c	11
crypto/evp/kdf_meth.c	7
crypto/evp/kdf_lib.c	3
ssl/tls13_enc.c	2
ssl/quic/quic_record_rx.c	7
ssl/quic/quic_record_shared.c	7
ssl/quic/quic_wire_pkt.c	2
include/internal/quic_demux.h	3
ssl/quic/quic_wire.c	5
include/internal/quic_vlint.h	1
ssl/quic/quic_fc.c	14
ssl/quic/quic_tls.c	8
ssl/quic/qlog.c	35
ssl/quic/json_enc.c	44
crypto/o_fopen.c	1
crypto/cversion.c	1
crypto/info.c	3
ssl/quic/qlog_event_helpers.c	5
crypto/bio/bss_null.c	1
ssl/quic/quic_reactor.c	18
ssl/quic/quic_demux.c	2
ssl/quic/quic_stream_map.c	10
ssl/rio/rio_notifier.c	2
include/internal/rio_notifier.h	1
crypto/time.c	1
crypto/bio/bss_fd.c	1
ssl/quic/quic_statm.c	1
include/internal/quic_stream_map.h	3
ssl/quic/quic_rstream.c	3
ssl/quic/quic_sstream.c	3
include/internal/ring_buf.h	7
ssl/quic/uint_set.c	2
include/internal/uint_set.h	3
ssl/quic/quic_sf_list.c	3
ssl/record/rec_layer_s3.c	10
ssl/s3_msg.c	1
ssl/t1_enc.c	1
ssl/record/rec_layer_d1.c	2
ssl/pqueue.c	3
crypto/bio/bss_dgram_pair.c	1
crypto/async/async.c	13
crypto/async/async_wait.c	2
crypto/async/async_local.h	4
crypto/async/arch/async_posix.c	3
crypto/async/arch/async_posix.h	1
ssl/quic/quic_ackm.c	1
ssl/quic/quic_thread_assist.c	2
crypto/thread/arch.c	1

Fuzzer: dtlsserver

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4491	64.1%
gold	[1:9]	368	5.25%
yellow	[10:29]	91	1.29%
greenyellow	[30:49]	42	0.59%
lawngreen	50+	2009	28.6%
All colors	7001	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
13784	13788	3 : View List ['tls1_check_sig_alg', 'tls1_lookup_sigalg', 'find_sig_alg']	15024	23958	tls1_check_chain	call site: 00000	/src/openssl/ssl/t1_lib.c:4078
12377	21495	15 : View List ['X509_cmp', 'get1_trusted_issuer', 'OPENSSL_sk_delete_ptr', 'ERR_set_debug', 'ERR_set_error', 'ERR_new', 'ossl_check_X509_type', 'OPENSSL_sk_pop', 'OPENSSL_sk_set', 'check_dane_issuer', 'get0_best_issuer_sk', 'X509_free', 'OPENSSL_sk_push', 'X509_add_cert', 'ossl_assert_int.12236']	16628	52984	build_chain	call site: 00000	/src/openssl/crypto/x509/x509_vfy.c:3518
10675	56359	26 : View List ['dtls1_check_timeout_num', 'PACKET_remaining.9968', 'ossl_statem_app_data_allowed', 'SSL_get_rbio', 'ssl_release_record', 'SSL_in_init', 'ossl_statem_fatal', 'dtls_unbuffer_record', 'ossl_statem_in_error', 'ossl_statem_set_in_init', 'BIO_set_flags', 'ossl_tls_handle_rlayer_return', 'PACKET_get_1.9978', 'dtls1_retransmit_buffered_messages', 'ossl_assert_int.9977', 'ERR_set_debug', 'ERR_new', 'ossl_statem_get_in_handshake', 'SSL_is_init_finished', 'dtls_buffer_record', 'dtls1_get_message_header', 'BIO_clear_flags', 'dtls1_read_failed', 'PACKET_buf_init.9979', 'dtls1_handle_timeout', 'SSL_CTX_remove_session']	10675	56359	dtls1_read_bytes	call site: 00000	/src/openssl/ssl/record/rec_layer_d1.c:265
9914	10415	5 : View List ['OSSL_STACK_OF_X509_free', 'get0_best_issuer_sk', 'X509_up_ref', 'ossl_x509_check_cert_time', 'X509_STORE_CTX_get1_certs']	9914	10907	X509_STORE_CTX_get1_issuer	call site: 00000	/src/openssl/crypto/x509/x509_vfy.c:444
9084	9095	6 : View List ['X509_chain_check_suiteb', 'internal_verify', 'X509v3_asid_validate_path', 'verify_cb_cert', 'X509v3_addr_validate_path', 'check_name_constraints']	9084	9095	verify_chain	call site: 00000	/src/openssl/crypto/x509/x509_vfy.c:238
7739	8006	6 : View List ['EVP_PKEY_get_bn_param', 'ssl_get_auto_dh', 'EVP_PKEY_get_security_bits', 'ssl_generate_pkey', 'ssl_dh_to_pkey', 'ssl_security']	7741	42685	tls_construct_server_key_exchange	call site: 00000	/src/openssl/ssl/statem/statem_srvr.c:2571
6320	6320	2 : View List ['EVP_DigestSignInit', 'EVP_DigestVerifyInit']	6320	6586	evp_md_init_internal	call site: 03592	/src/openssl/crypto/evp/digest.c:165
4813	4813	1 : View List ['ossl_ecdsa_deterministic_sign']	4813	4813	ecdsa_sign_directly	call site: 00000	/src/openssl/providers/implementations/signature/ecdsa_sig.c:351
4734	5065	9 : View List ['CRYPTO_free', 'ERR_clear_error', 'EVP_DecryptFinal', 'CRYPTO_malloc', 'EVP_DecryptUpdate', 'd2i_SSL_SESSION_ex', 'ssl_hmac_update', 'memcmp', 'ssl_hmac_final']	4734	9267	tls_decrypt_ticket	call site: 00000	/src/openssl/ssl/t1_lib.c:3189
4444	6478	4 : View List ['ossl_statem_fatal', 'ssl_srp_server_param_with_username_intern', 'ERR_set_debug', 'ERR_new']	4444	6478	ssl_check_srp_ext_ClientHello	call site: 00000	/src/openssl/ssl/statem/statem_srvr.c:1360
4332	4332	1 : View List ['d2i_ECParameters']	4332	5144	ossl_ec_key_param_from_x509_algor	call site: 00000	/src/openssl/crypto/ec/ec_backend.c:774
4318	4324	4 : View List ['X509_cmp', 'ossl_check_const_X509_sk_type.41693', 'OPENSSL_sk_value', 'OPENSSL_sk_num']	4318	9940	X509_add_cert	call site: 00000	/src/openssl/crypto/x509/x509_cmp.c:201

Runtime coverage analysis

Covered functions

3913

Functions that are reachable but not covered

855

Reachable functions

2102

Percentage of reachable functions covered

59.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/dtlsserver.c	1
ssl/methods.c	1
ssl/ssl_lib.c	46
crypto/err/err_blocks.c	4
crypto/err/err_local.h	6
crypto/bio/bio_print.c	12
include/internal/common.h	3
crypto/ctype.c	3
crypto/o_str.c	12
ssl/ssl_init.c	3
ssl/ssl_ciph.c	20
crypto/context.c	12
crypto/threads_pthread.c	14
ssl/s3_lib.c	3
ssl/ssl_cert.c	12
crypto/ex_data.c	9
include/internal/cryptlib.h	6
crypto/stack/stack.c	28
include/internal/refcount.h	5
ssl/ssl_local.h	13
crypto/lhash/lhash.c	19
crypto/x509/x509_lu.c	7
include/openssl/x509_vfy.h	5
crypto/x509/x509_cmp.c	9
crypto/x509/x_name.c	7
crypto/asn1/tasn_enc.c	8
crypto/asn1/asn1_local.h	3
crypto/asn1/a_bitstr.c	2
crypto/asn1/a_int.c	11
crypto/asn1/asn1_lib.c	15
crypto/asn1/tasn_utl.c	13
crypto/objects/obj_dat.c	33
crypto/bsearch.c	1
crypto/objects/obj_local.h	17
crypto/x509/x509_vpm.c	3
include/openssl/crypto.h	3
include/openssl/asn1.h	6
crypto/asn1/a_object.c	6
include/openssl/safestack.h	4
crypto/ct/ct_log.c	3
include/openssl/ct.h	2
crypto/evp/p_lib.c	34
crypto/evp/keymgmt_lib.c	16
include/crypto/evp.h	7
crypto/evp/keymgmt_meth.c	29
crypto/provider_core.c	31
crypto/initthread.c	13
crypto/dso/dso_lib.c	9
crypto/provider_local.h	2
crypto/provider_child.c	2
crypto/asn1/ameth_lib.c	10
include/crypto/asn1.h	3
crypto/engine/tb_asnmth.c	6
crypto/engine/eng_table.c	8
crypto/err/err_mark.c	4
crypto/engine/eng_local.h	8
crypto/engine/eng_init.c	4
crypto/engine/eng_lib.c	4
crypto/engine/tb_pkmeth.c	4
crypto/evp/pmeth_lib.c	30
crypto/engine/eng_list.c	1
include/openssl/x509.h	10
crypto/x509/x_attrib.c	2
crypto/asn1/tasn_fre.c	5
include/openssl/asn1t.h	3
ssl/tls_depr.c	3
crypto/engine/tb_cipher.c	3
crypto/evp/evp_enc.c	33
crypto/evp/evp_fetch.c	10
crypto/core_namemap.c	16
crypto/objects/o_names.c	10
crypto/evp/evp_lib.c	26
crypto/bn/bn_word.c	4
crypto/bn/bn_lib.c	20
crypto/bn/bn_local.h	1
crypto/bn/bn_shift.c	2
crypto/bn/bn_conv.c	1
include/internal/constant_time.h	4
crypto/bn/asm/x86_64-gcc.c	2
include/internal/hashtable.h	1
crypto/hashtable/hashtable.c	11
crypto/property/property.c	38
crypto/sparse_array.c	8
crypto/core_fetch.c	7
crypto/core_algorithm.c	4
crypto/dso/dso_dlfcn.c	1
crypto/getenv.c	1
crypto/defaults.c	4
include/openssl/core_dispatch.h	142
include/openssl/err.h	2
crypto/rand/rand_lib.c	14
crypto/provider.c	4
crypto/encode_decode/decoder_pkey.c	24
crypto/encode_decode/decoder_meth.c	20
crypto/encode_decode/encoder_local.h	6
crypto/encode_decode/decoder_lib.c	30
crypto/passphrase.c	9
crypto/params.c	31
crypto/evp/evp_utils.c	6
crypto/engine/tb_digest.c	3
crypto/evp/digest.c	23
crypto/evp/signature.c	13
crypto/evp/exchange.c	8
ssl/t1_lib.c	18
crypto/conf/conf_mod.c	1
ssl/statem/statem_lib.c	1
crypto/objects/obj_lib.c	2
crypto/objects/obj_xref.c	11
crypto/objects/obj_xref.h	5
crypto/evp/kem.c	2
crypto/evp/asymcipher.c	2
include/openssl/ssl.h	5
crypto/bio/bio_lib.c	23
providers/implementations/rands/seeding/rand_unix.c	1
crypto/engine/tb_rand.c	2
crypto/rand/rand_meth.c	1
crypto/evp/evp_rand.c	20
ssl/tls_srp.c	2
ssl/quic/quic_method.c	3
ssl/quic/quic_impl.c	66
crypto/hashtable/hashfunc.c	1
crypto/thread/arch/thread_posix.c	11
ssl/ssl_mcnf.c	2
crypto/conf/conf_ssl.c	3
ssl/ssl_conf.c	14
ssl/quic/quic_obj.c	6
ssl/ssl_rsa.c	7
crypto/bio/bss_file.c	3
crypto/pem/pem_pkey.c	5
crypto/bio/bf_readbuff.c	1
crypto/bio/ossl_core_bio.c	3
crypto/ui/ui_util.c	10
crypto/ui/ui_lib.c	29
crypto/ui/ui_openssl.c	1
crypto/ui/ui_null.c	1
include/openssl/ui.h	4
crypto/err/err_prn.c	3
include/internal/to_hex.h	1
crypto/pem/pem_lib.c	15
crypto/evp/encode.c	7
crypto/evp/names.c	6
crypto/evp/evp_key.c	3
crypto/evp/legacy_md5.c	1
crypto/evp/m_sigver.c	6
crypto/evp/ctrl_params_translate.c	8
crypto/asn1/p8_pkey.c	4
crypto/asn1/tasn_dec.c	14
crypto/asn1/tasn_typ.c	9
crypto/asn1/tasn_new.c	9
crypto/asn1/a_type.c	1
crypto/evp/evp_pkey.c	1
crypto/asn1/x_sig.c	4
crypto/pkcs12/p12_p8d.c	2
crypto/pkcs12/p12_decr.c	2
crypto/evp/evp_pbe.c	5
crypto/evp/evp_local.h	3
crypto/asn1/d2i_pr.c	4
crypto/x509/x_pubkey.c	8
crypto/x509/x_all.c	2
crypto/asn1/a_d2i_fp.c	1
ssl/ssl_sess.c	9
include/internal/time.h	17
crypto/x509/x_x509.c	3
crypto/x509/t_x509.c	1
crypto/x509/x_crl.c	2
ssl/statem/extensions_cust.c	4
crypto/pem/pem_all.c	6
crypto/evp/p_legacy.c	4
crypto/rsa/rsa_lib.c	3
crypto/rsa/rsa_asn1.c	2
crypto/rsa/rsa_local.h	1
crypto/rsa/rsa_mp.c	2
crypto/bn/bn_blind.c	1
crypto/ec/ec_key.c	4
crypto/ec/ec_lib.c	4
crypto/rsa/rsa_backend.c	1
crypto/rsa/rsa_ossl.c	1
crypto/ec/ec_backend.c	1
crypto/ec/ec_kmeth.c	2
crypto/dsa/dsa_backend.c	1
crypto/dsa/dsa_lib.c	3
crypto/dsa/dsa_ossl.c	1
crypto/dh/dh_backend.c	1
crypto/dh/dh_lib.c	1
crypto/dh/dh_key.c	1
crypto/pem/pem_x509.c	1
crypto/pem/pem_oth.c	1
crypto/x509/v3_purp.c	13
crypto/evp/legacy_sha.c	1
crypto/asn1/a_digest.c	1
crypto/x509/x509_set.c	6
crypto/x509/x509_ext.c	4
crypto/x509/v3_lib.c	7
crypto/x509/x509_v3.c	7
include/openssl/x509v3.h	8
crypto/x509/v3_bcons.c	2
crypto/x509/v3_pcia.c	2
crypto/asn1/a_octet.c	1
crypto/x509/v3_crld.c	1
crypto/asn1/a_dup.c	1
crypto/x509/x509name.c	1
crypto/ec/ecp_nistz256.c	1
crypto/ec/ecp_nistp224.c	1
crypto/ec/ecp_nistp256.c	1
crypto/ec/ecp_nistp384.c	1
crypto/ec/ecp_nistp521.c	1
crypto/ec/ec_mult.c	1
crypto/bn/bn_mont.c	1
crypto/ffc/ffc_params.c	2
ssl/quic/quic_channel.c	32
ssl/quic/quic_port.c	17
crypto/err/err_save.c	4
ssl/quic/quic_obj_local.h	4
ssl/quic/quic_engine.c	8
crypto/bio/bio_addr.c	6
ssl/quic/quic_txp.c	5
ssl/quic/quic_record_tx.c	3
ssl/quic/quic_record_util.c	11
crypto/evp/kdf_meth.c	7
crypto/evp/kdf_lib.c	3
ssl/tls13_enc.c	2
ssl/quic/quic_record_rx.c	7
ssl/quic/quic_record_shared.c	7
ssl/quic/quic_wire_pkt.c	2
include/internal/quic_demux.h	3
ssl/quic/quic_wire.c	5
include/internal/quic_vlint.h	1
ssl/quic/quic_fc.c	14
ssl/quic/quic_tls.c	8
ssl/quic/qlog.c	35
ssl/quic/json_enc.c	44
crypto/o_fopen.c	1
crypto/cversion.c	1
crypto/info.c	3
ssl/quic/qlog_event_helpers.c	5
ssl/statem/statem.c	8
crypto/bio/bss_null.c	1
ssl/quic/quic_reactor.c	18
ssl/quic/quic_demux.c	2
ssl/quic/quic_stream_map.c	10
ssl/rio/rio_notifier.c	2
include/internal/rio_notifier.h	1
crypto/time.c	1
crypto/bio/bss_fd.c	1
ssl/quic/quic_statm.c	1
include/internal/quic_stream_map.h	3
ssl/quic/quic_rstream.c	3
ssl/quic/quic_sstream.c	3
include/internal/ring_buf.h	7
ssl/quic/uint_set.c	2
include/internal/uint_set.h	3
ssl/quic/quic_sf_list.c	3
ssl/record/rec_layer_s3.c	10
ssl/s3_msg.c	1
ssl/t1_enc.c	1
ssl/record/rec_layer_d1.c	2
ssl/pqueue.c	3
crypto/bio/bss_dgram_pair.c	1
crypto/async/async.c	13
crypto/async/async_wait.c	2
crypto/async/async_local.h	4
crypto/async/arch/async_posix.c	3
crypto/async/arch/async_posix.h	1
ssl/quic/quic_ackm.c	1
ssl/quic/quic_thread_assist.c	2
crypto/thread/arch.c	1

Fuzzer: bignum

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	486	49.8%
gold	[1:9]	11	1.12%
yellow	[10:29]	4	0.41%
greenyellow	[30:49]	1	0.10%
lawngreen	50+	472	48.4%
All colors	974	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
617	617	1 : View List ['bn_mod_inverse_no_branch']	617	617	int_bn_mod_inverse	call site: 00180	/src/openssl/crypto/bn/bn_gcd.c:214
592	4253	9 : View List ['BN_set_word', 'BN_mul_word', 'BN_add', 'BN_num_bits', 'BN_is_word', 'BN_div', 'BN_mul', 'BN_lshift1', 'BN_lshift']	592	6954	int_bn_mod_inverse	call site: 00372	/src/openssl/crypto/bn/bn_gcd.c:261
438	880	5 : View List ['CRYPTO_free', 'CRYPTO_FREE_REF.6938', 'EVP_RAND_CTX_free', 'EVP_RAND_free', 'CRYPTO_DOWN_REF.6937']	438	880	EVP_RAND_CTX_free	call site: 00000	/src/openssl/crypto/evp/evp_rand.c:390
266	266	3 : View List ['ERR_new', 'ERR_set_debug', 'ERR_set_error']	266	266	BN_usub	call site: 00336	/src/openssl/crypto/bn/bn_add.c:138
266	266	3 : View List ['ERR_new', 'ERR_set_debug', 'ERR_set_error']	266	266	BN_CTX_get	call site: 00140	/src/openssl/crypto/bn/bn_ctx.c:219
266	266	3 : View List ['ERR_new', 'ERR_set_debug', 'ERR_set_error']	266	266	BN_div	call site: 00214	/src/openssl/crypto/bn/bn_div.c:224
266	266	3 : View List ['ERR_new', 'ERR_set_debug', 'ERR_set_error']	266	266	BN_mod_exp_recp	call site: 00769	/src/openssl/crypto/bn/bn_exp.c:179
266	266	3 : View List ['ERR_new', 'ERR_set_debug', 'ERR_set_error']	266	266	BN_mod_exp_simple	call site: 00852	/src/openssl/crypto/bn/bn_exp.c:1337
266	266	3 : View List ['ERR_new', 'ERR_set_debug', 'ERR_set_error']	266	266	bn_expand_internal	call site: 00085	/src/openssl/crypto/bn/bn_lib.c:274
266	266	3 : View List ['ERR_new', 'ERR_set_debug', 'ERR_set_error']	266	266	BN_nnmod	call site: 00206	/src/openssl/crypto/bn/bn_mod.c:21
266	266	3 : View List ['ERR_new', 'ERR_set_debug', 'ERR_set_error']	266	266	BN_lshift	call site: 00421	/src/openssl/crypto/bn/bn_shift.c:85
266	266	3 : View List ['ERR_new', 'ERR_set_debug', 'ERR_set_error']	266	266	BN_rshift	call site: 00381	/src/openssl/crypto/bn/bn_shift.c:154

Runtime coverage analysis

Covered functions

408

Functions that are reachable but not covered

98

Reachable functions

220

Percentage of reachable functions covered

55.45%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/bignum.c	1
crypto/bn/bn_lib.c	35
crypto/bn/bn_ctx.c	14
crypto/err/err_blocks.c	4
crypto/err/err_local.h	6
crypto/bio/bio_print.c	9
include/internal/common.h	1
crypto/ctype.c	1
crypto/o_str.c	1
crypto/bn/bn_exp.c	10
include/internal/constant_time.h	11
crypto/bn/bn_local.h	1
crypto/bn/bn_mont.c	10
crypto/bn/bn_gcd.c	3
crypto/bn/bn_mod.c	2
crypto/bn/bn_div.c	3
crypto/bn/bn_shift.c	6
crypto/bn/asm/x86_64-gcc.c	10
crypto/bn/bn_mul.c	6
crypto/bn/bn_add.c	4
crypto/bn/bn_word.c	3
crypto/bn/bn_sqr.c	4
crypto/bn/rsaz_exp.c	2
crypto/bn/rsaz_exp.h	2
crypto/bn/bn_recp.c	6
crypto/bn/bn_print.c	2
crypto/bio/bss_file.c	1
crypto/bio/bio_lib.c	7
include/internal/refcount.h	3
crypto/ex_data.c	6
crypto/context.c	4
crypto/threads_pthread.c	4
include/internal/cryptlib.h	2
crypto/stack/stack.c	3
include/openssl/crypto.h	2

Fuzzer: decoder

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1501	54.4%
gold	[1:9]	174	6.31%
yellow	[10:29]	38	1.37%
greenyellow	[30:49]	41	1.48%
lawngreen	50+	1002	36.3%
All colors	2756	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
8915	9769	5 : View List ['BN_CTX_get', 'generate_p', 'CRYPTO_malloc', 'generate_q_fips186_4', 'BN_lshift']	14047	20039	ossl_ffc_params_FIPS186_4_gen_verify	call site: 00000	/src/openssl/crypto/ffc/ffc_params_generate.c:622
7185	10784	8 : View List ['do_b2i_key', 'EVP_DecryptFinal_ex', 'EVP_DecryptUpdate', 'EVP_CIPHER_fetch', 'derive_pvk_key', 'EVP_DecryptInit_ex', 'CRYPTO_malloc', 'read_ledword']	7187	12308	do_PVK_body_key	call site: 00000	/src/openssl/crypto/pem/pvkfmt.c:885
6320	6320	2 : View List ['EVP_DigestSignInit', 'EVP_DigestVerifyInit']	6320	6586	evp_md_init_internal	call site: 00000	/src/openssl/crypto/evp/digest.c:165
6050	6606	8 : View List ['EVP_BytesToKey', 'EVP_DecryptFinal_ex', 'EVP_CIPHER_CTX_new', 'EVP_md5', 'EVP_DecryptUpdate', 'EVP_DecryptInit_ex', 'OPENSSL_cleanse', 'EVP_CIPHER_CTX_free']	6050	6872	PEM_do_header	call site: 00000	/src/openssl/crypto/pem/pem_lib.c:468
5181	12150	15 : View List ['BN_is_bit_set', 'BN_secure_new', 'ossl_ffc_generate_private_key', 'BN_is_word', 'BN_priv_rand_ex', 'BN_CTX_free', 'BN_free', 'ossl_ifc_ffc_compute_security_bits', 'DH_get_nid', 'ossl_dh_generate_public_key', 'BN_num_bits', 'BN_clear_bit', 'ossl_ffc_params_simple_validate', 'BN_CTX_new_ex', 'BN_new']	5181	12416	generate_key	call site: 00000	/src/openssl/crypto/dh/dh_key.c:286
4571	9184	2 : View List ['ossl_ffc_params_FIPS186_4_validate', 'ossl_ffc_params_FIPS186_2_validate']	4571	9184	ossl_ffc_params_full_validate	call site: 00000	/src/openssl/crypto/ffc/ffc_params_validate.c:154
4571	4571	1 : View List ['ossl_ffc_params_FIPS186_2_validate']	4571	4852	ossl_ffc_params_simple_validate	call site: 00000	/src/openssl/crypto/ffc/ffc_params_validate.c:115
3699	3699	1 : View List ['ml_kem_pairwise_test']	3699	3699	ml_kem_validate	call site: 00000	/src/openssl/providers/implementations/keymgmt/ml_kem_kmgmt.c:231
3327	3327	1 : View List ['ossl_ml_dsa_key_pairwise_check']	3327	3327	ml_dsa_validate	call site: 00000	/src/openssl/providers/implementations/keymgmt/ml_dsa_kmgmt.c:179
2719	2738	2 : View List ['CONF_modules_load', 'OSSL_LIB_CTX_get_conf_diagnostics']	2719	2762	CONF_modules_load_file_ex	call site: 00000	/src/openssl/crypto/conf/conf_mod.c:217
2246	3184	2 : View List ['EVP_PKEY_CTX_free', 'EVP_PKEY_CTX_new_from_pkey']	2749	7789	evp_pkey_export_to_provider	call site: 02611	/src/openssl/crypto/evp/p_lib.c:1948
1997	1997	1 : View List ['RAND_bytes_ex']	1997	2318	bnrand	call site: 00000	/src/openssl/crypto/bn/bn_rand.c:53

Runtime coverage analysis

Covered functions

3168

Functions that are reachable but not covered

225

Reachable functions

873

Percentage of reachable functions covered

74.23%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/decoder.c	1
crypto/bio/bss_null.c	1
crypto/bio/bio_lib.c	12
include/internal/refcount.h	4
crypto/ex_data.c	10
crypto/context.c	8
crypto/threads_pthread.c	13
crypto/err/err_blocks.c	4
crypto/err/err_local.h	6
crypto/bio/bio_print.c	12
include/internal/common.h	1
crypto/ctype.c	2
crypto/o_str.c	11
include/internal/cryptlib.h	6
crypto/stack/stack.c	24
include/openssl/crypto.h	3
crypto/encode_decode/decoder_pkey.c	23
crypto/params.c	12
crypto/lhash/lhash.c	17
crypto/encode_decode/decoder_meth.c	20
crypto/encode_decode/decoder_lib.c	30
crypto/evp/keymgmt_meth.c	27
crypto/evp/evp_fetch.c	9
crypto/core_namemap.c	16
crypto/objects/o_names.c	10
crypto/objects/obj_local.h	9
crypto/evp/evp_lib.c	3
crypto/objects/obj_dat.c	25
crypto/asn1/a_object.c	3
crypto/asn1/ameth_lib.c	10
include/crypto/asn1.h	3
crypto/bsearch.c	1
crypto/bn/bn_word.c	3
crypto/bn/bn_lib.c	18
crypto/bn/bn_local.h	1
crypto/bn/bn_shift.c	2
crypto/bn/bn_conv.c	1
include/internal/constant_time.h	4
crypto/bn/asm/x86_64-gcc.c	1
include/internal/hashtable.h	1
crypto/hashtable/hashtable.c	11
include/openssl/safestack.h	7
crypto/property/property.c	38
crypto/sparse_array.c	8
crypto/core_fetch.c	7
crypto/core_algorithm.c	4
crypto/provider_core.c	29
crypto/initthread.c	9
crypto/dso/dso_lib.c	9
crypto/provider_local.h	2
crypto/provider_child.c	2
crypto/dso/dso_dlfcn.c	1
crypto/getenv.c	1
crypto/defaults.c	1
include/openssl/core_dispatch.h	35
include/openssl/err.h	1
crypto/rand/rand_lib.c	3
crypto/provider.c	2
crypto/encode_decode/encoder_local.h	11
crypto/passphrase.c	7
crypto/evp/p_lib.c	24
crypto/engine/tb_asnmth.c	6
crypto/engine/eng_table.c	8
crypto/err/err_mark.c	3
crypto/engine/eng_local.h	8
crypto/engine/eng_init.c	4
crypto/engine/eng_lib.c	4
crypto/engine/tb_pkmeth.c	4
crypto/evp/pmeth_lib.c	14
crypto/engine/eng_list.c	1
crypto/evp/keymgmt_lib.c	14
include/crypto/evp.h	7
include/openssl/x509.h	4
crypto/x509/x_attrib.c	3
crypto/asn1/tasn_fre.c	5
include/openssl/asn1t.h	3
crypto/asn1/asn1_lib.c	12
crypto/asn1/tasn_utl.c	13
crypto/asn1/a_int.c	10
crypto/bio/bf_readbuff.c	1
crypto/bio/ossl_core_bio.c	3
crypto/ui/ui_util.c	10
crypto/ui/ui_lib.c	29
crypto/ui/ui_openssl.c	1
crypto/ui/ui_null.c	1
include/openssl/ui.h	4
crypto/err/err_prn.c	1
include/internal/to_hex.h	1
crypto/bio/bf_prefix.c	1
crypto/encode_decode/encoder_pkey.c	7
crypto/encode_decode/encoder_meth.c	17
crypto/encode_decode/encoder_lib.c	18
crypto/x509/x509_att.c	4
crypto/objects/obj_lib.c	1
crypto/asn1/a_dup.c	1
crypto/asn1/tasn_enc.c	8
crypto/asn1/asn1_local.h	3
crypto/asn1/a_bitstr.c	2
crypto/asn1/tasn_dec.c	13
crypto/asn1/tasn_typ.c	7
crypto/asn1/tasn_new.c	9
crypto/asn1/a_type.c	1
crypto/evp/signature.c	1
crypto/evp/exchange.c	1
crypto/evp/kem.c	1
crypto/evp/asymcipher.c	1
crypto/evp/pmeth_check.c	7

Fuzzer: v3name

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	279	42.7%
gold	[1:9]	63	9.64%
yellow	[10:29]	29	4.44%
greenyellow	[30:49]	12	1.83%
lawngreen	50+	270	41.3%
All colors	653	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2719	2738	2 : View List ['CONF_modules_load', 'OSSL_LIB_CTX_get_conf_diagnostics']	2726	2762	CONF_modules_load_file_ex	call site: 00000	/src/openssl/crypto/conf/conf_mod.c:217
1247	1247	2 : View List ['def_load_bio', 'BIO_free']	1247	1247	def_load	call site: 00000	/src/openssl/crypto/conf/conf_def.c:177
672	1713	2 : View List ['x509_name_encode', 'x509_name_canon']	672	1713	x509_name_ex_i2d	call site: 00000	/src/openssl/crypto/x509/x_name.c:220
661	661	5 : View List ['BIO_s_file', 'fclose', 'BIO_ctrl', 'BIO_clear_flags', 'BIO_new']	661	661	BIO_new_file	call site: 00000	/src/openssl/crypto/bio/bss_file.c:66
610	610	1 : View List ['ASN1_TYPE_new']	610	4524	asn1_ex_c2i	call site: 00299	/src/openssl/crypto/asn1/tasn_dec.c:846
438	880	5 : View List ['CRYPTO_free', 'CRYPTO_FREE_REF.6938', 'EVP_RAND_CTX_free', 'EVP_RAND_free', 'CRYPTO_DOWN_REF.6937']	438	880	EVP_RAND_CTX_free	call site: 00000	/src/openssl/crypto/evp/evp_rand.c:390
283	1157	5 : View List ['OBJ_obj2nid', 'ERR_set_debug', 'ERR_set_error', 'ERR_new', 'ASN1_INTEGER_get']	283	1157	ossl_asn1_do_adb	call site: 00177	/src/openssl/crypto/asn1/tasn_utl.c:234
266	270	2 : View List ['sk_const_ASN1_VALUE_set', 'sk_const_ASN1_VALUE_num']	266	270	asn1_set_seq_out	call site: 00636	/src/openssl/crypto/asn1/tasn_enc.c:451
46	51	6 : View List ['lh_OBJ_NAME_get_down_load', 'lh_OBJ_NAME_doall', 'CRYPTO_THREAD_lock_free', 'lh_OBJ_NAME_set_down_load', 'lh_OBJ_NAME_free', 'sk_NAME_FUNCS_pop_free']	46	51	OBJ_NAME_cleanup	call site: 00000	/src/openssl/crypto/objects/o_names.c:371
40	40	2 : View List ['ossl_strtouint64', 'ossl_strchr']	44	44	OPENSSL_cpuid_setup	call site: 00000	/src/openssl/crypto/cpuid.c:107
20	37	6 : View List ['OPENSSL_LH_set_down_load', 'lh_CONF_VALUE_doall_LH_CONF_VALUE', 'OPENSSL_LH_free', 'OPENSSL_LH_doall', 'ossl_check_CONF_VALUE_lh_type', 'ossl_check_CONF_VALUE_lh_doallfunc_type']	20	37	_CONF_free_data	call site: 00000	/src/openssl/crypto/conf/conf_api.c:142
15	15	1 : View List ['lh_ADDED_OBJ_retrieve']	15	23	ossl_obj_obj2nid	call site: 00197	/src/openssl/crypto/objects/obj_dat.c:406

Runtime coverage analysis

Covered functions

509

Functions that are reachable but not covered

32

Reachable functions

177

Percentage of reachable functions covered

81.92%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/v3name.c	1
crypto/x509/v3_genn.c	6
crypto/asn1/tasn_dec.c	14
crypto/err/err_blocks.c	4
crypto/err/err_local.h	6
crypto/bio/bio_print.c	9
include/internal/common.h	1
crypto/ctype.c	1
crypto/o_str.c	1
crypto/asn1/asn1_lib.c	13
crypto/stack/stack.c	17
include/openssl/asn1t.h	3
crypto/asn1/tasn_fre.c	5
crypto/asn1/a_object.c	3
crypto/asn1/tasn_utl.c	13
include/internal/refcount.h	4
crypto/threads_pthread.c	4
crypto/objects/obj_dat.c	13
crypto/bsearch.c	1
crypto/objects/obj_local.h	1
crypto/lhash/lhash.c	2
crypto/asn1/a_int.c	10
crypto/asn1/tasn_typ.c	7
crypto/asn1/tasn_new.c	9
crypto/asn1/a_type.c	2
crypto/asn1/a_bitstr.c	2
crypto/objects/obj_lib.c	1
crypto/x509/x509_cmp.c	1
crypto/x509/x_name.c	2
crypto/asn1/tasn_enc.c	8
crypto/asn1/asn1_local.h	3
crypto/asn1/a_octet.c	1

Fuzzer: pem

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	132	50.1%
gold	[1:9]	7	2.66%
yellow	[10:29]	5	1.90%
greenyellow	[30:49]	1	0.38%
lawngreen	50+	118	44.8%
All colors	263	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
438	880	5 : View List ['CRYPTO_free', 'CRYPTO_FREE_REF.6938', 'EVP_RAND_CTX_free', 'EVP_RAND_free', 'CRYPTO_DOWN_REF.6937']	438	880	EVP_RAND_CTX_free	call site: 00000	/src/openssl/crypto/evp/evp_rand.c:390
46	51	6 : View List ['lh_OBJ_NAME_get_down_load', 'lh_OBJ_NAME_doall', 'CRYPTO_THREAD_lock_free', 'lh_OBJ_NAME_set_down_load', 'lh_OBJ_NAME_free', 'sk_NAME_FUNCS_pop_free']	46	51	OBJ_NAME_cleanup	call site: 00000	/src/openssl/crypto/objects/o_names.c:371
40	40	2 : View List ['ossl_strtouint64', 'ossl_strchr']	44	44	OPENSSL_cpuid_setup	call site: 00000	/src/openssl/crypto/cpuid.c:107
14	14	1 : View List ['async_deinit']	14	2924	OPENSSL_cleanup	call site: 00000	/src/openssl/crypto/init.c:431
14	14	2 : View List ['qsort', 'CRYPTO_get_ex_data']	14	17	CRYPTO_free_ex_data	call site: 00105	/src/openssl/crypto/ex_data.c:398
6	6	2 : View List ['sk_EX_CALLBACK_value', 'CRYPTO_malloc']	20	28	CRYPTO_free_ex_data	call site: 00103	/src/openssl/crypto/ex_data.c:385
6	6	2 : View List ['sk_EX_CALLBACK_value', 'CRYPTO_malloc']	18	23	ossl_crypto_new_ex_data_ex	call site: 00086	/src/openssl/crypto/ex_data.c:239
6	6	1 : View List ['sk_EX_CALLBACK_value']	6	11	ossl_crypto_free_ex_index_ex	call site: 00000	/src/openssl/crypto/ex_data.c:127
0	621	1 : View List ['ossl_provider_store_free']	0	621	ossl_provider_store_new	call site: 00000	/src/openssl/crypto/provider_core.c:313
0	297	2 : View List ['sk_reserve', 'OPENSSL_sk_free']	0	297	OPENSSL_sk_new_reserve	call site: 00000	/src/openssl/crypto/stack/stack.c:236
0	266	3 : View List ['ERR_new', 'ERR_set_debug', 'ERR_set_error']	0	266	BIO_puts	call site: 00192	/src/openssl/crypto/bio/bio_lib.c:536
0	266	3 : View List ['ERR_new', 'ERR_set_debug', 'ERR_set_error']	0	266	BIO_ctrl	call site: 00197	/src/openssl/crypto/bio/bio_lib.c:666

Runtime coverage analysis

Covered functions

370

Functions that are reachable but not covered

27

Reachable functions

83

Percentage of reachable functions covered

67.47%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/pem.c	1
crypto/bio/bio_lib.c	11
include/internal/refcount.h	3
crypto/ex_data.c	6
crypto/context.c	4
crypto/threads_pthread.c	4
crypto/err/err_blocks.c	4
crypto/err/err_local.h	6
crypto/bio/bio_print.c	9
include/internal/common.h	1
crypto/ctype.c	2
crypto/o_str.c	1
include/internal/cryptlib.h	2
crypto/stack/stack.c	3
include/openssl/crypto.h	2
crypto/pem/pem_lib.c	6
crypto/evp/encode.c	7

Fuzzer: conf

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	73	52.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	65	47.1%
All colors	138	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
438	880	5 : View List ['CRYPTO_free', 'CRYPTO_FREE_REF.6938', 'EVP_RAND_CTX_free', 'EVP_RAND_free', 'CRYPTO_DOWN_REF.6937']	438	880	EVP_RAND_CTX_free	call site: 00000	/src/openssl/crypto/evp/evp_rand.c:390
46	51	6 : View List ['lh_OBJ_NAME_get_down_load', 'lh_OBJ_NAME_doall', 'CRYPTO_THREAD_lock_free', 'lh_OBJ_NAME_set_down_load', 'lh_OBJ_NAME_free', 'sk_NAME_FUNCS_pop_free']	46	51	OBJ_NAME_cleanup	call site: 00000	/src/openssl/crypto/objects/o_names.c:371
40	40	2 : View List ['ossl_strtouint64', 'ossl_strchr']	44	44	OPENSSL_cpuid_setup	call site: 00000	/src/openssl/crypto/cpuid.c:107
14	14	1 : View List ['async_deinit']	14	2924	OPENSSL_cleanup	call site: 00000	/src/openssl/crypto/init.c:431
14	14	2 : View List ['qsort', 'CRYPTO_get_ex_data']	14	17	CRYPTO_free_ex_data	call site: 00111	/src/openssl/crypto/ex_data.c:398
6	6	2 : View List ['sk_EX_CALLBACK_value', 'CRYPTO_malloc']	20	28	CRYPTO_free_ex_data	call site: 00109	/src/openssl/crypto/ex_data.c:385
6	6	2 : View List ['sk_EX_CALLBACK_value', 'CRYPTO_malloc']	18	23	ossl_crypto_new_ex_data_ex	call site: 00092	/src/openssl/crypto/ex_data.c:239
4	4	2 : View List ['free', '__errno_location']	4	4	OPENSSL_DIR_read	call site: 00000	/src/openssl/crypto/LPdir_unix.c:113
2	2	1 : View List ['fclose']	2	2	BIO_new_file	call site: 00000	/src/openssl/crypto/bio/bss_file.c:80
0	621	1 : View List ['ossl_provider_store_free']	0	621	ossl_provider_store_new	call site: 00000	/src/openssl/crypto/provider_core.c:313
0	297	2 : View List ['sk_reserve', 'OPENSSL_sk_free']	0	297	OPENSSL_sk_new_reserve	call site: 00000	/src/openssl/crypto/stack/stack.c:236
0	266	3 : View List ['ERR_new', 'ERR_set_debug', 'ERR_set_error']	0	266	BIO_ctrl	call site: 00000	/src/openssl/crypto/bio/bio_lib.c:666

Runtime coverage analysis

Covered functions

426

Functions that are reachable but not covered

16

Reachable functions

66

Percentage of reachable functions covered

75.76%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/conf.c	1
crypto/conf/conf_lib.c	4
crypto/conf/conf_def.c	1
crypto/err/err_blocks.c	4
crypto/err/err_local.h	6
crypto/bio/bio_print.c	9
include/internal/common.h	1
crypto/ctype.c	1
crypto/o_str.c	1
crypto/bio/bio_lib.c	6
include/internal/refcount.h	3
crypto/ex_data.c	6
crypto/context.c	4
crypto/threads_pthread.c	4
include/internal/cryptlib.h	2
crypto/stack/stack.c	3
include/openssl/crypto.h	2

Fuzzer: smime

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	408	38.5%
gold	[1:9]	52	4.91%
yellow	[10:29]	40	3.78%
greenyellow	[30:49]	49	4.63%
lawngreen	50+	508	48.0%
All colors	1057	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
6320	6320	2 : View List ['EVP_DigestSignInit', 'EVP_DigestVerifyInit']	6320	6586	evp_md_init_internal	call site: 00000	/src/openssl/crypto/evp/digest.c:165
3035	4009	7 : View List ['OPENSSL_sk_num', 'X509_NAME_dup', 'i2d_X509_NAME', 'OPENSSL_sk_value', 'X509_NAME_free', 'X509_NAME_add_entry', 'ossl_check_const_X509_NAME_ENTRY_sk_type.40525']	3035	4009	DIST_POINT_set_dpname	call site: 00000	/src/openssl/crypto/x509/v3_crld.c:491
2719	2738	2 : View List ['CONF_modules_load', 'OSSL_LIB_CTX_get_conf_diagnostics']	2719	2762	CONF_modules_load_file_ex	call site: 00000	/src/openssl/crypto/conf/conf_mod.c:217
2463	2465	8 : View List ['RSA_get0_q', 'RSA_get0_iqmp', 'RSA_get_multi_prime_extra_count', 'RSA_get0_p', 'sk_BIGNUM_const_push', 'sk_RSA_PRIME_INFO_value.38562', 'RSA_get0_dmp1', 'RSA_get0_dmq1']	2463	2465	ossl_rsa_get0_all_params	call site: 00000	/src/openssl/crypto/rsa/rsa_lib.c:887
2389	3686	4 : View List ['EVP_PKEY_free', 'EVP_PKEY_get1_DH', 'DH_free', 'EVP_PKEY_get_id']	2389	3686	ossl_d2i_DH_PUBKEY	call site: 00000	/src/openssl/crypto/x509/x_pubkey.c:654
1904	2298	5 : View List ['EVP_PKEY_CTX_ctrl', 'ENGINE_init', 'ENGINE_get_digest', 'CRYPTO_zalloc', 'ENGINE_finish']	1904	3544	evp_md_init_internal	call site: 00000	/src/openssl/crypto/evp/digest.c:225
1759	2346	14 : View List ['CRYPTO_THREAD_unlock', 'CRYPTO_free', 'DSO_ctrl', 'DSO_load', 'DSO_free', 'DSO_bind_func', 'CRYPTO_THREAD_read_lock', 'ossl_safe_getenv', 'DSO_merge', 'CRYPTO_strdup', 'DSO_new', 'get_provider_store', 'DSO_convert_filename', 'ossl_get_modulesdir']	1767	3162	provider_init	call site: 00000	/src/openssl/crypto/provider_core.c:959
1725	2650	6 : View List ['ERR_set_debug', 'ERR_set_error', 'ERR_new', 'OBJ_obj2nid', 'EVP_get_digestbyname', 'OBJ_nid2sn']	1725	2650	ossl_x509_algor_get_md	call site: 00000	/src/openssl/crypto/asn1/x_algor.c:161
1323	1323	1 : View List ['d2i_DHxparams']	1323	1323	d2i_dhp	call site: 00000	/src/openssl/crypto/dh/dh_ameth.c:40
1319	2184	3 : View List ['ASN1_INTEGER_to_BN', 'EVP_PKEY_assign', 'd2i_ASN1_INTEGER']	1319	3164	dh_pub_decode	call site: 00000	/src/openssl/crypto/dh/dh_ameth.c:85
1000	1484	2 : View List ['ossl_x509_algor_mgf1_decode', 'RSA_PSS_PARAMS_free']	1000	1484	ossl_rsa_pss_decode	call site: 00000	/src/openssl/crypto/rsa/rsa_backend.c:577
877	1247	2 : View List ['def_load_bio', 'BIO_free']	877	1247	def_load	call site: 00000	/src/openssl/crypto/conf/conf_def.c:177

Runtime coverage analysis

Covered functions

1737

Functions that are reachable but not covered

31

Reachable functions

287

Percentage of reachable functions covered

89.2%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/smime.c	1
crypto/pkcs7/pk7_mime.c	2
crypto/pkcs7/pk7_asn1.c	2
crypto/asn1/asn_mime.c	17
crypto/asn1/asn1_local.h	16
crypto/stack/stack.c	23
crypto/err/err_blocks.c	4
crypto/err/err_local.h	6
crypto/bio/bio_print.c	9
include/internal/common.h	1
crypto/ctype.c	3
crypto/o_str.c	2
crypto/bio/bio_lib.c	15
crypto/bsearch.c	1
include/openssl/bio.h	4
include/internal/refcount.h	4
crypto/ex_data.c	6
crypto/context.c	4
crypto/threads_pthread.c	6
include/internal/cryptlib.h	2
include/openssl/crypto.h	2
crypto/evp/bio_b64.c	1
crypto/asn1/a_d2i_fp.c	2
crypto/err/err_mark.c	3
crypto/asn1/asn1_lib.c	13
include/openssl/err.h	1
crypto/asn1/tasn_dec.c	14
include/openssl/asn1t.h	3
crypto/asn1/tasn_fre.c	5
crypto/asn1/a_object.c	3
crypto/asn1/tasn_utl.c	13
crypto/objects/obj_dat.c	13
crypto/objects/obj_local.h	1
crypto/lhash/lhash.c	2
crypto/asn1/a_int.c	11
crypto/asn1/tasn_typ.c	7
crypto/asn1/tasn_new.c	9
crypto/asn1/a_type.c	1
crypto/asn1/a_bitstr.c	2
crypto/pkcs7/pk7_lib.c	8
include/openssl/x509.h	2
crypto/x509/x_x509.c	1
include/openssl/pkcs7.h	2
crypto/x509/x509_cmp.c	3
crypto/x509/x_name.c	2
crypto/asn1/tasn_enc.c	8
crypto/pkcs7/pk7_attr.c	1
crypto/pkcs7/pk7_doit.c	2
crypto/x509/x509_att.c	4
crypto/objects/obj_lib.c	1
include/openssl/asn1.h	3
crypto/asn1/x_algor.c	3

Fuzzer: quic-lcidm

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	638	54.2%
gold	[1:9]	296	25.1%
yellow	[10:29]	27	2.29%
greenyellow	[30:49]	1	0.08%
lawngreen	50+	215	18.2%
All colors	1177	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2719	2738	2 : View List ['CONF_modules_load', 'OSSL_LIB_CTX_get_conf_diagnostics']	2726	2762	CONF_modules_load_file_ex	call site: 00000	/src/openssl/crypto/conf/conf_mod.c:217
1759	2346	14 : View List ['CRYPTO_THREAD_unlock', 'CRYPTO_free', 'DSO_ctrl', 'DSO_load', 'DSO_free', 'DSO_bind_func', 'CRYPTO_THREAD_read_lock', 'ossl_safe_getenv', 'DSO_merge', 'CRYPTO_strdup', 'DSO_new', 'get_provider_store', 'DSO_convert_filename', 'ossl_get_modulesdir']	1767	3162	provider_init	call site: 00570	/src/openssl/crypto/provider_core.c:959
1247	1247	2 : View List ['def_load_bio', 'BIO_free']	1247	1247	def_load	call site: 00000	/src/openssl/crypto/conf/conf_def.c:177
661	661	5 : View List ['BIO_s_file', 'fclose', 'BIO_ctrl', 'BIO_clear_flags', 'BIO_new']	661	661	BIO_new_file	call site: 00000	/src/openssl/crypto/bio/bss_file.c:66
639	639	2 : View List ['sk_INFOPAIR_new_null', 'ossl_provider_info_add_parameter']	639	1578	ossl_provider_new	call site: 00000	/src/openssl/crypto/provider_core.c:574
389	667	6 : View List ['CRYPTO_THREAD_unlock', 'engine_unlocked_finish', 'CRYPTO_THREAD_write_lock', 'ERR_set_debug', 'ERR_new', 'ERR_set_error']	389	667	ENGINE_finish	call site: 00160	/src/openssl/crypto/engine/eng_init.c:110
277	277	1 : View List ['parse_hex']	277	277	parse_value	call site: 00000	/src/openssl/crypto/property/property_parse.c:272
277	277	1 : View List ['parse_oct']	277	277	parse_value	call site: 00000	/src/openssl/crypto/property/property_parse.c:275
273	273	1 : View List ['parse_number']	273	273	parse_value	call site: 00000	/src/openssl/crypto/property/property_parse.c:278
272	272	1 : View List ['parse_string']	272	272	parse_value	call site: 00000	/src/openssl/crypto/property/property_parse.c:262
73	73	1 : View List ['ossl_method_cache_flush_some']	97	149	ossl_method_store_cache_set	call site: 00807	/src/openssl/crypto/property/property.c:892
40	40	2 : View List ['ossl_strtouint64', 'ossl_strchr']	44	44	OPENSSL_cpuid_setup	call site: 00000	/src/openssl/crypto/cpuid.c:107

Runtime coverage analysis

Covered functions

981

Functions that are reachable but not covered

149

Reachable functions

504

Percentage of reachable functions covered

70.44%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/quic-lcidm.c	2
include/internal/packet.h	9
ssl/quic/quic_lcidm.c	48
crypto/rand/rand_lib.c	12
crypto/threads_pthread.c	13
providers/implementations/rands/seeding/rand_unix.c	1
include/internal/common.h	1
crypto/engine/tb_rand.c	2
crypto/engine/eng_table.c	4
crypto/err/err_mark.c	2
crypto/engine/eng_local.h	7
crypto/lhash/lhash.c	18
crypto/engine/eng_init.c	3
include/internal/refcount.h	4
crypto/stack/stack.c	20
crypto/engine/eng_lib.c	1
crypto/engine/tb_pkmeth.c	1
crypto/evp/pmeth_lib.c	1
crypto/engine/tb_asnmth.c	1
crypto/asn1/ameth_lib.c	4
crypto/engine/eng_list.c	1
crypto/ex_data.c	4
crypto/context.c	8
crypto/err/err_blocks.c	4
crypto/err/err_local.h	6
crypto/bio/bio_print.c	10
crypto/ctype.c	2
crypto/o_str.c	5
include/internal/cryptlib.h	2
include/openssl/crypto.h	2
crypto/rand/rand_meth.c	1
crypto/provider_core.c	30
crypto/evp/evp_rand.c	20
crypto/evp/evp_fetch.c	5
crypto/core_namemap.c	15
crypto/objects/o_names.c	10
crypto/objects/obj_local.h	9
crypto/evp/evp_lib.c	3
crypto/objects/obj_dat.c	17
crypto/asn1/a_object.c	1
include/crypto/asn1.h	2
crypto/bsearch.c	1
crypto/bn/bn_word.c	3
crypto/bn/bn_lib.c	18
crypto/bn/bn_local.h	1
crypto/bn/bn_shift.c	2
crypto/bn/bn_conv.c	1
include/internal/constant_time.h	4
crypto/bn/asm/x86_64-gcc.c	1
include/internal/hashtable.h	1
crypto/hashtable/hashtable.c	11
include/openssl/safestack.h	4
crypto/property/property.c	27
crypto/sparse_array.c	7
crypto/core_fetch.c	7
crypto/core_algorithm.c	4
crypto/initthread.c	13
crypto/dso/dso_lib.c	9
crypto/provider_local.h	2
crypto/provider_child.c	2
crypto/dso/dso_dlfcn.c	1
crypto/getenv.c	1
crypto/defaults.c	1
include/openssl/core_dispatch.h	28
include/openssl/err.h	1
crypto/provider.c	1
crypto/encode_decode/decoder_pkey.c	4
crypto/encode_decode/decoder_meth.c	2
crypto/encode_decode/encoder_local.h	1
crypto/encode_decode/decoder_lib.c	1
crypto/passphrase.c	2
crypto/params.c	9
crypto/siphash/siphash.c	5
include/internal/quic_types.h	1

Fuzzer: punycode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	13	100.%
All colors	13	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	None	6	41	ossl_a2ulabel	call site: 00007	/src/openssl/crypto/punycode.c:263
0	0	None	6	41	ossl_a2ulabel	call site: 00007	/src/openssl/crypto/punycode.c:266
0	0	None	0	0	ossl_punycode_decode	call site: 00004	/src/openssl/crypto/punycode.c:173
0	0	None	0	0	ossl_assert_int	call site: 00007	/src/openssl/include/internal/common.h:46

Runtime coverage analysis

Covered functions

24

Functions that are reachable but not covered

3

Reachable functions

12

Percentage of reachable functions covered

75.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/punycode.c	1
crypto/punycode.c	6
include/internal/common.h	1

Fuzzer: crl

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	410	34.3%
gold	[1:9]	7	0.58%
yellow	[10:29]	13	1.08%
greenyellow	[30:49]	8	0.67%
lawngreen	50+	755	63.2%
All colors	1193	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
6320	6320	2 : View List ['EVP_DigestSignInit', 'EVP_DigestVerifyInit']	6320	6586	evp_md_init_internal	call site: 00000	/src/openssl/crypto/evp/digest.c:165
2719	2738	2 : View List ['CONF_modules_load', 'OSSL_LIB_CTX_get_conf_diagnostics']	2726	2762	CONF_modules_load_file_ex	call site: 00000	/src/openssl/crypto/conf/conf_mod.c:217
2661	3066	7 : View List ['CRYPTO_free', 'evp_pkey_ctx_free_all_cached_data', 'ENGINE_finish', 'EVP_KEYMGMT_free', 'EVP_PKEY_free', 'BN_free', 'evp_pkey_ctx_free_old_ops']	2661	3066	EVP_PKEY_CTX_free	call site: 00000	/src/openssl/crypto/evp/pmeth_lib.c:393
2008	2008	1 : View List ['i2r_HASH']	2008	2008	i2r_INFO_SYNTAX_POINTER	call site: 00000	/src/openssl/crypto/x509/v3_attrdesc.c:83
1904	2298	5 : View List ['EVP_PKEY_CTX_ctrl', 'ENGINE_init', 'ENGINE_get_digest', 'CRYPTO_zalloc', 'ENGINE_finish']	1904	3544	evp_md_init_internal	call site: 00000	/src/openssl/crypto/evp/digest.c:225
1759	2346	14 : View List ['CRYPTO_THREAD_unlock', 'CRYPTO_free', 'DSO_ctrl', 'DSO_load', 'DSO_free', 'DSO_bind_func', 'CRYPTO_THREAD_read_lock', 'ossl_safe_getenv', 'DSO_merge', 'CRYPTO_strdup', 'DSO_new', 'get_provider_store', 'DSO_convert_filename', 'ossl_get_modulesdir']	1767	3162	provider_init	call site: 00000	/src/openssl/crypto/provider_core.c:959
877	1247	2 : View List ['def_load_bio', 'BIO_free']	877	1247	def_load	call site: 00000	/src/openssl/crypto/conf/conf_def.c:177
737	737	2 : View List ['ENGINE_get_pkey_asn1_meth_engine', 'ENGINE_get_pkey_asn1_meth']	737	737	EVP_PKEY_asn1_find	call site: 00734	/src/openssl/crypto/asn1/ameth_lib.c:91
598	598	2 : View List ['EVP_DigestVerifyUpdate', 'EVP_DigestSignUpdate']	598	864	EVP_DigestUpdate	call site: 00000	/src/openssl/crypto/evp/digest.c:395
438	880	5 : View List ['CRYPTO_free', 'CRYPTO_FREE_REF.6938', 'EVP_RAND_CTX_free', 'EVP_RAND_free', 'CRYPTO_DOWN_REF.6937']	438	880	EVP_RAND_CTX_free	call site: 00000	/src/openssl/crypto/evp/evp_rand.c:390
389	667	6 : View List ['CRYPTO_THREAD_unlock', 'engine_unlocked_finish', 'CRYPTO_THREAD_write_lock', 'ERR_set_debug', 'ERR_new', 'ERR_set_error']	389	667	ENGINE_finish	call site: 00000	/src/openssl/crypto/engine/eng_init.c:110
277	277	1 : View List ['parse_hex']	277	277	parse_value	call site: 00000	/src/openssl/crypto/property/property_parse.c:272

Runtime coverage analysis

Covered functions

1544

Functions that are reachable but not covered

64

Reachable functions

379

Percentage of reachable functions covered

83.11%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/crl.c	1
crypto/x509/x_crl.c	4
crypto/asn1/tasn_dec.c	14
crypto/err/err_blocks.c	4
crypto/err/err_local.h	6
crypto/bio/bio_print.c	12
include/internal/common.h	1
crypto/ctype.c	3
crypto/o_str.c	3
crypto/asn1/asn1_lib.c	14
crypto/stack/stack.c	21
include/openssl/asn1t.h	3
crypto/asn1/tasn_fre.c	5
crypto/asn1/a_object.c	6
crypto/asn1/tasn_utl.c	13
include/internal/refcount.h	4
crypto/threads_pthread.c	6
crypto/objects/obj_dat.c	16
crypto/bsearch.c	1
crypto/objects/obj_local.h	1
crypto/lhash/lhash.c	4
crypto/asn1/a_int.c	10
crypto/asn1/tasn_typ.c	16
crypto/asn1/tasn_new.c	9
crypto/asn1/a_type.c	1
crypto/asn1/a_bitstr.c	2
crypto/bio/bss_null.c	1
crypto/bio/bio_lib.c	11
crypto/ex_data.c	6
crypto/context.c	4
include/internal/cryptlib.h	2
include/openssl/crypto.h	2
crypto/x509/t_crl.c	2
crypto/x509/x509cset.c	10
crypto/x509/t_x509.c	2
crypto/bn/bn_word.c	3
crypto/bn/bn_lib.c	18
crypto/bn/bn_local.h	1
crypto/bn/bn_shift.c	2
crypto/bn/bn_conv.c	1
include/internal/constant_time.h	4
crypto/bn/asm/x86_64-gcc.c	1
crypto/bio/bio_dump.c	5
crypto/objects/obj_xref.c	8
crypto/objects/obj_xref.h	2
crypto/asn1/ameth_lib.c	6
include/crypto/asn1.h	2
crypto/engine/tb_asnmth.c	4
crypto/engine/eng_table.c	4
crypto/err/err_mark.c	2
crypto/engine/eng_local.h	7
crypto/engine/eng_init.c	2
crypto/engine/eng_lib.c	1
crypto/engine/tb_pkmeth.c	1
crypto/evp/pmeth_lib.c	1
crypto/engine/eng_list.c	1
crypto/asn1/a_strex.c	9
crypto/x509/x_name.c	1
crypto/x509/x509_obj.c	1
include/openssl/x509.h	3
include/internal/to_hex.h	1
crypto/x509/x509name.c	5
crypto/asn1/asn1_parse.c	4
crypto/asn1/tasn_enc.c	8
crypto/asn1/asn1_local.h	3
crypto/asn1/a_utf8.c	2
include/internal/unicode.h	1
crypto/asn1/a_time.c	6
crypto/o_time.c	4
crypto/x509/v3_prn.c	4
crypto/x509/x509_v3.c	3
crypto/x509/v3_lib.c	5
include/openssl/x509v3.h	3
crypto/bio/bf_prefix.c	1
include/openssl/conf.h	3
crypto/x509/v3_utl.c	1
crypto/asn1/a_print.c	1
crypto/asn1/f_int.c	1

Fuzzer: ml-kem

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	3	100.%
All colors	3	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
6320	6320	2 : View List ['EVP_DigestSignInit', 'EVP_DigestVerifyInit']	6320	6586	evp_md_init_internal	call site: 00000	/src/openssl/crypto/evp/digest.c:165
3279	3293	2 : View List ['hash_h', 'encode_pubkey']	3285	3299	genkey	call site: 00000	/src/openssl/crypto/ml_kem/ml_kem.c:1385
2719	2738	2 : View List ['CONF_modules_load', 'OSSL_LIB_CTX_get_conf_diagnostics']	2719	2762	CONF_modules_load_file_ex	call site: 00000	/src/openssl/crypto/conf/conf_mod.c:217
2417	3291	4 : View List ['EVP_PKEY_missing_parameters', 'EVP_PKEY_free', 'EVP_PKEY_up_ref', 'EVP_PKEY_parameters_eq']	2417	4355	EVP_PKEY_derive_set_peer_ex	call site: 00000	/src/openssl/crypto/evp/exchange.c:454
2058	2058	2 : View List ['CRYPTO_free', 'ossl_cipher_tlsunpadblock']	2058	3654	ossl_cipher_generic_block_update	call site: 00000	/src/openssl/providers/implementations/ciphers/ciphercommon.c:435
1904	2298	5 : View List ['EVP_PKEY_CTX_ctrl', 'ENGINE_init', 'ENGINE_get_digest', 'CRYPTO_zalloc', 'ENGINE_finish']	1904	3544	evp_md_init_internal	call site: 00000	/src/openssl/crypto/evp/digest.c:225
1759	2346	14 : View List ['CRYPTO_THREAD_unlock', 'CRYPTO_free', 'DSO_ctrl', 'DSO_load', 'DSO_free', 'DSO_bind_func', 'CRYPTO_THREAD_read_lock', 'ossl_safe_getenv', 'DSO_merge', 'CRYPTO_strdup', 'DSO_new', 'get_provider_store', 'DSO_convert_filename', 'ossl_get_modulesdir']	1767	3162	provider_init	call site: 00000	/src/openssl/crypto/provider_core.c:959
1745	2062	2 : View List ['EVP_CIPHER_fetch', 'OBJ_nid2sn']	2340	7490	evp_cipher_init_internal	call site: 00000	/src/openssl/crypto/evp/evp_enc.c:186
1745	1759	2 : View List ['EVP_CIPHER_fetch', 'ERR_pop_to_mark']	1745	5385	drbg_ctr_set_ctx_params_locked	call site: 00000	/src/openssl/providers/implementations/rands/drbg_ctr.c:783
1247	1247	2 : View List ['def_load_bio', 'BIO_free']	1247	1247	def_load	call site: 00000	/src/openssl/crypto/conf/conf_def.c:177
1140	1457	6 : View List ['evp_pkey_meth_find_added_by_application', 'EVP_PKEY_meth_find', 'ENGINE_init', 'ENGINE_get_pkey_meth_engine', 'OBJ_nid2sn', 'ENGINE_get_pkey_meth']	1140	8074	int_ctx_new	call site: 00000	/src/openssl/crypto/evp/pmeth_lib.c:188
885	885	8 : View List ['EVP_CIPHER_get_mode', 'ENGINE_get_cipher', 'ENGINE_init', 'EVP_CIPHER_CTX_ctrl', 'OPENSSL_die', 'CRYPTO_zalloc', 'EVP_CIPHER_CTX_get0_cipher', 'EVP_CIPHER_get_flags']	885	4190	evp_cipher_init_internal	call site: 00000	/src/openssl/crypto/evp/evp_enc.c:146

Runtime coverage analysis

Covered functions

1579

Functions that are reachable but not covered

0

Reachable functions

3

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/ml-kem.c	2

Fuzzer: server

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4405	63.1%
gold	[1:9]	380	5.45%
yellow	[10:29]	106	1.52%
greenyellow	[30:49]	41	0.58%
lawngreen	50+	2039	29.2%
All colors	6971	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
12377	21495	15 : View List ['X509_cmp', 'get1_trusted_issuer', 'OPENSSL_sk_delete_ptr', 'ERR_set_debug', 'ERR_set_error', 'ERR_new', 'ossl_check_X509_type', 'OPENSSL_sk_pop', 'OPENSSL_sk_set', 'check_dane_issuer', 'get0_best_issuer_sk', 'X509_free', 'OPENSSL_sk_push', 'X509_add_cert', 'ossl_assert_int.12236']	16628	52984	build_chain	call site: 00000	/src/openssl/crypto/x509/x509_vfy.c:3518
9914	10415	5 : View List ['OSSL_STACK_OF_X509_free', 'get0_best_issuer_sk', 'X509_up_ref', 'ossl_x509_check_cert_time', 'X509_STORE_CTX_get1_certs']	9914	10907	X509_STORE_CTX_get1_issuer	call site: 00000	/src/openssl/crypto/x509/x509_vfy.c:444
9084	9095	6 : View List ['X509_chain_check_suiteb', 'internal_verify', 'X509v3_asid_validate_path', 'verify_cb_cert', 'X509v3_addr_validate_path', 'check_name_constraints']	9084	9095	verify_chain	call site: 00000	/src/openssl/crypto/x509/x509_vfy.c:238
6800	6803	5 : View List ['BN_is_bit_set', 'BN_clear_bit', 'BN_is_word', 'ossl_ffc_params_simple_validate', 'BN_priv_rand_ex']	6800	10186	generate_key	call site: 00000	/src/openssl/crypto/dh/dh_key.c:313
6320	6320	2 : View List ['EVP_DigestSignInit', 'EVP_DigestVerifyInit']	6320	6586	evp_md_init_internal	call site: 03592	/src/openssl/crypto/evp/digest.c:165
6068	6940	2 : View List ['EVP_PKEY_Q_keygen', 'mlx_kem_key_free']	6068	6940	mlx_kem_gen	call site: 00000	/src/openssl/providers/implementations/keymgmt/mlx_kmgmt.c:710
4916	8006	6 : View List ['EVP_PKEY_get_bn_param', 'ssl_get_auto_dh', 'EVP_PKEY_get_security_bits', 'ssl_generate_pkey', 'ssl_dh_to_pkey', 'ssl_security']	4918	42685	tls_construct_server_key_exchange	call site: 00000	/src/openssl/ssl/statem/statem_srvr.c:2571
4444	6478	4 : View List ['ossl_statem_fatal', 'ssl_srp_server_param_with_username_intern', 'ERR_set_debug', 'ERR_new']	4444	6478	ssl_check_srp_ext_ClientHello	call site: 00000	/src/openssl/ssl/statem/statem_srvr.c:1360
4332	4332	1 : View List ['d2i_ECParameters']	4332	5144	ossl_ec_key_param_from_x509_algor	call site: 00000	/src/openssl/crypto/ec/ec_backend.c:774
4318	4324	4 : View List ['X509_cmp', 'ossl_check_const_X509_sk_type.41693', 'OPENSSL_sk_value', 'OPENSSL_sk_num']	4318	9940	X509_add_cert	call site: 00000	/src/openssl/crypto/x509/x509_cmp.c:201
4262	4338	3 : View List ['EC_GROUP_get_curve_name', 'EC_GROUP_free', 'd2i_ECPKParameters']	4262	4338	ossl_x509_algor_is_sm2	call site: 00000	/src/openssl/crypto/ec/ec_backend.c:738
4194	4194	4 : View List ['ossl_ml_kem_set_seed', 'ossl_ml_kem_genkey', 'check_seed', 'check_prvenc']	4194	4194	ml_kem_key_fromdata	call site: 00000	/src/openssl/providers/implementations/keymgmt/ml_kem_kmgmt.c:486

Runtime coverage analysis

Covered functions

4297

Functions that are reachable but not covered

848

Reachable functions

2095

Percentage of reachable functions covered

59.52%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/server.c	1
ssl/methods.c	1
ssl/ssl_lib.c	49
crypto/err/err_blocks.c	4
crypto/err/err_local.h	6
crypto/bio/bio_print.c	12
include/internal/common.h	3
crypto/ctype.c	3
crypto/o_str.c	12
ssl/ssl_init.c	3
ssl/ssl_ciph.c	20
crypto/context.c	12
crypto/threads_pthread.c	14
ssl/s3_lib.c	3
ssl/ssl_cert.c	12
crypto/ex_data.c	9
include/internal/cryptlib.h	6
crypto/stack/stack.c	28
include/internal/refcount.h	5
ssl/ssl_local.h	13
crypto/lhash/lhash.c	19
crypto/x509/x509_lu.c	7
include/openssl/x509_vfy.h	5
crypto/x509/x509_cmp.c	9
crypto/x509/x_name.c	7
crypto/asn1/tasn_enc.c	8
crypto/asn1/asn1_local.h	3
crypto/asn1/a_bitstr.c	2
crypto/asn1/a_int.c	11
crypto/asn1/asn1_lib.c	15
crypto/asn1/tasn_utl.c	13
crypto/objects/obj_dat.c	33
crypto/bsearch.c	1
crypto/objects/obj_local.h	17
crypto/x509/x509_vpm.c	3
include/openssl/crypto.h	3
include/openssl/asn1.h	6
crypto/asn1/a_object.c	6
include/openssl/safestack.h	4
crypto/ct/ct_log.c	3
include/openssl/ct.h	2
crypto/evp/p_lib.c	34
crypto/evp/keymgmt_lib.c	16
include/crypto/evp.h	7
crypto/evp/keymgmt_meth.c	29
crypto/provider_core.c	31
crypto/initthread.c	13
crypto/dso/dso_lib.c	9
crypto/provider_local.h	2
crypto/provider_child.c	2
crypto/asn1/ameth_lib.c	10
include/crypto/asn1.h	3
crypto/engine/tb_asnmth.c	6
crypto/engine/eng_table.c	8
crypto/err/err_mark.c	4
crypto/engine/eng_local.h	8
crypto/engine/eng_init.c	4
crypto/engine/eng_lib.c	4
crypto/engine/tb_pkmeth.c	4
crypto/evp/pmeth_lib.c	30
crypto/engine/eng_list.c	1
include/openssl/x509.h	10
crypto/x509/x_attrib.c	2
crypto/asn1/tasn_fre.c	5
include/openssl/asn1t.h	3
ssl/tls_depr.c	3
crypto/engine/tb_cipher.c	3
crypto/evp/evp_enc.c	33
crypto/evp/evp_fetch.c	10
crypto/core_namemap.c	16
crypto/objects/o_names.c	10
crypto/evp/evp_lib.c	26
crypto/bn/bn_word.c	4
crypto/bn/bn_lib.c	20
crypto/bn/bn_local.h	1
crypto/bn/bn_shift.c	2
crypto/bn/bn_conv.c	1
include/internal/constant_time.h	4
crypto/bn/asm/x86_64-gcc.c	2
include/internal/hashtable.h	1
crypto/hashtable/hashtable.c	11
crypto/property/property.c	38
crypto/sparse_array.c	8
crypto/core_fetch.c	7
crypto/core_algorithm.c	4
crypto/dso/dso_dlfcn.c	1
crypto/getenv.c	1
crypto/defaults.c	4
include/openssl/core_dispatch.h	142
include/openssl/err.h	2
crypto/rand/rand_lib.c	14
crypto/provider.c	4
crypto/encode_decode/decoder_pkey.c	24
crypto/encode_decode/decoder_meth.c	20
crypto/encode_decode/encoder_local.h	6
crypto/encode_decode/decoder_lib.c	30
crypto/passphrase.c	9
crypto/params.c	31
crypto/evp/evp_utils.c	6
crypto/engine/tb_digest.c	3
crypto/evp/digest.c	23
crypto/evp/signature.c	13
crypto/evp/exchange.c	8
ssl/t1_lib.c	18
crypto/conf/conf_mod.c	1
ssl/statem/statem_lib.c	1
crypto/objects/obj_lib.c	2
crypto/objects/obj_xref.c	11
crypto/objects/obj_xref.h	5
crypto/evp/kem.c	2
crypto/evp/asymcipher.c	2
include/openssl/ssl.h	5
crypto/bio/bio_lib.c	23
providers/implementations/rands/seeding/rand_unix.c	1
crypto/engine/tb_rand.c	2
crypto/rand/rand_meth.c	1
crypto/evp/evp_rand.c	20
ssl/tls_srp.c	2
ssl/quic/quic_method.c	3
ssl/quic/quic_impl.c	66
crypto/hashtable/hashfunc.c	1
crypto/thread/arch/thread_posix.c	11
ssl/ssl_mcnf.c	2
crypto/conf/conf_ssl.c	3
ssl/ssl_conf.c	14
ssl/quic/quic_obj.c	6
ssl/ssl_rsa.c	7
crypto/bio/bss_file.c	3
crypto/pem/pem_pkey.c	5
crypto/bio/bf_readbuff.c	1
crypto/bio/ossl_core_bio.c	3
crypto/ui/ui_util.c	10
crypto/ui/ui_lib.c	29
crypto/ui/ui_openssl.c	1
crypto/ui/ui_null.c	1
include/openssl/ui.h	4
crypto/err/err_prn.c	3
include/internal/to_hex.h	1
crypto/pem/pem_lib.c	15
crypto/evp/encode.c	7
crypto/evp/names.c	6
crypto/evp/evp_key.c	3
crypto/evp/legacy_md5.c	1
crypto/evp/m_sigver.c	6
crypto/evp/ctrl_params_translate.c	8
crypto/asn1/p8_pkey.c	4
crypto/asn1/tasn_dec.c	14
crypto/asn1/tasn_typ.c	9
crypto/asn1/tasn_new.c	9
crypto/asn1/a_type.c	1
crypto/evp/evp_pkey.c	1
crypto/asn1/x_sig.c	4
crypto/pkcs12/p12_p8d.c	2
crypto/pkcs12/p12_decr.c	2
crypto/evp/evp_pbe.c	5
crypto/evp/evp_local.h	3
crypto/asn1/d2i_pr.c	4
crypto/x509/x_pubkey.c	8
crypto/x509/x_all.c	2
crypto/asn1/a_d2i_fp.c	1
ssl/ssl_sess.c	9
include/internal/time.h	17
crypto/x509/x_x509.c	3
crypto/x509/t_x509.c	1
crypto/x509/x_crl.c	2
ssl/statem/extensions_cust.c	4
crypto/rsa/rsa_asn1.c	2
crypto/ec/ec_key.c	4
crypto/ec/ec_lib.c	4
crypto/rsa/rsa_backend.c	1
crypto/rsa/rsa_lib.c	1
crypto/rsa/rsa_ossl.c	1
crypto/ec/ec_backend.c	1
crypto/ec/ec_kmeth.c	2
crypto/dsa/dsa_backend.c	1
crypto/dsa/dsa_lib.c	3
crypto/dsa/dsa_ossl.c	1
crypto/dh/dh_backend.c	1
crypto/dh/dh_lib.c	1
crypto/dh/dh_key.c	1
crypto/x509/v3_purp.c	13
crypto/evp/legacy_sha.c	1
crypto/asn1/a_digest.c	1
crypto/x509/x509_set.c	6
crypto/x509/x509_ext.c	4
crypto/x509/v3_lib.c	7
crypto/x509/x509_v3.c	7
include/openssl/x509v3.h	8
crypto/x509/v3_bcons.c	2
crypto/x509/v3_pcia.c	2
crypto/asn1/a_octet.c	1
crypto/x509/v3_crld.c	1
crypto/asn1/a_dup.c	1
crypto/x509/x509name.c	1
crypto/pem/pem_all.c	4
crypto/evp/p_legacy.c	2
crypto/ec/ecp_nistz256.c	1
crypto/ec/ecp_nistp224.c	1
crypto/ec/ecp_nistp256.c	1
crypto/ec/ecp_nistp384.c	1
crypto/ec/ecp_nistp521.c	1
crypto/ec/ec_mult.c	1
crypto/bn/bn_mont.c	1
crypto/pem/pem_x509.c	1
crypto/pem/pem_oth.c	1
crypto/ffc/ffc_params.c	2
ssl/quic/quic_channel.c	32
ssl/quic/quic_port.c	17
crypto/err/err_save.c	4
ssl/quic/quic_obj_local.h	4
ssl/quic/quic_engine.c	8
crypto/bio/bio_addr.c	6
ssl/quic/quic_txp.c	5
ssl/quic/quic_record_tx.c	3
ssl/quic/quic_record_util.c	11
crypto/evp/kdf_meth.c	7
crypto/evp/kdf_lib.c	3
ssl/tls13_enc.c	2
ssl/quic/quic_record_rx.c	7
ssl/quic/quic_record_shared.c	7
ssl/quic/quic_wire_pkt.c	2
include/internal/quic_demux.h	3
ssl/quic/quic_wire.c	5
include/internal/quic_vlint.h	1
ssl/quic/quic_fc.c	14
ssl/quic/quic_tls.c	8
ssl/quic/qlog.c	35
ssl/quic/json_enc.c	44
crypto/o_fopen.c	1
crypto/cversion.c	1
crypto/info.c	3
ssl/quic/qlog_event_helpers.c	5
ssl/statem/statem.c	8
crypto/bio/bss_null.c	1
ssl/quic/quic_reactor.c	18
ssl/quic/quic_demux.c	2
ssl/quic/quic_stream_map.c	10
ssl/rio/rio_notifier.c	2
include/internal/rio_notifier.h	1
crypto/time.c	1
crypto/bio/bss_fd.c	1
ssl/quic/quic_statm.c	1
include/internal/quic_stream_map.h	3
ssl/quic/quic_rstream.c	3
ssl/quic/quic_sstream.c	3
include/internal/ring_buf.h	7
ssl/quic/uint_set.c	2
include/internal/uint_set.h	3
ssl/quic/quic_sf_list.c	3
ssl/record/rec_layer_s3.c	10
ssl/s3_msg.c	1
ssl/t1_enc.c	1
ssl/record/rec_layer_d1.c	2
ssl/pqueue.c	3
crypto/bio/bss_dgram_pair.c	1
crypto/async/async.c	13
crypto/async/async_wait.c	2
crypto/async/async_local.h	4
crypto/async/arch/async_posix.c	3
crypto/async/arch/async_posix.h	1
ssl/quic/quic_ackm.c	1
ssl/quic/quic_thread_assist.c	2
crypto/thread/arch.c	1

Fuzzer: provider

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1553	66.1%
gold	[1:9]	118	5.02%
yellow	[10:29]	74	3.15%
greenyellow	[30:49]	29	1.23%
lawngreen	50+	572	24.3%
All colors	2346	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
6320	6320	2 : View List ['EVP_DigestSignInit', 'EVP_DigestVerifyInit']	6320	6586	evp_md_init_internal	call site: 00035	/src/openssl/crypto/evp/digest.c:165
5654	10413	11 : View List ['CRYPTO_free', 'ossl_drbg_set_ctx_params', 'ERR_pop_to_mark', 'CRYPTO_strndup', 'ERR_set_mark', 'drbg_ctr_init', 'strcpy', 'EVP_CIPHER_fetch', 'EVP_CIPHER_free', 'ERR_clear_last_mark', 'evp_cipher_fetch_from_prov']	5654	11975	drbg_ctr_set_ctx_params_locked	call site: 00000	/src/openssl/providers/implementations/rands/drbg_ctr.c:757
3854	5896	9 : View List ['EVP_MAC_free', 'ossl_provider_find', 'EVP_MAC_CTX_new', 'EVP_MD_free', 'EVP_MAC_CTX_free', 'evp_digest_fetch_from_prov', 'evp_mac_fetch_from_prov', 'ossl_provider_free', 'OSSL_PARAM_locate_const']	3854	5896	drbg_fetch_algs_from_prov	call site: 00000	/src/openssl/providers/implementations/rands/drbg_hmac.c:427
3364	3366	2 : View List ['ossl_prov_digest_md', 'SSKDF_hash_kdm']	3364	3632	x963kdf_derive	call site: 00000	/src/openssl/providers/implementations/kdfs/sskdf.c:536
3364	3364	1 : View List ['SSKDF_hash_kdm']	3364	3630	sskdf_derive	call site: 00000	/src/openssl/providers/implementations/kdfs/sskdf.c:428
2719	2738	2 : View List ['CONF_modules_load', 'OSSL_LIB_CTX_get_conf_diagnostics']	2719	2762	CONF_modules_load_file_ex	call site: 00000	/src/openssl/crypto/conf/conf_mod.c:217
2407	3647	5 : View List ['ERR_set_debug', 'EVP_MD_CTX_reset', 'ERR_set_error', 'ERR_new', 'EVP_PKEY_CTX_dup']	2407	3647	EVP_MD_CTX_copy_ex	call site: 00000	/src/openssl/crypto/evp/digest.c:657
2225	3066	7 : View List ['CRYPTO_free', 'evp_pkey_ctx_free_all_cached_data', 'ENGINE_finish', 'EVP_KEYMGMT_free', 'EVP_PKEY_free', 'BN_free', 'evp_pkey_ctx_free_old_ops']	2225	3066	EVP_PKEY_CTX_free	call site: 01053	/src/openssl/crypto/evp/pmeth_lib.c:393
2222	2222	1 : View List ['CMAC_Init']	2222	2222	cmac_init	call site: 00000	/src/openssl/providers/implementations/macs/cmac_prov.c:177
2210	3091	5 : View List ['evp_digest_fetch_from_prov', 'ossl_provider_find', 'EVP_MD_free', 'ossl_provider_free', 'OSSL_PARAM_locate_const']	2210	3091	drbg_fetch_digest_from_prov	call site: 00000	/src/openssl/providers/implementations/rands/drbg_hash.c:522
2058	2058	2 : View List ['CRYPTO_free', 'ossl_cipher_tlsunpadblock']	2058	3654	ossl_cipher_generic_block_update	call site: 00000	/src/openssl/providers/implementations/ciphers/ciphercommon.c:435
1904	2298	5 : View List ['EVP_PKEY_CTX_ctrl', 'ENGINE_init', 'ENGINE_get_digest', 'CRYPTO_zalloc', 'ENGINE_finish']	1904	3544	evp_md_init_internal	call site: 00036	/src/openssl/crypto/evp/digest.c:225

Runtime coverage analysis

Covered functions

2136

Functions that are reachable but not covered

281

Reachable functions

820

Percentage of reachable functions covered

65.73%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/provider.c	37
crypto/stack/stack.c	22
crypto/evp/digest.c	25
crypto/evp/evp_lib.c	23
crypto/provider_core.c	29
crypto/o_str.c	6
crypto/evp/m_sigver.c	6
include/internal/common.h	1
crypto/err/err_blocks.c	4
crypto/err/err_local.h	6
crypto/bio/bio_print.c	10
crypto/ctype.c	2
crypto/evp/pmeth_lib.c	30
crypto/evp/keymgmt_meth.c	23
crypto/evp/p_lib.c	13
crypto/objects/obj_dat.c	25
crypto/bsearch.c	1
crypto/threads_pthread.c	12
crypto/objects/obj_local.h	9
crypto/lhash/lhash.c	17
crypto/asn1/ameth_lib.c	9
include/crypto/asn1.h	3
crypto/engine/tb_asnmth.c	4
crypto/engine/eng_table.c	4
crypto/err/err_mark.c	3
crypto/engine/eng_local.h	7
crypto/engine/eng_init.c	4
include/internal/refcount.h	4
crypto/engine/eng_lib.c	3
crypto/engine/tb_pkmeth.c	4
crypto/engine/eng_list.c	1
crypto/ex_data.c	4
crypto/context.c	8
include/internal/cryptlib.h	2
include/openssl/crypto.h	2
include/crypto/evp.h	7
crypto/evp/evp_fetch.c	8
crypto/core_namemap.c	16
crypto/objects/o_names.c	10
crypto/asn1/a_object.c	1
crypto/bn/bn_word.c	3
crypto/bn/bn_lib.c	18
crypto/bn/bn_local.h	1
crypto/bn/bn_shift.c	2
crypto/bn/bn_conv.c	1
include/internal/constant_time.h	4
crypto/bn/asm/x86_64-gcc.c	1
include/internal/hashtable.h	1
crypto/hashtable/hashtable.c	11
include/openssl/safestack.h	4
crypto/property/property.c	27
crypto/sparse_array.c	7
crypto/core_fetch.c	7
crypto/core_algorithm.c	4
crypto/initthread.c	9
crypto/dso/dso_lib.c	9
crypto/provider_local.h	2
crypto/provider_child.c	2
crypto/dso/dso_dlfcn.c	1
crypto/getenv.c	1
crypto/defaults.c	1
include/openssl/core_dispatch.h	102
include/openssl/err.h	1
crypto/rand/rand_lib.c	3
crypto/provider.c	1
crypto/encode_decode/decoder_pkey.c	4
crypto/encode_decode/decoder_meth.c	2
crypto/encode_decode/encoder_local.h	1
crypto/encode_decode/decoder_lib.c	1
crypto/passphrase.c	2
crypto/evp/signature.c	14
crypto/evp/exchange.c	3
crypto/evp/kem.c	3
crypto/evp/asymcipher.c	3
crypto/evp/keymgmt_lib.c	10
include/openssl/x509.h	2
crypto/x509/x_attrib.c	2
crypto/asn1/tasn_fre.c	4
include/openssl/asn1t.h	2
crypto/asn1/asn1_lib.c	1
crypto/asn1/tasn_utl.c	6
crypto/asn1/a_int.c	5
crypto/params.c	18
crypto/evp/evp_utils.c	6
crypto/evp/names.c	3
crypto/evp/ctrl_params_translate.c	8
crypto/engine/tb_digest.c	3
crypto/params_dup.c	1
crypto/evp/evp_enc.c	29
crypto/engine/tb_cipher.c	3
crypto/evp/kdf_meth.c	5
crypto/evp/kdf_lib.c	5
crypto/evp/mac_meth.c	6
crypto/evp/mac_lib.c	9
crypto/evp/evp_rand.c	18

Fuzzer: x509

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2566	49.9%
gold	[1:9]	234	4.55%
yellow	[10:29]	122	2.37%
greenyellow	[30:49]	96	1.86%
lawngreen	50+	2116	41.2%
All colors	5134	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
4319	4624	5 : View List ['check_sig_level', 'verify_cb_cert', 'OPENSSL_sk_value', 'ossl_check_const_X509_sk_type.12230', 'check_cert_key_level']	4319	4624	check_auth_level	call site: 04457	/src/openssl/crypto/x509/x509_vfy.c:193
3160	6320	2 : View List ['EVP_DigestSignInit', 'EVP_DigestVerifyInit']	3160	6586	evp_md_init_internal	call site: 02312	/src/openssl/crypto/evp/digest.c:165
2719	2738	2 : View List ['CONF_modules_load', 'OSSL_LIB_CTX_get_conf_diagnostics']	2719	2762	CONF_modules_load_file_ex	call site: 00000	/src/openssl/crypto/conf/conf_mod.c:217
2596	2596	1 : View List ['EVP_PKEY_copy_parameters']	2596	2596	X509_get_pubkey_parameters	call site: 03863	/src/openssl/crypto/x509/x509_vfy.c:2165
2463	2465	8 : View List ['RSA_get0_q', 'RSA_get0_iqmp', 'RSA_get_multi_prime_extra_count', 'RSA_get0_p', 'sk_BIGNUM_const_push', 'sk_RSA_PRIME_INFO_value.38562', 'RSA_get0_dmp1', 'RSA_get0_dmq1']	2463	2465	ossl_rsa_get0_all_params	call site: 00000	/src/openssl/crypto/rsa/rsa_lib.c:887
2246	4492	2 : View List ['EVP_PKEY_CTX_new_from_pkey', 'EVP_PKEY_CTX_new']	13069	42410	do_sigver_init	call site: 02315	/src/openssl/crypto/evp/m_sigver.c:56
2158	2428	5 : View List ['ERR_set_debug', 'ERR_set_error', 'ERR_new', 'EVP_MD_get_type', 'EVP_PKEY_CTX_get_signature_md']	2158	6971	ossl_rsa_pss_to_ctx	call site: 03667	/src/openssl/crypto/rsa/rsa_ameth.c:563
2008	2008	1 : View List ['i2r_HASH']	2008	2008	i2r_INFO_SYNTAX_POINTER	call site: 00000	/src/openssl/crypto/x509/v3_attrdesc.c:83
1997	1997	1 : View List ['RAND_bytes_ex']	1997	2318	bnrand	call site: 00000	/src/openssl/crypto/bn/bn_rand.c:53
1956	1956	1 : View List ['EVP_KEYMGMT_fetch']	1956	6081	int_ctx_new	call site: 02378	/src/openssl/crypto/evp/pmeth_lib.c:253
1759	2346	14 : View List ['CRYPTO_THREAD_unlock', 'CRYPTO_free', 'DSO_ctrl', 'DSO_load', 'DSO_free', 'DSO_bind_func', 'CRYPTO_THREAD_read_lock', 'ossl_safe_getenv', 'DSO_merge', 'CRYPTO_strdup', 'DSO_new', 'get_provider_store', 'DSO_convert_filename', 'ossl_get_modulesdir']	1767	3162	provider_init	call site: 01376	/src/openssl/crypto/provider_core.c:959
1745	2724	3 : View List ['EVP_CIPHER_fetch', 'OSSL_PARAM_get_utf8_string_ptr', 'EVP_CIPHER_free']	1745	3017	key2any_set_ctx_params	call site: 00000	/src/openssl/providers/implementations/encode_decode/encode_key2any.c:1158

Runtime coverage analysis

Covered functions

3355

Functions that are reachable but not covered

382

Reachable functions

1445

Percentage of reachable functions covered

73.56%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/x509.c	2
crypto/x509/x_x509.c	7
crypto/asn1/tasn_dec.c	14
crypto/err/err_blocks.c	4
crypto/err/err_local.h	6
crypto/bio/bio_print.c	12
include/internal/common.h	1
crypto/ctype.c	5
crypto/o_str.c	11
crypto/asn1/asn1_lib.c	17
crypto/stack/stack.c	28
include/openssl/asn1t.h	3
crypto/asn1/tasn_fre.c	5
crypto/asn1/a_object.c	7
crypto/asn1/tasn_utl.c	13
include/internal/refcount.h	4
crypto/threads_pthread.c	13
crypto/objects/obj_dat.c	27
crypto/bsearch.c	1
crypto/objects/obj_local.h	9
crypto/lhash/lhash.c	17
crypto/asn1/a_int.c	17
crypto/asn1/tasn_typ.c	16
crypto/asn1/tasn_new.c	9
crypto/asn1/a_type.c	3
crypto/asn1/a_bitstr.c	2
crypto/bio/bss_null.c	1
crypto/bio/bio_lib.c	12
crypto/ex_data.c	9
crypto/context.c	8
include/internal/cryptlib.h	6
include/openssl/crypto.h	3
crypto/x509/t_x509.c	7
crypto/x509/x509_set.c	12
crypto/x509/x509_cmp.c	18
crypto/err/err_mark.c	3
crypto/bn/bn_word.c	4
crypto/bn/bn_lib.c	24
crypto/bn/bn_local.h	1
crypto/bn/bn_shift.c	2
crypto/bn/bn_conv.c	1
include/internal/constant_time.h	4
crypto/bn/asm/x86_64-gcc.c	2
crypto/bio/bio_dump.c	5
crypto/objects/obj_xref.c	8
crypto/objects/obj_xref.h	2
crypto/asn1/ameth_lib.c	10
include/crypto/asn1.h	3
crypto/engine/tb_asnmth.c	6
crypto/engine/eng_table.c	8
crypto/engine/eng_local.h	8
crypto/engine/eng_init.c	4
crypto/engine/eng_lib.c	4
crypto/engine/tb_pkmeth.c	4
crypto/evp/pmeth_lib.c	34
crypto/engine/eng_list.c	1
crypto/asn1/a_strex.c	10
crypto/x509/x_name.c	8
crypto/x509/x509_obj.c	1
include/openssl/x509.h	12
include/internal/to_hex.h	1
crypto/x509/x509name.c	9
crypto/asn1/asn1_parse.c	4
crypto/asn1/tasn_enc.c	8
crypto/asn1/asn1_local.h	3
crypto/asn1/a_utf8.c	2
include/internal/unicode.h	2
crypto/asn1/a_time.c	12
crypto/o_time.c	6
crypto/x509/x_pubkey.c	8
crypto/err/err_prn.c	3
crypto/evp/p_lib.c	35
crypto/bio/bf_prefix.c	1
crypto/encode_decode/encoder_pkey.c	7
crypto/encode_decode/encoder_meth.c	17
crypto/evp/keymgmt_meth.c	26
crypto/provider_core.c	29
crypto/encode_decode/encoder_lib.c	18
crypto/evp/evp_fetch.c	8
crypto/core_namemap.c	16
crypto/objects/o_names.c	10
crypto/evp/evp_lib.c	15
include/internal/hashtable.h	1
crypto/hashtable/hashtable.c	11
include/openssl/safestack.h	8
crypto/property/property.c	38
crypto/sparse_array.c	8
crypto/core_fetch.c	7
crypto/core_algorithm.c	4
crypto/initthread.c	9
crypto/dso/dso_lib.c	9
crypto/provider_local.h	2
crypto/provider_child.c	2
crypto/dso/dso_dlfcn.c	1
crypto/getenv.c	1
crypto/defaults.c	1
include/openssl/core_dispatch.h	82
include/openssl/err.h	1
crypto/rand/rand_lib.c	3
crypto/provider.c	2
crypto/encode_decode/decoder_pkey.c	4
crypto/encode_decode/decoder_meth.c	2
crypto/encode_decode/encoder_local.h	6
crypto/encode_decode/decoder_lib.c	1
crypto/passphrase.c	5
crypto/params.c	9
crypto/bio/ossl_core_bio.c	3
crypto/ui/ui_util.c	10
crypto/ui/ui_lib.c	29
crypto/ui/ui_openssl.c	1
crypto/ui/ui_null.c	1
include/openssl/ui.h	4
crypto/x509/v3_prn.c	4
crypto/x509/x509_v3.c	7
crypto/x509/v3_lib.c	7
include/openssl/x509v3.h	19
include/openssl/conf.h	3
crypto/x509/v3_utl.c	6
crypto/asn1/a_print.c	1
crypto/x509/x_x509a.c	5
include/openssl/asn1.h	4
crypto/evp/digest.c	25
crypto/evp/evp_utils.c	2
crypto/evp/m_sigver.c	8
include/crypto/evp.h	7
crypto/evp/signature.c	14
crypto/evp/exchange.c	3
crypto/evp/kem.c	3
crypto/evp/asymcipher.c	3
crypto/evp/keymgmt_lib.c	14
crypto/x509/x_attrib.c	2
crypto/evp/names.c	3
crypto/evp/ctrl_params_translate.c	11
crypto/engine/tb_digest.c	3
crypto/x509/x_crl.c	3
crypto/ocsp/ocsp_asn.c	10
crypto/x509/x509_lu.c	16
include/openssl/x509_vfy.h	13
crypto/x509/x509_vpm.c	16
crypto/x509/x509cset.c	1
crypto/x509/v3_purp.c	19
crypto/evp/legacy_sha.c	1
crypto/x509/x_all.c	4
crypto/asn1/a_digest.c	2
crypto/x509/x509_ext.c	4
crypto/x509/v3_bcons.c	2
crypto/objects/obj_lib.c	2
crypto/x509/v3_pcia.c	2
crypto/asn1/a_octet.c	2
crypto/x509/v3_crld.c	1
crypto/asn1/a_dup.c	1
crypto/x509/x509_vfy.c	53
crypto/x509/pcy_tree.c	2
crypto/x509/pcy_node.c	1
crypto/x509/pcy_local.h	1
crypto/x509/pcy_data.c	1
crypto/x509/v3_cpols.c	2
include/internal/dane.h	2
crypto/asn1/x_algor.c	4
crypto/asn1/a_verify.c	2
crypto/rsa/rsa_ameth.c	3
crypto/rsa/rsa_backend.c	2
crypto/rsa/rsa_asn1.c	2
crypto/asn1/asn_pack.c	1
crypto/rsa/rsa_pss.c	3
crypto/rsa/rsa_lib.c	4
crypto/asn1/a_mbstr.c	6
crypto/x509/v3_genn.c	2
crypto/x509/x509_trust.c	5
crypto/asn1/a_utctm.c	1
crypto/asn1/a_gentm.c	1
crypto/x509/v3_ncons.c	16
crypto/punycode.c	6
crypto/http/http_lib.c	5
crypto/x509/v3_asid.c	6
crypto/x509/v3_addr.c	11
crypto/ocsp/ocsp_cl.c	5
crypto/ocsp/ocsp_vfy.c	9
crypto/x509/x509_txt.c	1
include/openssl/ocsp.h	1
crypto/ocsp/ocsp_lib.c	4

Fuzzer: cmp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7537	71.8%
gold	[1:9]	337	3.21%
yellow	[10:29]	167	1.59%
greenyellow	[30:49]	58	0.55%
lawngreen	50+	2388	22.7%
All colors	10487	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
28656	28656	2 : View List ['ossl_cmp_ctx_set1_validatedSrvCert', 'check_msg_given_cert']	28656	80983	check_msg_find_cert	call site: 05206	/src/openssl/crypto/cmp/cmp_vfy.c:491
27003	35539	18 : View List ['CRYPTO_free', 'ERR_set_error', 'ossl_cmp_pollReq_new', 'ossl_cmp_pollrepcontent_get0_pollrep', 'ossl_cmp_is_error_with_waiting', 'ossl_sk_ASN1_UTF8STRING2text', 'OSSL_CMP_MSG_get_bodytype', 'ossl_cmp_print_log', 'sk_OSSL_CMP_POLLREP_num', 'ERR_set_debug', 'ERR_new', 'ERR_add_error_data', 'is_crep_with_waiting', 'time', 'ossl_cmp_exchange_error', 'OSSL_sleep', 'send_receive_check', 'ASN1_INTEGER_get_int64']	27003	38569	poll_for_response	call site: 09251	/src/openssl/crypto/cmp/cmp_client.c:292
14856	18260	22 : View List ['OSSL_CRMF_CERTTEMPLATE_get0_issuer', 'send_receive_also_delayed', 'sk_OSSL_CMP_REVDETAILS_value', 'ERR_set_error', 'save_statusInfo', 'OSSL_CMP_CTX_snprint_PKIStatus', 'OPENSSL_sk_num', 'OSSL_CRMF_CERTID_get0_serialNumber', 'OSSL_CRMF_CERTID_get0_issuer', 'ossl_cmp_revrepcontent_get_pkisi', 'X509_NAME_cmp', 'ossl_cmp_revrepcontent_get_CertId', 'ossl_check_const_X509_CRL_sk_type', 'ossl_check_const_OSSL_CRMF_CERTID_sk_type', 'ossl_cmp_print_log', 'OSSL_CRMF_CERTTEMPLATE_get0_serialNumber', 'ERR_set_debug', 'ERR_new', 'ERR_add_error_data', 'ossl_cmp_pkisi_get_status', 'ossl_check_const_OSSL_CMP_PKISI_sk_type', 'ASN1_INTEGER_cmp']	14856	19228	OSSL_CMP_exec_RR_ses	call site: 09456	/src/openssl/crypto/cmp/cmp_client.c:920
13242	13546	2 : View List ['send_receive_also_delayed', 'OPENSSL_sk_new_null']	13242	14514	OSSL_CMP_exec_GENM_ses	call site: 09534	/src/openssl/crypto/cmp/cmp_client.c:1041
13242	13242	1 : View List ['ossl_cmp_exchange_error']	13242	13242	OSSL_CMP_try_certreq	call site: 09447	/src/openssl/crypto/cmp/cmp_client.c:844
13122	13388	7 : View List ['ERR_set_debug', 'ERR_set_error', 'ERR_new', 'ossl_cmp_pkisi_get_status', 'ossl_cmp_certrep_new', 'OSSL_CMP_CTX_set_option', 'ossl_cmp_hdr_has_implicitConfirm']	13122	16220	process_cert_request	call site: 09574	/src/openssl/crypto/cmp/cmp_server.c:283
12813	13297	2 : View List ['OSSL_CMP_MSG_free', 'send_receive_check']	12813	13297	initial_certreq	call site: 01978	/src/openssl/crypto/cmp/cmp_client.c:814
8676	9158	7 : View List ['X509_STORE_CTX_free', 'X509_STORE_CTX_init', 'ERR_GET_REASON.2031', 'X509_STORE_CTX_new_ex', 'OSSL_CMP_CTX_print_errors', 'ERR_peek_last_error', 'X509_verify_cert']	8676	9424	OSSL_CMP_validate_cert_path	call site: 05524	/src/openssl/crypto/cmp/cmp_vfy.c:118
7165	7715	11 : View List ['ERR_set_debug', 'OSSL_CRMF_POPOSIGNINGKEY_free', 'ERR_new', 'ERR_set_error', 'ASN1_INTEGER_new', 'create_popo_signature', 'ASN1_NULL_new', 'OSSL_CRMF_POPOSIGNINGKEY_new', 'ASN1_INTEGER_set', 'OSSL_CRMF_POPOPRIVKEY_new', 'OSSL_CRMF_POPO_new']	7165	8683	OSSL_CRMF_MSG_create_popo	call site: 03104	/src/openssl/crypto/crmf/crmf_lib.c:408
6501	6767	4 : View List ['ossl_cmp_rp_new', 'ERR_set_error', 'ERR_set_debug', 'ERR_new']	6501	7735	process_rr	call site: 09578	/src/openssl/crypto/cmp/cmp_server.c:346
5934	5936	4 : View List ['strcmp', 'EVP_PKEY_get_default_digest_name', 'ASN1_item_sign_ex', 'OSSL_CMP_PROTECTEDPART_it']	5934	6217	ossl_cmp_calc_protection	call site: 04342	/src/openssl/crypto/cmp/cmp_protect.c:55
5452	10297	3 : View List ['ossl_cmp_set_own_chain', 'ossl_cmp_print_log', 'ossl_x509_add_cert_new']	5452	19552	ossl_cmp_msg_add_extraCerts	call site: 04484	/src/openssl/crypto/cmp/cmp_protect.c:159

Runtime coverage analysis

Covered functions

3171

Functions that are reachable but not covered

1313

Reachable functions

2632

Percentage of reachable functions covered

50.11%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/cmp.c	13
crypto/bio/bio_lib.c	20
include/internal/refcount.h	5
crypto/ex_data.c	9
crypto/context.c	8
crypto/threads_pthread.c	14
crypto/err/err_blocks.c	4
crypto/err/err_local.h	6
crypto/bio/bio_print.c	12
include/internal/common.h	1
crypto/ctype.c	5
crypto/o_str.c	13
include/internal/cryptlib.h	6
crypto/stack/stack.c	29
include/openssl/crypto.h	3
crypto/cmp/cmp_msg.c	38
crypto/cmp/cmp_asn.c	38
crypto/asn1/a_d2i_fp.c	3
crypto/err/err_mark.c	3
crypto/asn1/asn1_lib.c	19
include/openssl/err.h	2
crypto/asn1/tasn_dec.c	14
include/openssl/asn1t.h	3
crypto/asn1/tasn_fre.c	5
crypto/asn1/a_object.c	7
crypto/asn1/tasn_utl.c	13
crypto/objects/obj_dat.c	27
crypto/bsearch.c	1
crypto/objects/obj_local.h	9
crypto/lhash/lhash.c	17
crypto/asn1/a_int.c	22
crypto/asn1/tasn_typ.c	27
crypto/asn1/tasn_new.c	10
crypto/asn1/a_type.c	6
crypto/asn1/a_bitstr.c	5
crypto/bio/bss_null.c	1
crypto/cmp/cmp_server.c	15
crypto/cmp/cmp_ctx.c	29
crypto/evp/digest.c	26
crypto/evp/evp_fetch.c	10
crypto/core_namemap.c	16
crypto/objects/o_names.c	10
crypto/evp/evp_lib.c	48
crypto/asn1/ameth_lib.c	11
include/crypto/asn1.h	3
crypto/bn/bn_word.c	4
crypto/bn/bn_lib.c	29
crypto/bn/bn_local.h	1
crypto/bn/bn_shift.c	2
crypto/bn/bn_conv.c	2
include/internal/constant_time.h	7
crypto/bn/asm/x86_64-gcc.c	2
include/internal/hashtable.h	1
crypto/hashtable/hashtable.c	11
include/openssl/safestack.h	8
crypto/property/property.c	38
crypto/sparse_array.c	8
crypto/core_fetch.c	7
crypto/core_algorithm.c	4
crypto/provider_core.c	30
crypto/initthread.c	13
crypto/dso/dso_lib.c	9
crypto/provider_local.h	2
crypto/provider_child.c	2
crypto/dso/dso_dlfcn.c	1
crypto/getenv.c	1
crypto/defaults.c	1
include/openssl/core_dispatch.h	155
crypto/rand/rand_lib.c	14
crypto/provider.c	2
crypto/encode_decode/decoder_pkey.c	23
crypto/encode_decode/decoder_meth.c	20
crypto/encode_decode/encoder_local.h	11
crypto/encode_decode/decoder_lib.c	30
crypto/passphrase.c	7
crypto/params.c	32
crypto/evp/evp_utils.c	6
crypto/http/http_client.c	2
crypto/x509/x_x509.c	11
crypto/x509/x_name.c	10
crypto/x509/x509_lu.c	20
include/openssl/x509_vfy.h	13
crypto/x509/x_crl.c	2
crypto/x509/x509_vpm.c	17
include/openssl/asn1.h	19
crypto/x509/t_x509.c	7
include/openssl/x509.h	21
crypto/evp/p_lib.c	45
crypto/evp/keymgmt_lib.c	17
include/crypto/evp.h	7
crypto/evp/keymgmt_meth.c	34
crypto/engine/tb_asnmth.c	6
crypto/engine/eng_table.c	8
crypto/engine/eng_local.h	8
crypto/engine/eng_init.c	4
crypto/engine/eng_lib.c	4
crypto/engine/tb_pkmeth.c	4
crypto/evp/pmeth_lib.c	39
crypto/engine/eng_list.c	1
crypto/x509/x_attrib.c	4
include/openssl/cmp.h	13
include/openssl/x509v3.h	25
crypto/x509/v3_genn.c	6
crypto/x509/x_exten.c	5
crypto/x509/v3_cpols.c	4
crypto/x509/x_req.c	4
crypto/asn1/a_i2d_fp.c	2
crypto/asn1/tasn_enc.c	8
crypto/asn1/asn1_local.h	14
crypto/asn1/tasn_prn.c	9
crypto/asn1/asn1_parse.c	4
crypto/x509/v3_utl.c	8
include/internal/to_hex.h	1
crypto/asn1/a_utctm.c	2
crypto/asn1/a_time.c	14
crypto/o_time.c	6
crypto/asn1/a_gentm.c	3
crypto/bio/bio_dump.c	5
crypto/bio/bf_prefix.c	1
crypto/asn1/a_strex.c	11
crypto/asn1/a_utf8.c	2
include/internal/unicode.h	2
crypto/cmp/cmp_util.c	7
crypto/asn1/a_octet.c	3
crypto/x509/x509_set.c	14
crypto/asn1/a_dup.c	1
crypto/cmp/cmp_client.c	16
crypto/cmp/cmp_hdr.c	16
crypto/x509/x509_cmp.c	19
crypto/x509/x509_req.c	7
providers/implementations/rands/seeding/rand_unix.c	1
crypto/engine/tb_rand.c	2
crypto/rand/rand_meth.c	1
crypto/evp/evp_rand.c	20
crypto/x509/v3_skid.c	1
crypto/crmf/crmf_asn.c	32
crypto/cmp/cmp_local.h	12
crypto/x509/x_pubkey.c	12
crypto/x509/x509name.c	9
crypto/x509/x509_v3.c	14
crypto/objects/obj_lib.c	2
crypto/crmf/crmf_lib.c	25
crypto/encode_decode/encoder_pkey.c	7
crypto/encode_decode/encoder_meth.c	17
crypto/encode_decode/encoder_lib.c	19
crypto/bio/ossl_core_bio.c	3
crypto/ui/ui_util.c	10
crypto/ui/ui_lib.c	29
crypto/ui/ui_openssl.c	1
crypto/ui/ui_null.c	1
include/openssl/ui.h	4
crypto/err/err_prn.c	6
crypto/x509/x509_att.c	14
crypto/x509/v3_lib.c	7
crypto/x509/v3_conf.c	2
include/openssl/crmf.h	8
crypto/evp/signature.c	15
crypto/evp/exchange.c	14
crypto/evp/kem.c	3
crypto/evp/asymcipher.c	15
crypto/asn1/a_sign.c	2
crypto/evp/ctrl_params_translate.c	11
crypto/evp/m_sigver.c	12
crypto/evp/names.c	6
crypto/engine/tb_digest.c	3
crypto/asn1/x_algor.c	16
crypto/objects/obj_xref.c	12
crypto/objects/obj_xref.h	2
crypto/cmp/cmp_protect.c	6
crypto/crmf/crmf_pbm.c	2
crypto/x509/v3_purp.c	26
crypto/evp/legacy_sha.c	1
crypto/x509/x_all.c	7
crypto/asn1/a_digest.c	1
crypto/x509/x509_ext.c	4
crypto/x509/v3_bcons.c	2
crypto/x509/v3_pcia.c	2
crypto/x509/v3_crld.c	1
crypto/evp/evp_pbe.c	6
crypto/evp/evp_local.h	3
crypto/evp/mac_lib.c	10
crypto/evp/mac_meth.c	9
crypto/x509/x509_vfy.c	56
crypto/x509/pcy_tree.c	2
crypto/x509/pcy_node.c	1
crypto/x509/pcy_local.h	1
crypto/x509/pcy_data.c	1
crypto/asn1/a_verify.c	2
crypto/rsa/rsa_ameth.c	6
crypto/rsa/rsa_backend.c	2
crypto/rsa/rsa_asn1.c	6
crypto/asn1/asn_pack.c	2
crypto/rsa/rsa_pss.c	3
crypto/rsa/rsa_lib.c	11
include/internal/dane.h	2
crypto/x509/x509_trust.c	5
crypto/bio/bss_file.c	2
crypto/cmp/cmp_status.c	7
crypto/cmp/cmp_vfy.c	18
crypto/x509/x509_obj.c	1
crypto/x509/x509cset.c	1
crypto/x509/v3_prn.c	4
include/openssl/conf.h	3
crypto/asn1/a_print.c	1
crypto/x509/x_x509a.c	5
crypto/asn1/a_mbstr.c	6
crypto/x509/v3_ncons.c	16
crypto/punycode.c	6
crypto/http/http_lib.c	5
crypto/x509/v3_asid.c	6
crypto/x509/v3_addr.c	11
crypto/evp/evp_enc.c	40
crypto/asn1/evp_asn1.c	7
crypto/engine/tb_cipher.c	3
crypto/asn1/d2i_pr.c	4
crypto/asn1/p8_pkey.c	6
crypto/bio/bf_readbuff.c	1
crypto/evp/evp_pkey.c	3
crypto/cms/cms_env.c	40
crypto/cms/cms_lib.c	32
crypto/cms/cms_asn1.c	20
crypto/cms/cms_smime.c	14
include/openssl/cms.h	12
crypto/cms/cms_pwri.c	4
crypto/cms/cms_dh.c	5
crypto/cms/cms_kari.c	14
crypto/evp/pmeth_check.c	3
crypto/evp/dh_ctrl.c	8
crypto/cms/cms_ec.c	7
crypto/evp/pmeth_gn.c	7
crypto/evp/ec_ctrl.c	9
crypto/cms/cms_rsa.c	7
crypto/cms/cms_sd.c	33
crypto/cms/cms_local.h	4
crypto/evp/bio_md.c	1
crypto/cms/cms_dd.c	2
crypto/cms/cms_enc.c	3
crypto/evp/bio_enc.c	1
crypto/evp/cmeth_lib.c	1
crypto/asn1/asn_mime.c	14
crypto/x509/x509_txt.c	1
crypto/cms/cms_att.c	8
crypto/cms/cms_ess.c	3
crypto/ess/ess_asn1.c	16
crypto/ess/ess_lib.c	7
include/openssl/ess.h	6
crypto/bio/bf_buff.c	1
crypto/sleep.c	1
crypto/asn1/i2d_evp.c	3
crypto/asn1/a_strnid.c	5
crypto/evp/p_sign.c	1

Fuzzer: quic-srtm

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	854	57.6%
gold	[1:9]	270	18.2%
yellow	[10:29]	20	1.34%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	338	22.8%
All colors	1482	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2719	2738	2 : View List ['CONF_modules_load', 'OSSL_LIB_CTX_get_conf_diagnostics']	2726	2762	CONF_modules_load_file_ex	call site: 00000	/src/openssl/crypto/conf/conf_mod.c:217
2058	2058	2 : View List ['CRYPTO_free', 'ossl_cipher_tlsunpadblock']	2058	3654	ossl_cipher_generic_block_update	call site: 00000	/src/openssl/providers/implementations/ciphers/ciphercommon.c:435
1759	2346	14 : View List ['CRYPTO_THREAD_unlock', 'CRYPTO_free', 'DSO_ctrl', 'DSO_load', 'DSO_free', 'DSO_bind_func', 'CRYPTO_THREAD_read_lock', 'ossl_safe_getenv', 'DSO_merge', 'CRYPTO_strdup', 'DSO_new', 'get_provider_store', 'DSO_convert_filename', 'ossl_get_modulesdir']	1767	3162	provider_init	call site: 00565	/src/openssl/crypto/provider_core.c:959
1472	2852	6 : View List ['OSSL_PARAM_get_size_t', 'ERR_set_debug', 'ERR_set_error', 'ERR_new', 'OSSL_PARAM_get_uint', 'OSSL_PARAM_locate_const']	1472	2852	ossl_cipher_generic_set_ctx_params	call site: 00000	/src/openssl/providers/implementations/ciphers/ciphercommon.c:799
1247	1247	2 : View List ['def_load_bio', 'BIO_free']	1247	1247	def_load	call site: 00000	/src/openssl/crypto/conf/conf_def.c:177
885	885	8 : View List ['EVP_CIPHER_get_mode', 'ENGINE_get_cipher', 'ENGINE_init', 'EVP_CIPHER_CTX_ctrl', 'OPENSSL_die', 'CRYPTO_zalloc', 'EVP_CIPHER_CTX_get0_cipher', 'EVP_CIPHER_get_flags']	1607	4190	evp_cipher_init_internal	call site: 01142	/src/openssl/crypto/evp/evp_enc.c:146
661	661	5 : View List ['BIO_s_file', 'fclose', 'BIO_ctrl', 'BIO_clear_flags', 'BIO_new']	661	661	BIO_new_file	call site: 00000	/src/openssl/crypto/bio/bss_file.c:66
639	639	2 : View List ['sk_INFOPAIR_new_null', 'ossl_provider_info_add_parameter']	639	1578	ossl_provider_new	call site: 00000	/src/openssl/crypto/provider_core.c:574
389	667	6 : View List ['CRYPTO_THREAD_unlock', 'engine_unlocked_finish', 'CRYPTO_THREAD_write_lock', 'ERR_set_debug', 'ERR_new', 'ERR_set_error']	389	667	ENGINE_finish	call site: 00155	/src/openssl/crypto/engine/eng_init.c:110
313	333	2 : View List ['EVP_CIPHER_CTX_set_params', 'OSSL_PARAM_locate_const']	1757	3197	evp_cipher_init_internal	call site: 01169	/src/openssl/crypto/evp/evp_enc.c:254
277	277	1 : View List ['parse_hex']	277	277	parse_value	call site: 00000	/src/openssl/crypto/property/property_parse.c:272
277	277	1 : View List ['parse_oct']	277	277	parse_value	call site: 00000	/src/openssl/crypto/property/property_parse.c:275

Runtime coverage analysis

Covered functions

1169

Functions that are reachable but not covered

179

Reachable functions

558

Percentage of reachable functions covered

67.92%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/quic-srtm.c	1
ssl/quic/quic_srtm.c	32
crypto/rand/rand_lib.c	12
crypto/threads_pthread.c	13
providers/implementations/rands/seeding/rand_unix.c	1
include/internal/common.h	1
crypto/engine/tb_rand.c	2
crypto/engine/eng_table.c	4
crypto/err/err_mark.c	2
crypto/engine/eng_local.h	7
crypto/lhash/lhash.c	18
crypto/engine/eng_init.c	4
include/internal/refcount.h	4
crypto/stack/stack.c	20
crypto/engine/eng_lib.c	3
crypto/engine/tb_pkmeth.c	1
crypto/evp/pmeth_lib.c	1
crypto/engine/tb_asnmth.c	1
crypto/asn1/ameth_lib.c	4
crypto/engine/eng_list.c	1
crypto/ex_data.c	4
crypto/context.c	8
crypto/err/err_blocks.c	4
crypto/err/err_local.h	6
crypto/bio/bio_print.c	10
crypto/ctype.c	2
crypto/o_str.c	5
include/internal/cryptlib.h	2
include/openssl/crypto.h	2
crypto/rand/rand_meth.c	1
crypto/provider_core.c	30
crypto/evp/evp_rand.c	20
crypto/evp/evp_fetch.c	6
crypto/core_namemap.c	16
crypto/objects/o_names.c	10
crypto/objects/obj_local.h	9
crypto/evp/evp_lib.c	12
crypto/objects/obj_dat.c	17
crypto/asn1/a_object.c	1
include/crypto/asn1.h	2
crypto/bsearch.c	1
crypto/bn/bn_word.c	3
crypto/bn/bn_lib.c	18
crypto/bn/bn_local.h	1
crypto/bn/bn_shift.c	2
crypto/bn/bn_conv.c	1
include/internal/constant_time.h	4
crypto/bn/asm/x86_64-gcc.c	1
include/internal/hashtable.h	1
crypto/hashtable/hashtable.c	11
include/openssl/safestack.h	4
crypto/property/property.c	27
crypto/sparse_array.c	7
crypto/core_fetch.c	7
crypto/core_algorithm.c	4
crypto/initthread.c	13
crypto/dso/dso_lib.c	9
crypto/provider_local.h	2
crypto/provider_child.c	2
crypto/dso/dso_dlfcn.c	1
crypto/getenv.c	1
crypto/defaults.c	1
include/openssl/core_dispatch.h	48
include/openssl/err.h	1
crypto/provider.c	1
crypto/encode_decode/decoder_pkey.c	4
crypto/encode_decode/decoder_meth.c	2
crypto/encode_decode/encoder_local.h	1
crypto/encode_decode/decoder_lib.c	1
crypto/passphrase.c	2
crypto/params.c	19
crypto/evp/evp_enc.c	27
crypto/evp/evp_utils.c	5
crypto/engine/tb_cipher.c	3
include/internal/packet.h	9

Fuzzer: quic-server

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7540	83.1%
gold	[1:9]	279	3.07%
yellow	[10:29]	52	0.57%
greenyellow	[30:49]	42	0.46%
lawngreen	50+	1152	12.7%
All colors	9065	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2719	2738	2 : View List ['CONF_modules_load', 'OSSL_LIB_CTX_get_conf_diagnostics']	2726	2762	CONF_modules_load_file_ex	call site: 00000	/src/openssl/crypto/conf/conf_mod.c:217
2625	4753	9 : View List ['OSSL_PARAM_get_octet_string', 'OSSL_PARAM_get_size_t', 'gcm_tls_iv_set_fixed', 'ERR_set_debug', 'ERR_new', 'ERR_set_error', 'gcm_tls_init', 'setivinv', 'ossl_cipher_aead_set_ctx_params_find_pidx']	2625	4753	ossl_gcm_set_ctx_params	call site: 00000	/src/openssl/providers/implementations/ciphers/ciphercommon_gcm.c:249
2197	6729	11 : View List ['ossl_quic_channel_get_qsm', 'ossl_quic_stream_map_reset_stream_send_part', 'qctx_lock', 'ossl_quic_stream_map_update_state', 'qc_cleanup', 'ossl_quic_stream_map_stop_sending_recv_part', 'ossl_quic_sstream_get_final_size', 'ossl_quic_thread_assist_cleanup', 'ossl_quic_thread_assist_wait_stopped', 'SSL_free', 'qctx_unlock']	2197	6729	ossl_quic_free	call site: 00000	/src/openssl/ssl/quic/quic_impl.c:762
2164	2164	9 : View List ['CRYPTO_free', 'ossl_asn1_get_choice_selector', 'ossl_asn1_get_field_ptr', 'ossl_asn1_primitive_free', 'OPENSSL_die', 'ossl_asn1_do_adb', 'ossl_asn1_enc_free', 'ossl_asn1_template_free', 'ossl_asn1_do_lock']	2164	2164	ossl_asn1_item_embed_free	call site: 00535	/src/openssl/crypto/asn1/tasn_fre.c:38
1759	2346	14 : View List ['CRYPTO_THREAD_unlock', 'CRYPTO_free', 'DSO_ctrl', 'DSO_load', 'DSO_free', 'DSO_bind_func', 'CRYPTO_THREAD_read_lock', 'ossl_safe_getenv', 'DSO_merge', 'CRYPTO_strdup', 'DSO_new', 'get_provider_store', 'DSO_convert_filename', 'ossl_get_modulesdir']	1767	3162	provider_init	call site: 00873	/src/openssl/crypto/provider_core.c:959
1248	1248	3 : View List ['sk_nid_triple_push', 'sk_nid_triple_new', 'sk_nid_triple_sort']	1248	1253	OBJ_add_sigid	call site: 02060	/src/openssl/crypto/objects/obj_xref.c:171
1030	3290	5 : View List ['ossl_quic_port_pop_incoming', 'SSL_free', 'ossl_quic_obj_get0_handshake_layer', 'ossl_quic_channel_free', 'ossl_quic_channel_get0_tls']	1030	3290	ossl_quic_port_drop_incoming	call site: 00000	/src/openssl/ssl/quic/quic_port.c:620
885	885	8 : View List ['EVP_CIPHER_get_mode', 'ENGINE_get_cipher', 'ENGINE_init', 'EVP_CIPHER_CTX_ctrl', 'OPENSSL_die', 'CRYPTO_zalloc', 'EVP_CIPHER_CTX_get0_cipher', 'EVP_CIPHER_get_flags']	1607	4190	evp_cipher_init_internal	call site: 04077	/src/openssl/crypto/evp/evp_enc.c:146
877	1247	2 : View List ['def_load_bio', 'BIO_free']	877	1247	def_load	call site: 00000	/src/openssl/crypto/conf/conf_def.c:177
676	676	2 : View List ['ENGINE_free', 'ENGINE_init']	676	676	EVP_PKEY_asn1_find_str	call site: 01483	/src/openssl/crypto/asn1/ameth_lib.c:118
639	639	2 : View List ['sk_INFOPAIR_new_null', 'ossl_provider_info_add_parameter']	639	1578	ossl_provider_new	call site: 00000	/src/openssl/crypto/provider_core.c:574
424	424	2 : View List ['obj_new_nid_unlocked', 'ossl_obj_add_object']	424	438	OBJ_create	call site: 01990	/src/openssl/crypto/objects/obj_dat.c:818

Runtime coverage analysis

Covered functions

1663

Functions that are reachable but not covered

1897

Reachable functions

2724

Percentage of reachable functions covered

30.36%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/quic-server.c	3
ssl/quic/quic_method.c	3
ssl/ssl_lib.c	54
crypto/err/err_blocks.c	4
crypto/err/err_local.h	6
crypto/bio/bio_print.c	12
include/internal/common.h	3
crypto/ctype.c	3
crypto/o_str.c	12
ssl/ssl_init.c	3
ssl/ssl_ciph.c	20
crypto/context.c	12
crypto/threads_pthread.c	14
ssl/s3_lib.c	3
ssl/ssl_cert.c	11
crypto/ex_data.c	9
include/internal/cryptlib.h	6
crypto/stack/stack.c	28
include/internal/refcount.h	5
ssl/ssl_local.h	13
crypto/lhash/lhash.c	20
crypto/x509/x509_lu.c	8
include/openssl/x509_vfy.h	5
crypto/x509/x509_cmp.c	7
crypto/x509/x_name.c	3
crypto/asn1/tasn_enc.c	8
crypto/asn1/asn1_local.h	3
crypto/asn1/a_bitstr.c	2
crypto/asn1/a_int.c	10
crypto/asn1/asn1_lib.c	14
crypto/asn1/tasn_utl.c	13
crypto/objects/obj_dat.c	33
crypto/bsearch.c	1
crypto/objects/obj_local.h	17
crypto/x509/x509_vpm.c	9
include/openssl/crypto.h	3
include/openssl/asn1.h	7
crypto/asn1/a_object.c	6
include/openssl/safestack.h	5
crypto/ct/ct_log.c	3
include/openssl/ct.h	2
crypto/evp/p_lib.c	23
crypto/evp/keymgmt_lib.c	15
include/crypto/evp.h	7
crypto/evp/keymgmt_meth.c	28
crypto/provider_core.c	31
crypto/initthread.c	13
crypto/dso/dso_lib.c	9
crypto/provider_local.h	2
crypto/provider_child.c	2
crypto/asn1/ameth_lib.c	10
include/crypto/asn1.h	3
crypto/engine/tb_asnmth.c	6
crypto/engine/eng_table.c	8
crypto/err/err_mark.c	4
crypto/engine/eng_local.h	8
crypto/engine/eng_init.c	4
crypto/engine/eng_lib.c	4
crypto/engine/tb_pkmeth.c	4
crypto/evp/pmeth_lib.c	30
crypto/engine/eng_list.c	1
include/openssl/x509.h	7
crypto/x509/x_attrib.c	2
crypto/asn1/tasn_fre.c	5
include/openssl/asn1t.h	3
ssl/tls_depr.c	3
crypto/engine/tb_cipher.c	3
crypto/evp/evp_enc.c	36
crypto/evp/evp_fetch.c	10
crypto/core_namemap.c	16
crypto/objects/o_names.c	10
crypto/evp/evp_lib.c	26
crypto/bn/bn_word.c	4
crypto/bn/bn_lib.c	19
crypto/bn/bn_local.h	1
crypto/bn/bn_shift.c	2
crypto/bn/bn_conv.c	1
include/internal/constant_time.h	4
crypto/bn/asm/x86_64-gcc.c	2
include/internal/hashtable.h	1
crypto/hashtable/hashtable.c	11
crypto/property/property.c	38
crypto/sparse_array.c	8
crypto/core_fetch.c	7
crypto/core_algorithm.c	4
crypto/dso/dso_dlfcn.c	1
crypto/getenv.c	1
crypto/defaults.c	4
include/openssl/core_dispatch.h	142
include/openssl/err.h	2
crypto/rand/rand_lib.c	14
crypto/provider.c	4
crypto/encode_decode/decoder_pkey.c	24
crypto/encode_decode/decoder_meth.c	20
crypto/encode_decode/encoder_local.h	6
crypto/encode_decode/decoder_lib.c	30
crypto/passphrase.c	9
crypto/params.c	31
crypto/evp/evp_utils.c	6
crypto/engine/tb_digest.c	3
crypto/evp/digest.c	22
crypto/evp/signature.c	13
crypto/evp/exchange.c	8
ssl/t1_lib.c	15
crypto/conf/conf_mod.c	1
ssl/statem/statem_lib.c	1
crypto/objects/obj_lib.c	1
crypto/objects/obj_xref.c	10
crypto/objects/obj_xref.h	5
crypto/evp/kem.c	2
crypto/evp/asymcipher.c	2
include/openssl/ssl.h	5
crypto/bio/bio_lib.c	25
providers/implementations/rands/seeding/rand_unix.c	1
crypto/engine/tb_rand.c	2
crypto/rand/rand_meth.c	1
crypto/evp/evp_rand.c	20
ssl/tls_srp.c	2
ssl/quic/quic_impl.c	95
crypto/hashtable/hashfunc.c	1
crypto/thread/arch/thread_posix.c	11
ssl/ssl_mcnf.c	2
crypto/conf/conf_ssl.c	3
ssl/ssl_conf.c	14
ssl/quic/quic_obj.c	6
ssl/ssl_rsa.c	5
crypto/bio/bss_file.c	2
crypto/pem/pem_pkey.c	4
crypto/bio/bf_readbuff.c	1
crypto/bio/ossl_core_bio.c	3
crypto/ui/ui_util.c	10
crypto/ui/ui_lib.c	29
crypto/ui/ui_openssl.c	1
crypto/ui/ui_null.c	1
include/openssl/ui.h	4
crypto/err/err_prn.c	1
include/internal/to_hex.h	1
crypto/pem/pem_lib.c	15
crypto/evp/encode.c	7
crypto/evp/names.c	6
crypto/evp/evp_key.c	3
crypto/evp/legacy_md5.c	1
crypto/evp/m_sigver.c	6
crypto/evp/ctrl_params_translate.c	8
crypto/asn1/p8_pkey.c	4
crypto/asn1/tasn_dec.c	14
crypto/asn1/tasn_typ.c	9
crypto/asn1/tasn_new.c	9
crypto/asn1/a_type.c	1
crypto/evp/evp_pkey.c	1
crypto/asn1/x_sig.c	4
crypto/pkcs12/p12_p8d.c	2
crypto/pkcs12/p12_decr.c	2
crypto/evp/evp_pbe.c	5
crypto/evp/evp_local.h	3
crypto/asn1/d2i_pr.c	4
crypto/x509/x_pubkey.c	8
crypto/x509/x_all.c	1
crypto/asn1/a_d2i_fp.c	1
ssl/ssl_sess.c	9
include/internal/time.h	23
crypto/x509/x_x509.c	2
crypto/x509/t_x509.c	1
crypto/x509/x_crl.c	2
ssl/statem/extensions_cust.c	6
ssl/quic/quic_channel.c	85
ssl/quic/quic_port.c	52
crypto/err/err_save.c	4
ssl/quic/quic_engine.c	16
ssl/quic/quic_reactor.c	20
ssl/rio/rio_notifier.c	5
crypto/bio/bio_sock.c	1
crypto/bio/bio_sock2.c	1
ssl/quic/quic_demux.c	16
include/internal/quic_demux.h	10
crypto/bio/bio_addr.c	6
crypto/bio/bss_sock.c	1
ssl/quic/quic_wire_pkt.c	15
ssl/quic/qlog.c	39
ssl/quic/json_enc.c	44
crypto/o_fopen.c	1
ssl/quic/qlog_event_helpers.c	13
crypto/cversion.c	1
crypto/info.c	3
crypto/time.c	1
ssl/quic/quic_ackm.c	74
ssl/quic/quic_statm.c	4
ssl/quic/quic_txp.c	62
ssl/quic/quic_record_tx.c	44
ssl/quic/quic_record_rx.c	56
ssl/quic/quic_record_shared.c	10
ssl/quic/quic_record_util.c	13
ssl/tls13_enc.c	2
crypto/evp/kdf_meth.c	7
crypto/evp/kdf_lib.c	3
ssl/quic/quic_wire.c	49
include/internal/packet.h	17
include/internal/packet_quic.h	3
include/internal/quic_vlint.h	2
crypto/quic_vlint.c	1
include/internal/quic_wire_pkt.h	8
include/internal/quic_types.h	4
ssl/quic/uint_set.c	10
include/internal/uint_set.h	13
ssl/quic/quic_sstream.c	16
include/internal/ring_buf.h	7
ssl/quic/quic_rstream.c	5
ssl/quic/quic_sf_list.c	7
ssl/quic/quic_rx_depack.c	27
ssl/quic/quic_stream_map.c	48
ssl/quic/quic_fc.c	26
include/internal/quic_stream_map.h	10
ssl/quic/quic_srtm.c	28
ssl/quic/quic_cfq.c	18
ssl/quic/quic_tls.c	10
ssl/statem/statem.c	8
crypto/bio/bss_null.c	1
ssl/quic/quic_obj_local.h	4
ssl/quic/quic_thread_assist.c	2
crypto/thread/arch.c	1
include/internal/rio_notifier.h	1
crypto/bio/bss_fd.c	1
ssl/record/rec_layer_s3.c	11
ssl/s3_msg.c	1
ssl/t1_enc.c	1
ssl/record/rec_layer_d1.c	2
ssl/pqueue.c	3
crypto/bio/bss_dgram_pair.c	1
crypto/async/async.c	13
crypto/async/async_wait.c	2
crypto/async/async_local.h	4
crypto/async/arch/async_posix.c	3
crypto/async/arch/async_posix.h	1
ssl/quic/quic_txpim.c	15
include/internal/quic_wire.h	1
ssl/quic/quic_fifd.c	5
include/internal/quic_reactor.h	1
ssl/quic/quic_lcidm.c	46
ssl/methods.c	1
crypto/x509/x509_set.c	1
ssl/quic/quic_types.c	1
crypto/siphash/siphash.c	5

Fuzzer: client

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4274	65.9%
gold	[1:9]	316	4.87%
yellow	[10:29]	103	1.58%
greenyellow	[30:49]	58	0.89%
lawngreen	50+	1729	26.6%
All colors	6480	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
12628	27219	14 : View List ['X509_STORE_CTX_free', 'X509_STORE_CTX_init', 'ssl_security_cert_chain', 'ERR_set_debug', 'ERR_new', 'ERR_clear_error', 'ssl_add_cert_to_wpacket', 'ossl_check_const_X509_sk_type.6527', 'OPENSSL_sk_value', 'ossl_statem_fatal', 'OPENSSL_sk_num', 'X509_STORE_CTX_new_ex', 'X509_STORE_CTX_get0_chain', 'X509_verify_cert']	12628	27219	ssl_add_cert_chain	call site: 00000	/src/openssl/ssl/statem/statem_lib.c:1024
9084	9095	6 : View List ['X509_chain_check_suiteb', 'internal_verify', 'X509v3_asid_validate_path', 'verify_cb_cert', 'X509v3_addr_validate_path', 'check_name_constraints']	9084	9095	verify_chain	call site: 00000	/src/openssl/crypto/x509/x509_vfy.c:238
7559	7559	1 : View List ['tls_post_process_server_rpk']	7559	7559	tls_post_process_server_certificate	call site: 00000	/src/openssl/ssl/statem/statem_clnt.c:2099
7103	7103	2 : View List ['SSL_use_PrivateKey', 'SSL_use_certificate']	7103	18249	tls_prepare_client_certificate	call site: 00000	/src/openssl/ssl/statem/statem_clnt.c:3750
6320	6320	2 : View List ['EVP_DigestSignInit', 'EVP_DigestVerifyInit']	6320	6586	evp_md_init_internal	call site: 03592	/src/openssl/crypto/evp/digest.c:165
5284	5284	1 : View List ['ssl_validate_ct']	5284	5284	tls_process_initial_server_flight	call site: 00000	/src/openssl/ssl/statem/statem_clnt.c:2985
4994	5713	6 : View List ['ossl_ml_dsa_pk_decode', 'ERR_set_debug', 'ERR_new', 'ERR_set_error', 'ossl_ml_dsa_key_new', 'ossl_ml_dsa_key_free']	4994	5713	ossl_ml_dsa_d2i_PUBKEY	call site: 00000	/src/openssl/providers/implementations/encode_decode/ml_dsa_codecs.c:118
4716	6874	2 : View List ['ossl_ffc_params_simple_validate', 'ossl_ffc_generate_private_key']	4716	8061	generate_key	call site: 00000	/src/openssl/crypto/dh/dh_key.c:329
4701	10415	5 : View List ['OSSL_STACK_OF_X509_free', 'get0_best_issuer_sk', 'X509_up_ref', 'ossl_x509_check_cert_time', 'X509_STORE_CTX_get1_certs']	4701	10907	X509_STORE_CTX_get1_issuer	call site: 00000	/src/openssl/crypto/x509/x509_vfy.c:444
4360	4360	1 : View List ['srp_generate_client_master_secret']	4360	4360	tls_client_key_exchange_post_work	call site: 00000	/src/openssl/ssl/statem/statem_clnt.c:3624
4315	5332	4 : View List ['ossl_statem_fatal', 'ssl_check_srvr_ecc_cert_and_alg', 'ERR_set_debug', 'ERR_new']	4315	5332	ssl3_check_cert_and_algorithm	call site: 00000	/src/openssl/ssl/statem/statem_clnt.c:3994
3792	3792	2 : View List ['ecd_key_pairwise_check', 'ecx_key_pairwise_check']	3792	3792	ecx_validate	call site: 00000	/src/openssl/providers/implementations/keymgmt/ecx_kmgmt.c:973

Runtime coverage analysis

Covered functions

4241

Functions that are reachable but not covered

861

Reachable functions

1950

Percentage of reachable functions covered

55.85%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/driver.c	1
fuzz/client.c	1
ssl/methods.c	1
ssl/ssl_lib.c	46
crypto/err/err_blocks.c	4
crypto/err/err_local.h	6
crypto/bio/bio_print.c	12
include/internal/common.h	3
crypto/ctype.c	3
crypto/o_str.c	12
ssl/ssl_init.c	3
ssl/ssl_ciph.c	20
crypto/context.c	12
crypto/threads_pthread.c	14
ssl/s3_lib.c	3
ssl/ssl_cert.c	10
crypto/ex_data.c	9
include/internal/cryptlib.h	6
crypto/stack/stack.c	28
include/internal/refcount.h	5
ssl/ssl_local.h	13
crypto/lhash/lhash.c	19
crypto/x509/x509_lu.c	7
include/openssl/x509_vfy.h	5
crypto/x509/x509_cmp.c	6
crypto/x509/x_name.c	3
crypto/asn1/tasn_enc.c	8
crypto/asn1/asn1_local.h	3
crypto/asn1/a_bitstr.c	2
crypto/asn1/a_int.c	10
crypto/asn1/asn1_lib.c	14
crypto/asn1/tasn_utl.c	13
crypto/objects/obj_dat.c	33
crypto/bsearch.c	1
crypto/objects/obj_local.h	17
crypto/x509/x509_vpm.c	3
include/openssl/crypto.h	3
include/openssl/asn1.h	5
crypto/asn1/a_object.c	6
include/openssl/safestack.h	4
crypto/ct/ct_log.c	3
include/openssl/ct.h	2
crypto/evp/p_lib.c	23
crypto/evp/keymgmt_lib.c	15
include/crypto/evp.h	7
crypto/evp/keymgmt_meth.c	28
crypto/provider_core.c	31
crypto/initthread.c	13
crypto/dso/dso_lib.c	9
crypto/provider_local.h	2
crypto/provider_child.c	2
crypto/asn1/ameth_lib.c	10
include/crypto/asn1.h	3
crypto/engine/tb_asnmth.c	6
crypto/engine/eng_table.c	8
crypto/err/err_mark.c	4
crypto/engine/eng_local.h	8
crypto/engine/eng_init.c	4
crypto/engine/eng_lib.c	4
crypto/engine/tb_pkmeth.c	4
crypto/evp/pmeth_lib.c	30
crypto/engine/eng_list.c	1
include/openssl/x509.h	6
crypto/x509/x_attrib.c	2
crypto/asn1/tasn_fre.c	5
include/openssl/asn1t.h	3
ssl/tls_depr.c	3
crypto/engine/tb_cipher.c	3
crypto/evp/evp_enc.c	33
crypto/evp/evp_fetch.c	10
crypto/core_namemap.c	16
crypto/objects/o_names.c	10
crypto/evp/evp_lib.c	25
crypto/bn/bn_word.c	4
crypto/bn/bn_lib.c	19
crypto/bn/bn_local.h	1
crypto/bn/bn_shift.c	2
crypto/bn/bn_conv.c	1
include/internal/constant_time.h	4
crypto/bn/asm/x86_64-gcc.c	2
include/internal/hashtable.h	1
crypto/hashtable/hashtable.c	11
crypto/property/property.c	38
crypto/sparse_array.c	8
crypto/core_fetch.c	7
crypto/core_algorithm.c	4
crypto/dso/dso_dlfcn.c	1
crypto/getenv.c	1
crypto/defaults.c	4
include/openssl/core_dispatch.h	142
include/openssl/err.h	2
crypto/rand/rand_lib.c	14
crypto/provider.c	4
crypto/encode_decode/decoder_pkey.c	24
crypto/encode_decode/decoder_meth.c	20
crypto/encode_decode/encoder_local.h	6
crypto/encode_decode/decoder_lib.c	30
crypto/passphrase.c	9
crypto/params.c	31
crypto/evp/evp_utils.c	6
crypto/engine/tb_digest.c	3
crypto/evp/digest.c	22
crypto/evp/signature.c	13
crypto/evp/exchange.c	8
ssl/t1_lib.c	15
crypto/conf/conf_mod.c	1
ssl/statem/statem_lib.c	1
crypto/objects/obj_lib.c	1
crypto/objects/obj_xref.c	10
crypto/objects/obj_xref.h	5
crypto/evp/kem.c	2
crypto/evp/asymcipher.c	2
include/openssl/ssl.h	5
crypto/bio/bio_lib.c	22
providers/implementations/rands/seeding/rand_unix.c	1
crypto/engine/tb_rand.c	2
crypto/rand/rand_meth.c	1
crypto/evp/evp_rand.c	20
ssl/tls_srp.c	2
ssl/quic/quic_method.c	3
ssl/quic/quic_impl.c	66
crypto/hashtable/hashfunc.c	1
crypto/thread/arch/thread_posix.c	11
ssl/ssl_mcnf.c	2
crypto/conf/conf_ssl.c	3
ssl/ssl_conf.c	14
ssl/quic/quic_obj.c	6
ssl/ssl_rsa.c	5
crypto/bio/bss_file.c	2
crypto/pem/pem_pkey.c	4
crypto/bio/bf_readbuff.c	1
crypto/bio/ossl_core_bio.c	3
crypto/ui/ui_util.c	10
crypto/ui/ui_lib.c	29
crypto/ui/ui_openssl.c	1
crypto/ui/ui_null.c	1
include/openssl/ui.h	4
crypto/err/err_prn.c	1
include/internal/to_hex.h	1
crypto/pem/pem_lib.c	15
crypto/evp/encode.c	7
crypto/evp/names.c	6
crypto/evp/evp_key.c	3
crypto/evp/legacy_md5.c	1
crypto/evp/m_sigver.c	6
crypto/evp/ctrl_params_translate.c	8
crypto/asn1/p8_pkey.c	4
crypto/asn1/tasn_dec.c	14
crypto/asn1/tasn_typ.c	9
crypto/asn1/tasn_new.c	9
crypto/asn1/a_type.c	1
crypto/evp/evp_pkey.c	1
crypto/asn1/x_sig.c	4
crypto/pkcs12/p12_p8d.c	2
crypto/pkcs12/p12_decr.c	2
crypto/evp/evp_pbe.c	5
crypto/evp/evp_local.h	3
crypto/asn1/d2i_pr.c	4
crypto/x509/x_pubkey.c	8
crypto/x509/x_all.c	1
crypto/asn1/a_d2i_fp.c	1
ssl/ssl_sess.c	9
include/internal/time.h	17
crypto/x509/x_x509.c	2
crypto/x509/t_x509.c	1
crypto/x509/x_crl.c	2
ssl/statem/extensions_cust.c	4
ssl/statem/statem.c	8
ssl/quic/quic_channel.c	32
ssl/quic/quic_port.c	17
crypto/err/err_save.c	4
ssl/quic/quic_obj_local.h	4
ssl/quic/quic_engine.c	8
crypto/bio/bio_addr.c	6
ssl/quic/quic_txp.c	5
ssl/quic/quic_record_tx.c	3
ssl/quic/quic_record_util.c	11
crypto/evp/kdf_meth.c	7
crypto/evp/kdf_lib.c	3
ssl/tls13_enc.c	2
ssl/quic/quic_record_rx.c	7
ssl/quic/quic_record_shared.c	7
ssl/quic/quic_wire_pkt.c	2
include/internal/quic_demux.h	3
ssl/quic/quic_wire.c	5
include/internal/quic_vlint.h	1
ssl/quic/quic_fc.c	14
ssl/quic/quic_tls.c	8
ssl/quic/qlog.c	35
ssl/quic/json_enc.c	44
crypto/o_fopen.c	1
crypto/cversion.c	1
crypto/info.c	3
ssl/quic/qlog_event_helpers.c	5
crypto/bio/bss_null.c	1
ssl/quic/quic_reactor.c	18
ssl/quic/quic_demux.c	2
ssl/quic/quic_stream_map.c	10
ssl/rio/rio_notifier.c	2
include/internal/rio_notifier.h	1
crypto/time.c	1
crypto/bio/bss_fd.c	1
ssl/quic/quic_statm.c	1
include/internal/quic_stream_map.h	3
ssl/quic/quic_rstream.c	3
ssl/quic/quic_sstream.c	3
include/internal/ring_buf.h	7
ssl/quic/uint_set.c	2
include/internal/uint_set.h	3
ssl/quic/quic_sf_list.c	3
ssl/record/rec_layer_s3.c	10
ssl/s3_msg.c	1
ssl/t1_enc.c	1
ssl/record/rec_layer_d1.c	2
ssl/pqueue.c	3
crypto/bio/bss_dgram_pair.c	1
crypto/async/async.c	13
crypto/async/async_wait.c	2
crypto/async/async_local.h	4
crypto/async/arch/async_posix.c	3
crypto/async/arch/async_posix.h	1
ssl/quic/quic_ackm.c	1
ssl/quic/quic_thread_assist.c	2
crypto/thread/arch.c	1