Fuzz introspector: fuzz-client-hello
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
168 168 1 :

['commission_handshake_secret']

168 351 server_finish_handshake call site: 00212 /src/picotls/lib/picotls.c:4741
151 443 5 :

['check_client_hello_constraints', 'ptls_aead_decrypt', 'ptls_aead_free', 'decode_client_hello', 'rebuild_ch_inner']

1504 6009 server_handle_hello call site: 00000 /src/picotls/lib/picotls.c:4271
134 270 4 :

['ptls__key_schedule_update_hash', 'push_signature_algorithms', 'ptls_buffer__adjust_quic_blocksize', 'ptls_buffer__do_pushv']

134 622 server_handle_hello call site: 00000 /src/picotls/lib/picotls.c:4663
66 160 5 :

['ptls_iovec_init', 'build_certificate_verify_signdata', 'ptls__key_schedule_update_hash', 'ptls_buffer__do_pushv', 'ptls_buffer__adjust_quic_blocksize']

66 160 send_certificate_verify call site: 00201 /src/picotls/lib/picotls.c:3094
62 62 3 :

['buffer_push_encrypted_records', 'malloc', 'free']

62 62 buffer_encrypt_record call site: 00261 /src/picotls/lib/picotls.c:804
6 6 1 :

['key_schedule_update_ch1hash_prefix']

906 4273 server_handle_hello call site: 00000 /src/picotls/lib/picotls.c:4379
2 2 1 :

['posix_memalign']

2 5 ptls_buffer_reserve_aligned call site: 00004 /src/picotls/lib/picotls.c:585
0 169 2 :

['ptls__key_schedule_update_hash', 'setup_traffic_protection']

0 169 server_handle_finished call site: 00000 /src/picotls/lib/picotls.c:4790
0 143 2 :

['malloc', 'derive_exporter_secret']

702 3291 server_handle_hello call site: 00000 /src/picotls/lib/picotls.c:4545
0 80 1 :

['derive_secret']

406 1767 server_handle_hello call site: 00000 /src/picotls/lib/picotls.c:4613
0 45 1 :

['push_change_cipher_spec']

0 45 server_handle_hello call site: 00000 /src/picotls/lib/picotls.c:4485
0 5 1 :

['ptls_decode16']

0 5 select_cipher call site: 00000 /src/picotls/lib/picotls.c:1993

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 deterministic_random_bytes [function] [call site] 00001
1 encrypt_ticket_cb_fake [function] [call site] 00002
2 ptls_buffer_reserve [function] [call site] 00003
3 ptls_buffer_reserve_aligned [function] [call site] 00004
4 posix_memalign [call site] 00005
4 ptls_buffer__release_memory [function] [call site] 00006
2 ptls_buffer_reserve [function] [call site] 00007
1 ptls_new [function] [call site] 00008
2 ptls_server_new [function] [call site] 00009
3 new_instance [function] [call site] 00010
4 __assert_fail [call site] 00011
4 update_open_count [function] [call site] 00012
3 ptls_skip_tracing [function] [call site] 00013
3 ptls_buffer_init [function] [call site] 00014
4 __assert_fail [call site] 00015
1 ptls_buffer_init [function] [call site] 00016
1 ptls_handshake [function] [call site] 00017
2 __assert_fail [call site] 00018
2 init_record_message_emitter [function] [call site] 00019
3 begin_record_message [function] [call site] 00020
4 ptls_buffer__do_pushv [function] [call site] 00021
5 ptls_buffer_reserve [function] [call site] 00022
2 __assert_fail [call site] 00023
2 __assert_fail [call site] 00024
2 send_client_hello [function] [call site] 00025
3 ptls_buffer_init [function] [call site] 00026
3 ptls_server_name_is_ipaddr [function] [call site] 00027
4 inet_pton [call site] 00028
4 inet_pton [call site] 00029
3 client_decode_ech_config_list [function] [call site] 00030
4 ptls_decode_quicint [function] [call site] 00031
4 ptls_iovec_init [function] [call site] 00032
3 client_setup_ech [function] [call site] 00033
4 ptls_buffer_init [function] [call site] 00034
4 ptls_buffer__do_pushv [function] [call site] 00035
4 ptls_buffer__do_pushv [function] [call site] 00036
4 ptls_iovec_init [function] [call site] 00037
4 ptls_hpke_setup_base_s [function] [call site] 00038
5 ptls_iovec_init [function] [call site] 00039
5 dh_encap [function] [call site] 00040
6 ptls_iovec_init [function] [call site] 00041
6 dh_derive [function] [call site] 00042
7 extract_and_expand [function] [call site] 00043
8 ptls_buffer_init [function] [call site] 00044
8 ptls_buffer__do_pushv [function] [call site] 00045
8 ptls_buffer__do_pushv [function] [call site] 00046
8 ptls_iovec_init [function] [call site] 00047
8 labeled_extract [function] [call site] 00048
9 ptls_buffer_init [function] [call site] 00049
9 ptls_buffer__do_pushv [function] [call site] 00050
9 build_suite_id [function] [call site] 00051
10 ptls_buffer__do_pushv [function] [call site] 00052
10 ptls_buffer__do_pushv [function] [call site] 00053
10 ptls_buffer__do_pushv [function] [call site] 00054
10 ptls_buffer__do_pushv [function] [call site] 00055
10 ptls_buffer__do_pushv [function] [call site] 00056
10 ptls_buffer__do_pushv [function] [call site] 00057
9 strlen [call site] 00058
9 ptls_buffer__do_pushv [function] [call site] 00059
9 ptls_buffer__do_pushv [function] [call site] 00060
9 ptls_iovec_init [function] [call site] 00061
9 ptls_hkdf_extract [function] [call site] 00062
10 ptls_iovec_init [function] [call site] 00063
10 ptls_hmac_create [function] [call site] 00064
11 __assert_fail [call site] 00065
11 hmac_update [function] [call site] 00066
11 hmac_apply_key [function] [call site] 00067
9 ptls_buffer_dispose [function] [call site] 00068
10 ptls_buffer__release_memory [function] [call site] 00069
8 ptls_iovec_init [function] [call site] 00070
8 ptls_iovec_init [function] [call site] 00071
8 labeled_expand [function] [call site] 00072
9 __assert_fail [call site] 00073
9 ptls_buffer_init [function] [call site] 00074
9 ptls_buffer__do_pushv [function] [call site] 00075
9 ptls_buffer__do_pushv [function] [call site] 00076
9 build_suite_id [function] [call site] 00077
9 strlen [call site] 00078
9 ptls_buffer__do_pushv [function] [call site] 00079
9 ptls_buffer__do_pushv [function] [call site] 00080
9 ptls_iovec_init [function] [call site] 00081
9 ptls_hkdf_expand [function] [call site] 00082
10 ptls_hmac_create [function] [call site] 00083
9 ptls_buffer_dispose [function] [call site] 00084
8 ptls_buffer_dispose [function] [call site] 00085
6 ptls_iovec_init [function] [call site] 00086
5 key_schedule [function] [call site] 00087
6 ptls_buffer_init [function] [call site] 00088
6 ptls_buffer__do_pushv [function] [call site] 00089
6 ptls_buffer_reserve [function] [call site] 00090
6 ptls_iovec_init [function] [call site] 00091
6 ptls_iovec_init [function] [call site] 00092
6 labeled_extract [function] [call site] 00093
6 ptls_buffer_reserve [function] [call site] 00094
6 ptls_iovec_init [function] [call site] 00095
6 labeled_extract [function] [call site] 00096
6 ptls_iovec_init [function] [call site] 00097
6 ptls_iovec_init [function] [call site] 00098
6 labeled_extract [function] [call site] 00099
6 ptls_iovec_init [function] [call site] 00100
6 ptls_iovec_init [function] [call site] 00101
6 labeled_expand [function] [call site] 00102
6 ptls_iovec_init [function] [call site] 00103
6 ptls_iovec_init [function] [call site] 00104
6 labeled_expand [function] [call site] 00105
6 ptls_aead_new_direct [function] [call site] 00106
6 ptls_buffer_dispose [function] [call site] 00107
5 ptls_iovec_init [function] [call site] 00108
4 duplicate_as_str [function] [call site] 00109
4 clear_ech [function] [call site] 00110
5 ptls_aead_free [function] [call site] 00111
5 ptls_iovec_init [function] [call site] 00112
5 ptls_iovec_init [function] [call site] 00113
3 client_setup_ech_grease [function] [call site] 00114
4 ptls_aead_new_direct [function] [call site] 00115
4 strlen [call site] 00116
4 duplicate_as_str [function] [call site] 00117
4 clear_ech [function] [call site] 00118
3 decode_stored_session_ticket [function] [call site] 00119
4 ptls_decode64 [function] [call site] 00120
5 ntoh64 [function] [call site] 00121
4 ptls_decode16 [function] [call site] 00122
5 ntoh16 [function] [call site] 00123
4 ptls_decode16 [function] [call site] 00124
4 ptls_decode_quicint [function] [call site] 00125
4 ptls_decode_quicint [function] [call site] 00126
4 ptls_iovec_init [function] [call site] 00127
3 ptls_iovec_init [function] [call site] 00128
3 __assert_fail [call site] 00129
3 key_schedule_new [function] [call site] 00130
4 key_schedule_free [function] [call site] 00131
3 key_schedule_extract [function] [call site] 00132
4 ptls_iovec_init [function] [call site] 00133
4 ptls_iovec_init [function] [call site] 00134
4 ptls_iovec_init [function] [call site] 00135
4 ptls_hkdf_expand_label [function] [call site] 00136
5 ptls_buffer_init [function] [call site] 00137
5 ptls_buffer__do_pushv [function] [call site] 00138
5 ptls_buffer__do_pushv [function] [call site] 00139
5 strlen [call site] 00140
5 ptls_buffer__do_pushv [function] [call site] 00141
5 ptls_iovec_init [function] [call site] 00142
5 ptls_hkdf_expand [function] [call site] 00143
5 ptls_buffer_dispose [function] [call site] 00144
4 ptls_iovec_init [function] [call site] 00145
4 ptls_hkdf_extract [function] [call site] 00146
3 encode_client_hello [function] [call site] 00147
4 __assert_fail [call site] 00148
4 ptls_buffer__do_pushv [function] [call site] 00149
4 __assert_fail [call site] 00150
3 derive_secret_with_empty_digest [function] [call site] 00151
4 derive_secret_with_hash [function] [call site] 00152
5 ptls_iovec_init [function] [call site] 00153
5 ptls_iovec_init [function] [call site] 00154
5 ptls_hkdf_expand_label [function] [call site] 00155
3 ptls__key_schedule_update_hash [function] [call site] 00156
3 calc_verify_data [function] [call site] 00157
4 ptls_iovec_init [function] [call site] 00158
4 ptls_iovec_init [function] [call site] 00159
4 ptls_hkdf_expand_label [function] [call site] 00160
3 ptls__key_schedule_update_hash [function] [call site] 00161
3 ptls_iovec_init [function] [call site] 00162
3 encode_client_hello [function] [call site] 00163
3 strlen [call site] 00164
3 ptls_buffer_reserve [function] [call site] 00165
3 ptls_iovec_init [function] [call site] 00166
3 encode_client_hello [function] [call site] 00167
3 ptls_aead_encrypt [function] [call site] 00168
3 outer_ech_header_size [function] [call site] 00169
3 outer_ech_header_size [function] [call site] 00170
3 ptls__key_schedule_update_hash [function] [call site] 00171
3 __assert_fail [call site] 00172
3 setup_traffic_protection [function] [call site] 00173
4 derive_secret [function] [call site] 00174
5 derive_secret_with_hash [function] [call site] 00175
4 ptls_is_server [function] [call site] 00176
4 ptls_iovec_init [function] [call site] 00177
4 ptls_aead_free [function] [call site] 00178
4 ptls_aead_new [function] [call site] 00179
5 ptls_iovec_init [function] [call site] 00180
5 new_aead [function] [call site] 00181
6 get_traffic_keys [function] [call site] 00182
7 get_traffic_key [function] [call site] 00183
8 ptls_iovec_init [function] [call site] 00184
8 ptls_hkdf_expand_label [function] [call site] 00185
7 get_traffic_key [function] [call site] 00186
6 ptls_aead_new_direct [function] [call site] 00187
3 push_change_cipher_spec [function] [call site] 00188
4 ptls_buffer__do_pushv [function] [call site] 00189
3 derive_exporter_secret [function] [call site] 00190
4 __assert_fail [call site] 00191
4 derive_secret [function] [call site] 00192
4 ptls_iovec_init [function] [call site] 00193
4 log_secret [function] [call site] 00194
5 ptls_skip_tracing [function] [call site] 00195
5 ptls_buffer_init [function] [call site] 00196
5 ptls_hexdump [function] [call site] 00197
6 byte_to_hex [function] [call site] 00198
3 ptls_buffer_dispose [function] [call site] 00199
2 server_finish_handshake [function] [call site] 00200
3 send_certificate_verify [function] [call site] 00201
4 ptls_buffer__do_pushv [function] [call site] 00202
4 ptls_iovec_init [function] [call site] 00203
4 __assert_fail [call site] 00204
3 send_finished [function] [call site] 00205
4 ptls_buffer__do_pushv [function] [call site] 00206
3 __assert_fail [call site] 00207
3 ptls_iovec_init [function] [call site] 00208
3 key_schedule_extract [function] [call site] 00209
3 setup_traffic_protection [function] [call site] 00210
3 derive_secret [function] [call site] 00211
3 derive_exporter_secret [function] [call site] 00212
3 commission_handshake_secret [function] [call site] 00213
4 ptls_is_server [function] [call site] 00214
4 __assert_fail [call site] 00215
4 setup_traffic_protection [function] [call site] 00216
3 send_session_ticket [function] [call site] 00217
4 __assert_fail [call site] 00218
4 __assert_fail [call site] 00219
4 ptls_buffer_init [function] [call site] 00220
4 __assert_fail [call site] 00221
4 ptls_buffer__do_pushv [function] [call site] 00222
4 ptls_buffer__do_pushv [function] [call site] 00223
4 ptls_iovec_init [function] [call site] 00224
4 encode_session_identifier [function] [call site] 00225
5 ptls_buffer__do_pushv [function] [call site] 00226
5 strlen [call site] 00227
4 ptls_buffer__do_pushv [function] [call site] 00228
4 ptls_iovec_init [function] [call site] 00229
4 ptls_buffer_dispose [function] [call site] 00230
2 ptls_buffer_init [function] [call site] 00231
2 handle_input [function] [call site] 00232
3 parse_record [function] [call site] 00233
4 __assert_fail [call site] 00234
4 parse_record_header [function] [call site] 00235
5 ntoh16 [function] [call site] 00236
5 ntoh16 [function] [call site] 00237
4 ptls_buffer_init [function] [call site] 00238
4 ptls_buffer_reserve [function] [call site] 00239
4 parse_record_header [function] [call site] 00240
4 ptls_buffer_reserve [function] [call site] 00241
3 __assert_fail [call site] 00242
3 ptls_buffer_reserve [function] [call site] 00243
3 aead_decrypt [function] [call site] 00244
3 handle_handshake_record [function] [call site] 00245
4 message_buffer_is_overflow [function] [call site] 00246
4 ptls_buffer_reserve [function] [call site] 00247
4 ntoh24 [function] [call site] 00248
4 ptls_iovec_init [function] [call site] 00249
4 ptls_buffer_dispose [function] [call site] 00250
4 message_buffer_is_overflow [function] [call site] 00251
4 ptls_buffer_init [function] [call site] 00252
4 ptls_buffer_reserve [function] [call site] 00253
4 ptls_buffer_dispose [function] [call site] 00254
3 handle_alert [function] [call site] 00255
3 ptls_buffer_dispose [function] [call site] 00256
2 __assert_fail [call site] 00257
2 ptls_buffer_dispose [function] [call site] 00258
2 ptls_send_alert [function] [call site] 00259
3 ptls_buffer__do_pushv [function] [call site] 00260
3 buffer_encrypt_record [function] [call site] 00261
4 ptls_buffer_reserve_aligned [function] [call site] 00262
4 aead_encrypt [function] [call site] 00263
4 __assert_fail [call site] 00264
4 buffer_push_encrypted_records [function] [call site] 00265
5 ptls_buffer__do_pushv [function] [call site] 00266
5 __assert_fail [call site] 00267
5 ptls_aead_encrypt [function] [call site] 00268
5 ptls_buffer__do_pushv [function] [call site] 00269
1 ptls_buffer_dispose [function] [call site] 00270
1 ptls_buffer_init [function] [call site] 00271
1 ptls_receive [function] [call site] 00272
2 __assert_fail [call site] 00273
2 handle_input_tls12 [function] [call site] 00274
3 parse_record [function] [call site] 00275
3 __assert_fail [call site] 00276
3 __assert_fail [call site] 00277
3 ptls_decode64 [function] [call site] 00278
3 build_tls12_aad [function] [call site] 00279
3 ptls_buffer_reserve [function] [call site] 00280
3 ptls_aead_decrypt [function] [call site] 00281
3 handle_alert [function] [call site] 00282
3 ptls_buffer_dispose [function] [call site] 00283
2 handle_input [function] [call site] 00284
1 ptls_buffer_dispose [function] [call site] 00285
1 ptls_free [function] [call site] 00286
2 ptls_skip_tracing [function] [call site] 00287
2 ptls_buffer_init [function] [call site] 00288
2 ptls_buffer_dispose [function] [call site] 00289
2 ptls_buffer_dispose [function] [call site] 00290
2 free_exporter_master_secret [function] [call site] 00291
3 __assert_fail [call site] 00292
2 free_exporter_master_secret [function] [call site] 00293
2 key_schedule_free [function] [call site] 00294
2 ptls_aead_free [function] [call site] 00295
2 ptls_aead_free [function] [call site] 00296
2 clear_ech [function] [call site] 00297
2 ptls_iovec_init [function] [call site] 00298
2 ptls_iovec_init [function] [call site] 00299
2 update_open_count [function] [call site] 00300