Fuzz introspector: fuzz/fuzz-asn1.c
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
198 1109 14 :

['push_change_cipher_spec', 'derive_exporter_secret', 'send_finished', 'send_certificate_verify', 'derive_secret', 'free', 'commission_handshake_secret', 'ptls_buffer__do_pushv', 'send_certificate', 'ptls_buffer__adjust_quic_blocksize', 'key_schedule_extract', 'ptls_iovec_init', 'ptls__key_schedule_update_hash', 'setup_traffic_protection']

198 1109 client_handle_finished call site: 00000 /src/picotls/lib/picotls.c:3357
168 168 1 :

['commission_handshake_secret']

168 351 server_finish_handshake call site: 00000 /src/picotls/lib/picotls.c:4741
151 443 5 :

['check_client_hello_constraints', 'ptls_aead_decrypt', 'ptls_aead_free', 'decode_client_hello', 'rebuild_ch_inner']

1460 6009 server_handle_hello call site: 00000 /src/picotls/lib/picotls.c:4271
142 142 2 :

['free', 'client_ech_select_hello']

142 1013 client_handle_hello call site: 00000 /src/picotls/lib/picotls.c:2738
142 142 1 :

['client_ech_select_hello']

142 650 client_handle_hello call site: 00000 /src/picotls/lib/picotls.c:2758
102 102 1 :

['decode_stored_session_ticket']

190 1826 send_client_hello call site: 00000 /src/picotls/lib/picotls.c:2325
90 270 4 :

['ptls__key_schedule_update_hash', 'push_signature_algorithms', 'ptls_buffer__adjust_quic_blocksize', 'ptls_buffer__do_pushv']

90 622 server_handle_hello call site: 00000 /src/picotls/lib/picotls.c:4663
80 160 2 :

['calc_verify_data', 'derive_secret_with_empty_digest']

88 1257 send_client_hello call site: 00000 /src/picotls/lib/picotls.c:2386
62 62 3 :

['buffer_push_encrypted_records', 'malloc', 'free']

62 62 buffer_encrypt_record call site: 00000 /src/picotls/lib/picotls.c:804
60 160 5 :

['ptls_iovec_init', 'build_certificate_verify_signdata', 'ptls__key_schedule_update_hash', 'ptls_buffer__do_pushv', 'ptls_buffer__adjust_quic_blocksize']

60 160 send_certificate_verify call site: 00000 /src/picotls/lib/picotls.c:3094
8 736 8 :

['ptls_aead_encrypt', 'outer_ech_header_size', 'ptls_buffer_reserve', 'strlen', 'ptls_iovec_init', 'malloc', 'ptls__key_schedule_update_hash', 'encode_client_hello']

8 1089 send_client_hello call site: 00000 /src/picotls/lib/picotls.c:2398
7 107 7 :

['ptls_decode16', 'ptls_decode_quicint', 'ptls_decode24', 'ptls_iovec_init', 'malloc', 'ptls__key_schedule_update_hash', 'client_do_handle_certificate']

7 107 client_handle_compressed_certificate call site: 00000 /src/picotls/lib/picotls.c:3234

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 count_printf [function] [call site] 00001
1 feeder_init [function] [call site] 00002
1 feeder_next_byte [function] [call site] 00003
1 feeder_next_byte [function] [call site] 00004
1 feeder_next_byte [function] [call site] 00005
1 ptls_asn1_validation [function] [call site] 00006
2 ptls_asn1_validation_recursive [function] [call site] 00007
3 ptls_asn1_read_type [function] [call site] 00008
4 ptls_asn1_error_message [function] [call site] 00009
5 ptls_asn1_print_indent [function] [call site] 00010
3 ptls_asn1_print_type [function] [call site] 00011
4 ptls_asn1_print_indent [function] [call site] 00012
3 ptls_asn1_read_length [function] [call site] 00013
4 ptls_asn1_error_message [function] [call site] 00014
4 ptls_asn1_error_message [function] [call site] 00015
3 ptls_asn1_error_message [function] [call site] 00016
3 ptls_asn1_print_indent [function] [call site] 00017
3 ptls_asn1_validation_recursive [function] [call site] 00018
4 ptls_asn1_print_indent [function] [call site] 00019
4 ptls_asn1_dump_content [function] [call site] 00020
1 feeder_next_byte [function] [call site] 00021
1 feeder_next_byte [function] [call site] 00022
1 ptls_asn1_get_expected_type_and_length [function] [call site] 00023
2 ptls_asn1_error_message [function] [call site] 00024
2 ptls_asn1_read_length [function] [call site] 00025
2 ptls_asn1_error_message [function] [call site] 00026
1 mkstemp [call site] 00027
1 write [call site] 00028
1 ptls_minicrypto_random_bytes [function] [call site] 00029
2 cf_hash_drbg_sha256_needs_reseed [function] [call site] 00030
2 read_entropy [function] [call site] 00031
3 open [call site] 00032
3 open [call site] 00033
3 perror [call site] 00034
3 abort [call site] 00035
3 read [call site] 00036
3 perror [call site] 00037
3 abort [call site] 00038
3 close [call site] 00039
2 cf_hash_drbg_sha256_init [function] [call site] 00040
3 mem_clean [function] [call site] 00041
3 hash_df [function] [call site] 00042
4 write32_be [function] [call site] 00043
3 hash_df [function] [call site] 00044
2 cf_hash_drbg_sha256_gen [function] [call site] 00045
3 cf_hash_drbg_sha256_gen_additional [function] [call site] 00046
4 hash_gen_request [function] [call site] 00047
5 cf_hash_drbg_sha256_needs_reseed [function] [call site] 00048
5 abort [call site] 00049
5 hash_process_addnl [function] [call site] 00050
6 add [function] [call site] 00051
5 hash_generate [function] [call site] 00052
6 add [function] [call site] 00053
5 hash_step [function] [call site] 00054
6 write32_be [function] [call site] 00055
6 add [function] [call site] 00056
6 add [function] [call site] 00057
6 add [function] [call site] 00058
1 ptls_load_certificates [function] [call site] 00059
2 ptls_load_pem_objects [function] [call site] 00060
3 fopen [call site] 00061
3 ptls_buffer_init [function] [call site] 00062
4 __assert_fail [call site] 00063
3 ptls_get_pem_object [function] [call site] 00064
4 fgets [call site] 00065
4 ptls_compare_separator_line [function] [call site] 00066
5 strncmp [call site] 00067
5 strlen [call site] 00068
5 strncmp [call site] 00069
5 strlen [call site] 00070
5 strncmp [call site] 00071
5 strncmp [call site] 00072
4 ptls_base64_decode_init [function] [call site] 00073
4 fgets [call site] 00074
4 ptls_compare_separator_line [function] [call site] 00075
4 ptls_base64_decode [function] [call site] 00076
5 ptls_buffer__do_pushv [function] [call site] 00077
6 ptls_buffer_reserve [function] [call site] 00078
7 ptls_buffer_reserve_aligned [function] [call site] 00079
8 posix_memalign [call site] 00080
8 ptls_buffer__release_memory [function] [call site] 00081
3 ptls_buffer_dispose [function] [call site] 00082
4 ptls_buffer__release_memory [function] [call site] 00083
3 ptls_buffer_dispose [function] [call site] 00084
3 fclose [call site] 00085
1 ptls_minicrypto_load_private_key [function] [call site] 00086
2 ptls_pem_parse_private_key [function] [call site] 00087
3 ptls_load_pem_objects [function] [call site] 00088
3 ptls_minicrypto_asn1_decode_private_key [function] [call site] 00089
4 ptls_asn1_get_expected_type_and_length [function] [call site] 00090
4 ptls_asn1_error_message [function] [call site] 00091
4 ptls_asn1_error_message [function] [call site] 00092
4 ptls_asn1_get_expected_type_and_length [function] [call site] 00093
4 ptls_asn1_get_expected_type_and_length [function] [call site] 00094
4 ptls_asn1_dump_content [function] [call site] 00095
4 ptls_asn1_error_message [function] [call site] 00096
4 ptls_asn1_get_expected_type_and_length [function] [call site] 00097
4 ptls_asn1_validation_recursive [function] [call site] 00098
4 ptls_asn1_error_message [function] [call site] 00099
2 memcmp [call site] 00100
2 ptls_set_ecdsa_private_key [function] [call site] 00101
3 ptls_asn1_get_expected_type_and_length [function] [call site] 00102
3 ptls_asn1_error_message [function] [call site] 00103
3 ptls_asn1_dump_content [function] [call site] 00104
3 ptls_asn1_get_expected_type_and_length [function] [call site] 00105
3 ptls_asn1_error_message [function] [call site] 00106
3 ptls_asn1_error_message [function] [call site] 00107
3 ptls_asn1_error_message [function] [call site] 00108
3 ptls_asn1_get_expected_type_and_length [function] [call site] 00109
3 memcmp [call site] 00110
3 ptls_iovec_init [function] [call site] 00111
3 ptls_minicrypto_init_secp256r1sha256_sign_certificate [function] [call site] 00112
4 secp256r1sha256_sign [function] [call site] 00113
5 cf_sha256_init [function] [call site] 00114
5 cf_sha256_update [function] [call site] 00115
6 cf_blockwise_accumulate [function] [call site] 00116
7 cf_blockwise_accumulate_final [function] [call site] 00117
8 abort [call site] 00118
8 abort [call site] 00119
8 abort [call site] 00120
8 abort [call site] 00121
8 abort [call site] 00122
6 sha256_update_block [function] [call site] 00123
7 read32_be [function] [call site] 00124
7 rotr32 [function] [call site] 00125
7 rotr32 [function] [call site] 00126
7 rotr32 [function] [call site] 00127
7 rotr32 [function] [call site] 00128
5 cf_sha256_digest_final [function] [call site] 00129
6 cf_blockwise_acc_pad [function] [call site] 00130
7 cf_blockwise_accumulate [function] [call site] 00131
7 cf_blockwise_accumulate [function] [call site] 00132
7 cf_blockwise_accumulate [function] [call site] 00133
7 cf_blockwise_accumulate [function] [call site] 00134
7 cf_blockwise_acc_byte [function] [call site] 00135
7 cf_blockwise_accumulate [function] [call site] 00136
7 cf_blockwise_acc_byte [function] [call site] 00137
6 sha256_update_block [function] [call site] 00138
6 write64_be [function] [call site] 00139
6 cf_sha256_update [function] [call site] 00140
6 abort [call site] 00141
6 write32_be [function] [call site] 00142
6 write32_be [function] [call site] 00143
6 write32_be [function] [call site] 00144
6 write32_be [function] [call site] 00145
6 write32_be [function] [call site] 00146
6 write32_be [function] [call site] 00147
6 write32_be [function] [call site] 00148
6 write32_be [function] [call site] 00149
5 uECC_secp256r1 [function] [call site] 00150
5 uECC_sign [function] [call site] 00151
6 uECC_generate_random_int [function] [call site] 00152
7 uECC_vli_numBits [function] [call site] 00153
8 vli_numDigits [function] [call site] 00154
7 uECC_vli_isZero [function] [call site] 00155
7 uECC_vli_cmp [function] [call site] 00156
8 uECC_vli_sub [function] [call site] 00157
8 uECC_vli_isZero [function] [call site] 00158
6 uECC_sign_with_k_internal [function] [call site] 00159
7 uECC_vli_isZero [function] [call site] 00160
7 regularize_k [function] [call site] 00161
8 uECC_vli_add [function] [call site] 00162
8 uECC_vli_testBit [function] [call site] 00163
8 uECC_vli_add [function] [call site] 00164
7 uECC_generate_random_int [function] [call site] 00165
7 EccPoint_mult [function] [call site] 00166
8 uECC_vli_set [function] [call site] 00167
8 uECC_vli_set [function] [call site] 00168
8 XYcZ_initial_double [function] [call site] 00169
9 uECC_vli_set [function] [call site] 00170
9 uECC_vli_clear [function] [call site] 00171
9 uECC_vli_set [function] [call site] 00172
9 uECC_vli_set [function] [call site] 00173
9 apply_z [function] [call site] 00174
10 uECC_vli_modSquare_fast [function] [call site] 00175
11 uECC_vli_modMult_fast [function] [call site] 00176
12 uECC_vli_mult [function] [call site] 00177
13 muladd [function] [call site] 00178
13 muladd [function] [call site] 00179
10 uECC_vli_modMult_fast [function] [call site] 00180
10 uECC_vli_modMult_fast [function] [call site] 00181
10 uECC_vli_modMult_fast [function] [call site] 00182
9 apply_z [function] [call site] 00183
8 uECC_vli_testBit [function] [call site] 00184
8 XYcZ_addC [function] [call site] 00185
9 uECC_vli_modSub [function] [call site] 00186
10 uECC_vli_sub [function] [call site] 00187
10 uECC_vli_add [function] [call site] 00188
9 uECC_vli_modSquare_fast [function] [call site] 00189
9 uECC_vli_modMult_fast [function] [call site] 00190
9 uECC_vli_modMult_fast [function] [call site] 00191
9 uECC_vli_modAdd [function] [call site] 00192
10 uECC_vli_add [function] [call site] 00193
10 uECC_vli_cmp_unsafe [function] [call site] 00194
10 uECC_vli_sub [function] [call site] 00195
9 uECC_vli_modSub [function] [call site] 00196
9 uECC_vli_modSub [function] [call site] 00197
9 uECC_vli_modMult_fast [function] [call site] 00198
9 uECC_vli_modAdd [function] [call site] 00199
9 uECC_vli_modSquare_fast [function] [call site] 00200
9 uECC_vli_modSub [function] [call site] 00201
9 uECC_vli_modSub [function] [call site] 00202
9 uECC_vli_modMult_fast [function] [call site] 00203
9 uECC_vli_modSub [function] [call site] 00204
9 uECC_vli_modSquare_fast [function] [call site] 00205
9 uECC_vli_modSub [function] [call site] 00206
9 uECC_vli_modSub [function] [call site] 00207
9 uECC_vli_modMult_fast [function] [call site] 00208
9 uECC_vli_modSub [function] [call site] 00209
9 uECC_vli_set [function] [call site] 00210
8 XYcZ_add [function] [call site] 00211
9 uECC_vli_modSub [function] [call site] 00212
9 uECC_vli_modSquare_fast [function] [call site] 00213
9 uECC_vli_modMult_fast [function] [call site] 00214
9 uECC_vli_modMult_fast [function] [call site] 00215
9 uECC_vli_modSub [function] [call site] 00216
9 uECC_vli_modSquare_fast [function] [call site] 00217
9 uECC_vli_modSub [function] [call site] 00218
9 uECC_vli_modSub [function] [call site] 00219
9 uECC_vli_modSub [function] [call site] 00220
9 uECC_vli_modMult_fast [function] [call site] 00221
9 uECC_vli_modSub [function] [call site] 00222
9 uECC_vli_modMult_fast [function] [call site] 00223
9 uECC_vli_modSub [function] [call site] 00224
9 uECC_vli_set [function] [call site] 00225
8 uECC_vli_testBit [function] [call site] 00226
8 XYcZ_addC [function] [call site] 00227
8 uECC_vli_modSub [function] [call site] 00228
8 uECC_vli_modMult_fast [function] [call site] 00229
8 uECC_vli_modMult_fast [function] [call site] 00230
8 uECC_vli_modInv [function] [call site] 00231
9 uECC_vli_isZero [function] [call site] 00232
9 uECC_vli_clear [function] [call site] 00233
9 uECC_vli_set [function] [call site] 00234
9 uECC_vli_set [function] [call site] 00235
9 uECC_vli_clear [function] [call site] 00236
9 uECC_vli_clear [function] [call site] 00237
9 uECC_vli_cmp_unsafe [function] [call site] 00238
9 uECC_vli_rshift1 [function] [call site] 00239
9 vli_modInv_update [function] [call site] 00240
10 uECC_vli_add [function] [call site] 00241
10 uECC_vli_rshift1 [function] [call site] 00242
9 uECC_vli_rshift1 [function] [call site] 00243
9 vli_modInv_update [function] [call site] 00244
9 uECC_vli_sub [function] [call site] 00245
9 uECC_vli_rshift1 [function] [call site] 00246
9 uECC_vli_cmp_unsafe [function] [call site] 00247
9 uECC_vli_add [function] [call site] 00248
9 uECC_vli_sub [function] [call site] 00249
9 vli_modInv_update [function] [call site] 00250
9 uECC_vli_sub [function] [call site] 00251
9 uECC_vli_rshift1 [function] [call site] 00252
9 uECC_vli_cmp_unsafe [function] [call site] 00253
9 uECC_vli_add [function] [call site] 00254
9 uECC_vli_sub [function] [call site] 00255
9 vli_modInv_update [function] [call site] 00256
9 uECC_vli_set [function] [call site] 00257
8 uECC_vli_modMult_fast [function] [call site] 00258
8 uECC_vli_modMult_fast [function] [call site] 00259
8 XYcZ_add [function] [call site] 00260
8 apply_z [function] [call site] 00261
8 uECC_vli_set [function] [call site] 00262
8 uECC_vli_set [function] [call site] 00263
7 uECC_vli_isZero [function] [call site] 00264
7 uECC_vli_clear [function] [call site] 00265
7 uECC_generate_random_int [function] [call site] 00266
7 uECC_vli_modMult [function] [call site] 00267
8 uECC_vli_mult [function] [call site] 00268
8 uECC_vli_mmod [function] [call site] 00269
9 uECC_vli_numBits [function] [call site] 00270
9 uECC_vli_clear [function] [call site] 00271
9 uECC_vli_set [function] [call site] 00272
9 uECC_vli_rshift1 [function] [call site] 00273
9 uECC_vli_rshift1 [function] [call site] 00274
9 uECC_vli_set [function] [call site] 00275
7 uECC_vli_modInv [function] [call site] 00276
7 uECC_vli_modMult [function] [call site] 00277
7 uECC_vli_nativeToBytes [function] [call site] 00278
7 uECC_vli_bytesToNative [function] [call site] 00279
8 uECC_vli_clear [function] [call site] 00280
7 uECC_vli_set [function] [call site] 00281
7 uECC_vli_modMult [function] [call site] 00282
7 bits2int [function] [call site] 00283
8 uECC_vli_clear [function] [call site] 00284
8 uECC_vli_bytesToNative [function] [call site] 00285
8 uECC_vli_cmp_unsafe [function] [call site] 00286
8 uECC_vli_sub [function] [call site] 00287
7 uECC_vli_modAdd [function] [call site] 00288
7 uECC_vli_modMult [function] [call site] 00289
7 uECC_vli_numBits [function] [call site] 00290
7 uECC_vli_nativeToBytes [function] [call site] 00291
5 ptls_buffer__do_pushv [function] [call site] 00292
1 unlink [call site] 00293