High level conclusions

Fuzzer encapsulated_request_certificate_req is blocked:

The runtime code coverage of encapsulated_request_certificate_req covers 4.347% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer finish_req is blocked:

The runtime code coverage of finish_req covers 1.587% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer end_session_rsp is blocked:

The runtime code coverage of end_session_rsp covers 5.172% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer key_update_rsp is blocked:

The runtime code coverage of key_update_rsp covers 5.172% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer vendor_req is blocked:

The runtime code coverage of vendor_req covers 7.142% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer psk_finish_req is blocked:

The runtime code coverage of psk_finish_req covers 4.761% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer measurement_rsp is blocked:

The runtime code coverage of measurement_rsp covers 4.347% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer digest_rsp is blocked:

The runtime code coverage of digest_rsp covers 2.439% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer keyexchange_rsp is blocked:

The runtime code coverage of keyexchange_rsp covers 5.555% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer algorithm_req is blocked:

The runtime code coverage of algorithm_req covers 7.142% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer pskexchange_rsp is blocked:

The runtime code coverage of pskexchange_rsp covers 5.084% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer certificate_rsp is blocked:

The runtime code coverage of certificate_rsp covers 4.347% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer psk_exchange_req is blocked:

The runtime code coverage of psk_exchange_req covers 6.666% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer end_session_req is blocked:

The runtime code coverage of end_session_req covers 5.084% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer capability_rsp is blocked:

The runtime code coverage of capability_rsp covers 7.142% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer algorithm_rsp is blocked:

The runtime code coverage of algorithm_rsp covers 7.142% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer heartbeat_req is blocked:

The runtime code coverage of heartbeat_req covers 5.084% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer key_exchange_req is blocked:

The runtime code coverage of key_exchange_req covers 5.263% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer psk_finish_rsp is blocked:

The runtime code coverage of psk_finish_rsp covers 4.615% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer digest_req is blocked:

The runtime code coverage of digest_req covers 1.428% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer finish_rsp is blocked:

The runtime code coverage of finish_rsp covers 3.797% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer key_update_req is blocked:

The runtime code coverage of key_update_req covers 10.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer version_req is blocked:

The runtime code coverage of version_req covers 12.5% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer deliver_encapsulated_response_rsp is blocked:

The runtime code coverage of deliver_encapsulated_response_rsp covers 6.25% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer deliver_encapsulated_response_certificate_rsp is blocked:

The runtime code coverage of deliver_encapsulated_response_certificate_rsp covers 6.382% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer capability_req is blocked:

The runtime code coverage of capability_req covers 7.317% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer vendor_rsp is blocked:

The runtime code coverage of vendor_rsp covers 6.521% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer encapsulated_request_req is blocked:

The runtime code coverage of encapsulated_request_req covers 4.918% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer measurement_req is blocked:

The runtime code coverage of measurement_req covers 3.703% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer deliver_encapsulated_response_digest_rsp is blocked:

The runtime code coverage of deliver_encapsulated_response_digest_rsp covers 7.317% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer encapsulated_request_digest_req is blocked:

The runtime code coverage of encapsulated_request_digest_req covers 4.285% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer certificate_req is blocked:

The runtime code coverage of certificate_req covers 1.449% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer version_rsp is blocked:

The runtime code coverage of version_rsp covers 6.25% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer challenge_rsp is blocked:

The runtime code coverage of challenge_rsp covers 5.555% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer get_encapsulated_request_rsp is blocked:

The runtime code coverage of get_encapsulated_request_rsp covers 6.382% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer heartbeat_rsp is blocked:

The runtime code coverage of heartbeat_rsp covers 5.172% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer challenge_req is blocked:

The runtime code coverage of challenge_req covers 5.357% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzers reach 0.599% of cyclomatic complexity.

Fuzzers reach 1.171% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

57 / 4867

Cyclomatic complexity statically reachable by fuzzers

53 / 8848

Runtime code coverage of functions

906 / 4867

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: challenge_req

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	847	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	847	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
846	0	EP	call site: 00000	fuzz_send_receive_spdm_challenge

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

53

Reachable functions

56

Percentage of reachable functions covered

5.36%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
spdmlib/fuzz/fuzz_targets/challenge_req.rs	4
fuzz-target/requester/challenge_req/src/main.rs	17
test/spdmlib-test/src/common/util.rs	43
test/spdm-emu/src/spdm_emu.rs	25
external/aws-lc-rs/aws-lc-rs/build.rs	4
external/ring/build.rs	1
external/aws-lc-rs/aws-lc-rs/src/test.rs	8
spdmlib_crypto_aws_lc/src/pqc_cert_verify_impl.rs	3
spdmlib/src/crypto/bytes_mut_scrubbed.rs	7
tdisp/src/pci_tdisp.rs	2
external/aws-lc-rs/aws-lc-rs/src/key_wrap.rs	11
external/aws-lc-rs/aws-lc-rs/src/digest/digest_ctx.rs	5
spdmlib/src/error.rs	2
test/spdm-emu/src/socket_io_transport.rs	16
codec/src/codec.rs	3
external/aws-lc-rs/aws-lc-rs/src/ptr.rs	1
external/aws-lc-rs/aws-lc-rs/src/fips.rs	8
spdmlib_crypto_aws_lc/src/aead_impl.rs	1
test/spdm-emu/src/crypto_callback.rs	5
spdmlib_crypto_aws_lc/src/hash_impl.rs	5
external/ring/src/polyfill/slice.rs	3
spdmlib/src/protocol/mod.rs	6
spdmlib/src/crypto/spdm_x509/src/certificate/mod.rs	1
test/spdmlib-test/src/responder_tests/context.rs	15
test/spdmlib-test/src/common/device_io.rs	7
spdmlib/src/responder/capability_rsp.rs	10
spdmlib/src/common/session.rs	6
test/spdm-emu/src/async_runtime.rs	3
test/spdm-requester-emu/src/main.rs	8
external/ring/src/io/der_writer.rs	11
external/ring/src/io/writer.rs	3
fuzz-target/fuzzlib/src/fake_device_io.rs	2
spdmlib/src/common/mod.rs	1
test/spdmlib-test/src/common/crypto_callback.rs	3
test/spdmlib-test/src/requester_tests/challenge_req.rs	18

Fuzzer: heartbeat_rsp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	721	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	721	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
720	0	EP	call site: 00000	ResponderContext::build_supported_algorithms_block

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

55

Reachable functions

58

Percentage of reachable functions covered

5.17%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
spdmlib/fuzz/fuzz_targets/heartbeat_rsp.rs	4
fuzz-target/responder/heartbeat_rsp/src/main.rs	16
spdmlib_crypto_aws_lc/src/pqc_cert_verify_impl.rs	3
spdmlib/src/crypto/bytes_mut_scrubbed.rs	7
test/spdmlib-test/src/common/util.rs	39
test/spdm-emu/src/spdm_emu.rs	25
external/aws-lc-rs/aws-lc-rs/build.rs	4
external/ring/build.rs	1
external/aws-lc-rs/aws-lc-rs/src/test.rs	8
tdisp/src/pci_tdisp.rs	2
external/aws-lc-rs/aws-lc-rs/src/key_wrap.rs	11
external/aws-lc-rs/aws-lc-rs/src/digest/digest_ctx.rs	5
spdmlib/src/error.rs	2
test/spdm-emu/src/socket_io_transport.rs	11
codec/src/codec.rs	3
external/aws-lc-rs/aws-lc-rs/src/ptr.rs	1
external/aws-lc-rs/aws-lc-rs/src/fips.rs	8
spdmlib_crypto_aws_lc/src/aead_impl.rs	1
test/spdm-emu/src/crypto_callback.rs	5
spdmlib_crypto_aws_lc/src/hash_impl.rs	3
external/ring/src/polyfill/slice.rs	3
spdmlib/src/protocol/mod.rs	6
spdmlib/src/crypto/spdm_x509/src/certificate/mod.rs	1
test/spdmlib-test/src/responder_tests/context.rs	15
test/spdmlib-test/src/common/device_io.rs	7
spdmlib/src/responder/capability_rsp.rs	10
spdmlib/src/common/session.rs	6
test/spdm-emu/src/async_runtime.rs	3
test/spdm-requester-emu/src/main.rs	8
external/ring/src/io/der_writer.rs	11
external/ring/src/io/writer.rs	3
test/spdmlib-test/src/responder_tests/heartbeat_rsp.rs	18

Fuzzer: get_encapsulated_request_rsp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	869	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	869	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
868	0	EP	call site: 00000	SpdmSession::decode_spdm_secured_message

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

44

Reachable functions

47

Percentage of reachable functions covered

6.38%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
spdmlib/fuzz/fuzz_targets/get_encapsulated_request_rsp.rs	4
fuzz-target/responder/get_encapsulated_request_rsp/src/main.rs	14
spdmlib_crypto_aws_lc/src/pqc_cert_verify_impl.rs	3
spdmlib/src/crypto/bytes_mut_scrubbed.rs	7
test/spdmlib-test/src/common/util.rs	39
test/spdm-emu/src/spdm_emu.rs	29
external/aws-lc-rs/aws-lc-rs/build.rs	4
external/ring/build.rs	1
external/aws-lc-rs/aws-lc-rs/src/test.rs	8
tdisp/src/pci_tdisp.rs	3
external/aws-lc-rs/aws-lc-rs/src/key_wrap.rs	11
external/aws-lc-rs/aws-lc-rs/src/digest/digest_ctx.rs	5
spdmlib/src/error.rs	2
test/spdm-emu/src/socket_io_transport.rs	11
codec/src/codec.rs	3
external/aws-lc-rs/aws-lc-rs/src/ptr.rs	1
external/aws-lc-rs/aws-lc-rs/src/fips.rs	8
spdmlib_crypto_aws_lc/src/aead_impl.rs	4
test/spdm-emu/src/crypto_callback.rs	5
spdmlib_crypto_aws_lc/src/hash_impl.rs	3
external/ring/src/polyfill/slice.rs	3
spdmlib/src/protocol/mod.rs	6
spdmlib/src/crypto/spdm_x509/src/certificate/mod.rs	3
test/spdmlib-test/src/responder_tests/context.rs	15
test/spdmlib-test/src/common/device_io.rs	7
spdmlib/src/responder/capability_rsp.rs	10
spdmlib/src/common/session.rs	20
test/spdm-emu/src/async_runtime.rs	3
test/spdm-requester-emu/src/main.rs	8
external/ring/src/io/der_writer.rs	11
external/ring/src/io/writer.rs	3
test/spdmlib-test/src/responder_tests/encap_rsp.rs	17
test/spdmlib-test/src/requester_tests/encap_req.rs	13
test/spdm-emu/src/tcp_transport.rs	4
spdmlib/src/common/mod.rs	13
test/spdmlib-test/src/common/crypto_callback.rs	3
spdmlib/src/message/heartbeat.rs	2

Fuzzer: challenge_rsp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1970	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	1970	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1969	0	EP	call site: 00000	SpdmMessage::spdm_read

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

51

Reachable functions

54

Percentage of reachable functions covered

5.56%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
spdmlib/fuzz/fuzz_targets/challenge_rsp.rs	4
fuzz-target/responder/challenge_rsp/src/main.rs	15
spdmlib_crypto_aws_lc/src/pqc_cert_verify_impl.rs	3
spdmlib/src/crypto/bytes_mut_scrubbed.rs	7
test/spdmlib-test/src/common/util.rs	43
test/spdm-emu/src/spdm_emu.rs	45
external/aws-lc-rs/aws-lc-rs/build.rs	4
external/ring/build.rs	1
external/aws-lc-rs/aws-lc-rs/src/test.rs	8
tdisp/src/pci_tdisp.rs	3
external/aws-lc-rs/aws-lc-rs/src/key_wrap.rs	11
external/aws-lc-rs/aws-lc-rs/src/digest/digest_ctx.rs	5
spdmlib/src/error.rs	2
test/spdm-emu/src/socket_io_transport.rs	15
codec/src/codec.rs	4
external/aws-lc-rs/aws-lc-rs/src/ptr.rs	1
external/aws-lc-rs/aws-lc-rs/src/fips.rs	8
spdmlib_crypto_aws_lc/src/aead_impl.rs	1
test/spdm-emu/src/crypto_callback.rs	5
spdmlib_crypto_aws_lc/src/hash_impl.rs	5
external/ring/src/polyfill/slice.rs	3
spdmlib/src/protocol/mod.rs	6
spdmlib/src/crypto/spdm_x509/src/certificate/mod.rs	1
test/spdmlib-test/src/responder_tests/context.rs	15
test/spdmlib-test/src/common/device_io.rs	7
spdmlib/src/responder/capability_rsp.rs	10
spdmlib/src/common/session.rs	6
test/spdm-emu/src/async_runtime.rs	3
test/spdm-requester-emu/src/main.rs	8
external/ring/src/io/der_writer.rs	11
external/ring/src/io/writer.rs	3
test/spdmlib-test/src/common/crypto_callback.rs	3
test/spdmlib-test/src/responder_tests/challenge_rsp.rs	26
spdmlib/src/message/heartbeat.rs	73
spdmlib/src/message/mod.rs	60
spdmlib/src/message/vendor.rs	2
spdmlib/src/crypto/spdm_x509/src/x509/signature.rs	2
spdmlib/src/protocol/algo.rs	3
spdmlib/src/common/mod.rs	6
spdmlib/src/common/spdm_codec.rs	6

Fuzzer: version_rsp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1913	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	1913	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1912	0	EP	call site: 00000	SpdmMessage::spdm_read

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

45

Reachable functions

48

Percentage of reachable functions covered

6.25%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
spdmlib/fuzz/fuzz_targets/version_rsp.rs	4
fuzz-target/responder/version_rsp/src/main.rs	14
test/spdmlib-test/src/common/util.rs	39
test/spdm-emu/src/spdm_emu.rs	45
external/aws-lc-rs/aws-lc-rs/build.rs	4
external/ring/build.rs	1
external/aws-lc-rs/aws-lc-rs/src/test.rs	8
spdmlib_crypto_aws_lc/src/pqc_cert_verify_impl.rs	3
spdmlib/src/crypto/bytes_mut_scrubbed.rs	7
tdisp/src/pci_tdisp.rs	3
external/aws-lc-rs/aws-lc-rs/src/key_wrap.rs	11
external/aws-lc-rs/aws-lc-rs/src/digest/digest_ctx.rs	5
spdmlib/src/error.rs	2
test/spdm-emu/src/socket_io_transport.rs	11
codec/src/codec.rs	4
external/aws-lc-rs/aws-lc-rs/src/ptr.rs	1
external/aws-lc-rs/aws-lc-rs/src/fips.rs	8
spdmlib_crypto_aws_lc/src/aead_impl.rs	1
test/spdm-emu/src/crypto_callback.rs	5
spdmlib_crypto_aws_lc/src/hash_impl.rs	3
external/ring/src/polyfill/slice.rs	3
spdmlib/src/protocol/mod.rs	6
spdmlib/src/crypto/spdm_x509/src/certificate/mod.rs	1
test/spdmlib-test/src/responder_tests/context.rs	15
test/spdmlib-test/src/common/device_io.rs	7
spdmlib/src/responder/capability_rsp.rs	10
spdmlib/src/common/session.rs	6
test/spdm-emu/src/async_runtime.rs	3
test/spdm-requester-emu/src/main.rs	8
external/ring/src/io/der_writer.rs	11
external/ring/src/io/writer.rs	3
test/spdmlib-test/src/responder_tests/version_rsp.rs	18
spdmlib/src/message/heartbeat.rs	73
spdmlib/src/message/mod.rs	60
spdmlib/src/message/vendor.rs	2
spdmlib/src/crypto/spdm_x509/src/x509/signature.rs	2
spdmlib/src/protocol/algo.rs	3
spdmlib/src/common/mod.rs	6
spdmlib/src/common/spdm_codec.rs	6
test/spdm-emu/src/tcp_transport.rs	4

Fuzzer: certificate_req

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	878	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	878	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
877	0	EP	call site: 00000	SpdmCertificateResponsePayload::spdm_read

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

68

Reachable functions

69

Percentage of reachable functions covered

1.45%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
spdmlib/fuzz/fuzz_targets/certificate_req.rs	4
fuzz-target/requester/encapsulated_request_certificate_req/src/main.rs	19
spdmlib_crypto_aws_lc/src/pqc_cert_verify_impl.rs	3
spdmlib/src/crypto/bytes_mut_scrubbed.rs	7
test/spdmlib-test/src/common/util.rs	43
test/spdm-emu/src/spdm_emu.rs	29
external/aws-lc-rs/aws-lc-rs/build.rs	4
external/ring/build.rs	1
external/aws-lc-rs/aws-lc-rs/src/test.rs	8
tdisp/src/pci_tdisp.rs	3
external/aws-lc-rs/aws-lc-rs/src/key_wrap.rs	11
external/aws-lc-rs/aws-lc-rs/src/digest/digest_ctx.rs	5
spdmlib/src/error.rs	2
test/spdm-emu/src/socket_io_transport.rs	16
codec/src/codec.rs	3
external/aws-lc-rs/aws-lc-rs/src/ptr.rs	1
external/aws-lc-rs/aws-lc-rs/src/fips.rs	8
spdmlib_crypto_aws_lc/src/aead_impl.rs	1
test/spdm-emu/src/crypto_callback.rs	5
spdmlib_crypto_aws_lc/src/hash_impl.rs	5
external/ring/src/polyfill/slice.rs	3
spdmlib/src/protocol/mod.rs	6
spdmlib/src/crypto/spdm_x509/src/certificate/mod.rs	1
test/spdmlib-test/src/responder_tests/context.rs	15
test/spdmlib-test/src/common/device_io.rs	7
spdmlib/src/responder/capability_rsp.rs	10
spdmlib/src/common/session.rs	6
test/spdm-emu/src/async_runtime.rs	3
test/spdm-requester-emu/src/main.rs	8
external/ring/src/io/der_writer.rs	11
external/ring/src/io/writer.rs	3
test/spdmlib-test/src/common/crypto_callback.rs	3
test/spdmlib-test/src/requester_tests/encap_certificate.rs	17
spdmlib/src/message/heartbeat.rs	8

Fuzzer: encapsulated_request_digest_req

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	895	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	895	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
894	0	EP	call site: 00000	SpdmDigestsResponsePayload::spdm_read

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

67

Reachable functions

70

Percentage of reachable functions covered

4.29%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
spdmlib/fuzz/fuzz_targets/encapsulated_request_digest_req.rs	4
fuzz-target/requester/encapsulated_request_digest_req/src/main.rs	20
spdmlib_crypto_aws_lc/src/pqc_cert_verify_impl.rs	3
spdmlib/src/crypto/bytes_mut_scrubbed.rs	7
test/spdmlib-test/src/common/util.rs	43
test/spdm-emu/src/spdm_emu.rs	31
external/aws-lc-rs/aws-lc-rs/build.rs	4
external/ring/build.rs	1
external/aws-lc-rs/aws-lc-rs/src/test.rs	8
tdisp/src/pci_tdisp.rs	3
external/aws-lc-rs/aws-lc-rs/src/key_wrap.rs	11
external/aws-lc-rs/aws-lc-rs/src/digest/digest_ctx.rs	5
spdmlib/src/error.rs	2
test/spdm-emu/src/socket_io_transport.rs	16
codec/src/codec.rs	3
external/aws-lc-rs/aws-lc-rs/src/ptr.rs	1
external/aws-lc-rs/aws-lc-rs/src/fips.rs	8
spdmlib_crypto_aws_lc/src/aead_impl.rs	1
test/spdm-emu/src/crypto_callback.rs	5
spdmlib_crypto_aws_lc/src/hash_impl.rs	5
external/ring/src/polyfill/slice.rs	3
spdmlib/src/protocol/mod.rs	6
spdmlib/src/crypto/spdm_x509/src/certificate/mod.rs	1
test/spdmlib-test/src/responder_tests/context.rs	15
test/spdmlib-test/src/common/device_io.rs	7
spdmlib/src/responder/capability_rsp.rs	10
spdmlib/src/common/session.rs	6
test/spdm-emu/src/async_runtime.rs	3
test/spdm-requester-emu/src/main.rs	8
external/ring/src/io/der_writer.rs	11
external/ring/src/io/writer.rs	3
test/spdmlib-test/src/common/crypto_callback.rs	3
test/spdmlib-test/src/requester_tests/encap_digest.rs	17
spdmlib/src/message/heartbeat.rs	12
spdmlib/src/common/mod.rs	1
spdmlib/src/crypto/spdm_x509/src/x509/signature.rs	2

Fuzzer: deliver_encapsulated_response_digest_rsp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	716	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	716	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
715	0	EP	call site: 00000	ResponderContext::build_supported_algorithms_block

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

38

Reachable functions

41

Percentage of reachable functions covered

7.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
spdmlib/fuzz/fuzz_targets/deliver_encapsulated_response_digest_rsp.rs	4
fuzz-target/responder/deliver_encapsulated_response_digest_rsp/src/main.rs	12
spdmlib_crypto_aws_lc/src/pqc_cert_verify_impl.rs	3
spdmlib/src/crypto/bytes_mut_scrubbed.rs	7
test/spdmlib-test/src/common/util.rs	39
test/spdm-emu/src/spdm_emu.rs	25
external/aws-lc-rs/aws-lc-rs/build.rs	4
external/ring/build.rs	1
external/aws-lc-rs/aws-lc-rs/src/test.rs	8
tdisp/src/pci_tdisp.rs	2
external/aws-lc-rs/aws-lc-rs/src/key_wrap.rs	11
external/aws-lc-rs/aws-lc-rs/src/digest/digest_ctx.rs	5
spdmlib/src/error.rs	2
test/spdm-emu/src/socket_io_transport.rs	11
codec/src/codec.rs	3
external/aws-lc-rs/aws-lc-rs/src/ptr.rs	1
external/aws-lc-rs/aws-lc-rs/src/fips.rs	8
spdmlib_crypto_aws_lc/src/aead_impl.rs	1
test/spdm-emu/src/crypto_callback.rs	5
spdmlib_crypto_aws_lc/src/hash_impl.rs	3
external/ring/src/polyfill/slice.rs	3
spdmlib/src/protocol/mod.rs	6
spdmlib/src/crypto/spdm_x509/src/certificate/mod.rs	1
test/spdmlib-test/src/responder_tests/context.rs	15
test/spdmlib-test/src/common/device_io.rs	7
spdmlib/src/responder/capability_rsp.rs	10
spdmlib/src/common/session.rs	6
test/spdm-emu/src/async_runtime.rs	3
test/spdm-requester-emu/src/main.rs	8
external/ring/src/io/der_writer.rs	11
external/ring/src/io/writer.rs	3
test/spdmlib-test/src/responder_tests/encap_get_digest.rs	13

Fuzzer: measurement_req

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	954	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	954	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
953	0	EP	call site: 00000	SpdmKeySchedule::derive_master_secret

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

78

Reachable functions

81

Percentage of reachable functions covered

3.7%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
spdmlib/fuzz/fuzz_targets/measurement_req.rs	4
fuzz-target/requester/measurement_req/src/main.rs	26
spdmlib_crypto_aws_lc/src/pqc_cert_verify_impl.rs	3
spdmlib/src/crypto/bytes_mut_scrubbed.rs	13
test/spdmlib-test/src/common/util.rs	43
test/spdm-emu/src/spdm_emu.rs	25
external/aws-lc-rs/aws-lc-rs/build.rs	4
external/ring/build.rs	1
external/aws-lc-rs/aws-lc-rs/src/test.rs	8
tdisp/src/pci_tdisp.rs	2
external/aws-lc-rs/aws-lc-rs/src/key_wrap.rs	11
external/aws-lc-rs/aws-lc-rs/src/digest/digest_ctx.rs	5
spdmlib/src/error.rs	2
test/spdm-emu/src/socket_io_transport.rs	16
codec/src/codec.rs	4
external/aws-lc-rs/aws-lc-rs/src/ptr.rs	1
external/aws-lc-rs/aws-lc-rs/src/fips.rs	8
spdmlib_crypto_aws_lc/src/aead_impl.rs	2
test/spdm-emu/src/crypto_callback.rs	5
spdmlib_crypto_aws_lc/src/hash_impl.rs	7
external/ring/src/polyfill/slice.rs	3
spdmlib/src/protocol/mod.rs	6
spdmlib/src/crypto/spdm_x509/src/certificate/mod.rs	1
test/spdmlib-test/src/responder_tests/context.rs	15
test/spdmlib-test/src/common/device_io.rs	7
spdmlib/src/responder/capability_rsp.rs	10
spdmlib/src/common/session.rs	9
test/spdm-emu/src/async_runtime.rs	3
test/spdm-requester-emu/src/main.rs	8
external/ring/src/io/der_writer.rs	11
external/ring/src/io/writer.rs	3
fuzz-target/fuzzlib/src/fake_device_io.rs	2
test/spdmlib-test/src/common/crypto_callback.rs	4
spdmlib/src/common/mod.rs	5
test/spdmlib-test/src/requester_tests/get_measurements_req.rs	23
spdmlib/src/common/key_schedule.rs	21
spdmlib/src/protocol/algo.rs	4

Fuzzer: encapsulated_request_req

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	851	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	851	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
850	0	EP	call site: 00000	fuzz_session_based_mutual_authenticate

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

58

Reachable functions

61

Percentage of reachable functions covered

4.92%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
spdmlib/fuzz/fuzz_targets/encapsulated_request_req.rs	4
fuzz-target/requester/encapsulated_request_req/src/main.rs	19
spdmlib_crypto_aws_lc/src/pqc_cert_verify_impl.rs	3
spdmlib/src/crypto/bytes_mut_scrubbed.rs	7
test/spdmlib-test/src/common/util.rs	39
test/spdm-emu/src/spdm_emu.rs	25
external/aws-lc-rs/aws-lc-rs/build.rs	4
external/ring/build.rs	1
external/aws-lc-rs/aws-lc-rs/src/test.rs	8
tdisp/src/pci_tdisp.rs	2
external/aws-lc-rs/aws-lc-rs/src/key_wrap.rs	11
external/aws-lc-rs/aws-lc-rs/src/digest/digest_ctx.rs	5
spdmlib/src/error.rs	2
test/spdm-emu/src/socket_io_transport.rs	12
codec/src/codec.rs	3
external/aws-lc-rs/aws-lc-rs/src/ptr.rs	1
external/aws-lc-rs/aws-lc-rs/src/fips.rs	8
spdmlib_crypto_aws_lc/src/aead_impl.rs	1
test/spdm-emu/src/crypto_callback.rs	5
spdmlib_crypto_aws_lc/src/hash_impl.rs	3
external/ring/src/polyfill/slice.rs	3
spdmlib/src/protocol/mod.rs	6
spdmlib/src/crypto/spdm_x509/src/certificate/mod.rs	1
test/spdmlib-test/src/responder_tests/context.rs	15
test/spdmlib-test/src/common/device_io.rs	7
spdmlib/src/responder/capability_rsp.rs	10
spdmlib/src/common/session.rs	6
test/spdm-emu/src/async_runtime.rs	3
test/spdm-requester-emu/src/main.rs	8
external/ring/src/io/der_writer.rs	11
external/ring/src/io/writer.rs	3
fuzz-target/fuzzlib/src/fake_device_io.rs	2

Fuzzer: vendor_rsp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	719	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	719	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
718	0	EP	call site: 00000	ResponderContext::build_supported_algorithms_block

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

43

Reachable functions

46

Percentage of reachable functions covered

6.52%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
spdmlib/fuzz/fuzz_targets/vendor_rsp.rs	4
fuzz-target/responder/vendor_rsp/src/main.rs	16
spdmlib_crypto_aws_lc/src/pqc_cert_verify_impl.rs	3
spdmlib/src/crypto/bytes_mut_scrubbed.rs	7
test/spdmlib-test/src/common/util.rs	39
test/spdm-emu/src/spdm_emu.rs	25
external/aws-lc-rs/aws-lc-rs/build.rs	4
external/ring/build.rs	1
external/aws-lc-rs/aws-lc-rs/src/test.rs	8
tdisp/src/pci_tdisp.rs	2
external/aws-lc-rs/aws-lc-rs/src/key_wrap.rs	11
external/aws-lc-rs/aws-lc-rs/src/digest/digest_ctx.rs	5
spdmlib/src/error.rs	2
test/spdm-emu/src/socket_io_transport.rs	11
codec/src/codec.rs	3
external/aws-lc-rs/aws-lc-rs/src/ptr.rs	1
external/aws-lc-rs/aws-lc-rs/src/fips.rs	8
spdmlib_crypto_aws_lc/src/aead_impl.rs	1
test/spdm-emu/src/crypto_callback.rs	5
spdmlib_crypto_aws_lc/src/hash_impl.rs	3
external/ring/src/polyfill/slice.rs	3
spdmlib/src/protocol/mod.rs	6
spdmlib/src/crypto/spdm_x509/src/certificate/mod.rs	1
test/spdmlib-test/src/responder_tests/context.rs	15
test/spdmlib-test/src/common/device_io.rs	7
spdmlib/src/responder/capability_rsp.rs	10
spdmlib/src/common/session.rs	6
test/spdm-emu/src/async_runtime.rs	3
test/spdm-requester-emu/src/main.rs	8
external/ring/src/io/der_writer.rs	11
external/ring/src/io/writer.rs	3
spdmlib/src/message/vendor.rs	2
test/spdmlib-test/src/responder_tests/vendor_rsp.rs	13
spdmlib/src/responder/vendor_rsp.rs	1

Fuzzer: capability_req

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	739	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	739	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
738	0	EP	call site: 00000	ResponderContext::build_supported_algorithms_block

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

38

Reachable functions

41

Percentage of reachable functions covered

7.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
spdmlib/fuzz/fuzz_targets/capability_req.rs	4
fuzz-target/requester/capability_req/src/main.rs	10
test/spdmlib-test/src/common/util.rs	39
test/spdm-emu/src/spdm_emu.rs	25
external/aws-lc-rs/aws-lc-rs/build.rs	4
external/ring/build.rs	1
external/aws-lc-rs/aws-lc-rs/src/test.rs	8
spdmlib_crypto_aws_lc/src/pqc_cert_verify_impl.rs	3
spdmlib/src/crypto/bytes_mut_scrubbed.rs	7
tdisp/src/pci_tdisp.rs	2
external/aws-lc-rs/aws-lc-rs/src/key_wrap.rs	11
external/aws-lc-rs/aws-lc-rs/src/digest/digest_ctx.rs	5
spdmlib/src/error.rs	2
test/spdm-emu/src/socket_io_transport.rs	12
codec/src/codec.rs	3
external/aws-lc-rs/aws-lc-rs/src/ptr.rs	1
external/aws-lc-rs/aws-lc-rs/src/fips.rs	8
spdmlib_crypto_aws_lc/src/aead_impl.rs	1
test/spdm-emu/src/crypto_callback.rs	5
spdmlib_crypto_aws_lc/src/hash_impl.rs	3
external/ring/src/polyfill/slice.rs	3
spdmlib/src/protocol/mod.rs	6
spdmlib/src/crypto/spdm_x509/src/certificate/mod.rs	1
test/spdmlib-test/src/responder_tests/context.rs	15
test/spdmlib-test/src/common/device_io.rs	7
spdmlib/src/responder/capability_rsp.rs	10
spdmlib/src/common/session.rs	6
test/spdm-emu/src/async_runtime.rs	3
test/spdm-requester-emu/src/main.rs	8
external/ring/src/io/der_writer.rs	11
external/ring/src/io/writer.rs	3
fuzz-target/fuzzlib/src/fake_device_io.rs	2
test/spdmlib-test/src/requester_tests/get_capabilities_req.rs	15
spdmlib/src/common/mod.rs	1

Fuzzer: deliver_encapsulated_response_certificate_rsp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	760	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	760	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
759	0	EP	call site: 00000	ResponderContext::build_supported_algorithms_block

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

44

Reachable functions

47

Percentage of reachable functions covered

6.38%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
spdmlib/fuzz/fuzz_targets/deliver_encapsulated_response_certificate_rsp.rs	4
fuzz-target/responder/deliver_encapsulated_response_certificate_rsp/src/main.rs	17
spdmlib_crypto_aws_lc/src/pqc_cert_verify_impl.rs	3
spdmlib/src/crypto/bytes_mut_scrubbed.rs	8
test/spdmlib-test/src/common/util.rs	39
test/spdm-emu/src/spdm_emu.rs	25
external/aws-lc-rs/aws-lc-rs/build.rs	4
external/ring/build.rs	1
external/aws-lc-rs/aws-lc-rs/src/test.rs	8
tdisp/src/pci_tdisp.rs	2
external/aws-lc-rs/aws-lc-rs/src/key_wrap.rs	11
external/aws-lc-rs/aws-lc-rs/src/digest/digest_ctx.rs	5
spdmlib/src/error.rs	2
test/spdm-emu/src/socket_io_transport.rs	11
codec/src/codec.rs	3
external/aws-lc-rs/aws-lc-rs/src/ptr.rs	1
external/aws-lc-rs/aws-lc-rs/src/fips.rs	8
spdmlib_crypto_aws_lc/src/aead_impl.rs	4
test/spdm-emu/src/crypto_callback.rs	5
spdmlib_crypto_aws_lc/src/hash_impl.rs	3
external/ring/src/polyfill/slice.rs	3
spdmlib/src/protocol/mod.rs	6
spdmlib/src/crypto/spdm_x509/src/certificate/mod.rs	1
test/spdmlib-test/src/responder_tests/context.rs	15
test/spdmlib-test/src/common/device_io.rs	7
spdmlib/src/responder/capability_rsp.rs	10
spdmlib/src/common/session.rs	6
test/spdm-emu/src/async_runtime.rs	3
test/spdm-requester-emu/src/main.rs	8
external/ring/src/io/der_writer.rs	11
external/ring/src/io/writer.rs	3
test/spdmlib-test/src/responder_tests/encap_get_certificate.rs	18

Fuzzer: deliver_encapsulated_response_rsp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	777	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	777	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
776	0	EP	call site: 00000	ResponderContext::build_supported_algorithms_block

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

45

Reachable functions

48

Percentage of reachable functions covered

6.25%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
spdmlib/fuzz/fuzz_targets/deliver_encapsulated_response_rsp.rs	4
fuzz-target/responder/deliver_encapsulated_response_rsp/src/main.rs	15
spdmlib_crypto_aws_lc/src/pqc_cert_verify_impl.rs	3
spdmlib/src/crypto/bytes_mut_scrubbed.rs	7
test/spdmlib-test/src/common/util.rs	39
test/spdm-emu/src/spdm_emu.rs	25
external/aws-lc-rs/aws-lc-rs/build.rs	4
external/ring/build.rs	1
external/aws-lc-rs/aws-lc-rs/src/test.rs	8
tdisp/src/pci_tdisp.rs	2
external/aws-lc-rs/aws-lc-rs/src/key_wrap.rs	11
external/aws-lc-rs/aws-lc-rs/src/digest/digest_ctx.rs	5
spdmlib/src/error.rs	2
test/spdm-emu/src/socket_io_transport.rs	11
codec/src/codec.rs	3
external/aws-lc-rs/aws-lc-rs/src/ptr.rs	1
external/aws-lc-rs/aws-lc-rs/src/fips.rs	8
spdmlib_crypto_aws_lc/src/aead_impl.rs	4
test/spdm-emu/src/crypto_callback.rs	5
spdmlib_crypto_aws_lc/src/hash_impl.rs	3
external/ring/src/polyfill/slice.rs	3
spdmlib/src/protocol/mod.rs	6
spdmlib/src/crypto/spdm_x509/src/certificate/mod.rs	1
test/spdmlib-test/src/responder_tests/context.rs	15
test/spdmlib-test/src/common/device_io.rs	7
spdmlib/src/responder/capability_rsp.rs	10
spdmlib/src/common/session.rs	6
test/spdm-emu/src/async_runtime.rs	3
test/spdm-requester-emu/src/main.rs	8
external/ring/src/io/der_writer.rs	11
external/ring/src/io/writer.rs	3

Fuzzer: version_req

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	746	99.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	0.13%
lawngreen	50+	1	0.13%
All colors	748	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
692	0	EP	call site: 00000	ResponderContext::build_supported_algorithms_block
54	693	Self::send_receive_spdm_version	call site: 00693	SocketIoTransport::new

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

14

Reachable functions

16

Percentage of reachable functions covered

12.5%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
spdmlib/fuzz/fuzz_targets/version_req.rs	4
fuzz-target/requester/version_req/src/main.rs	10
test/spdmlib-test/src/common/util.rs	39
test/spdm-emu/src/spdm_emu.rs	25
external/aws-lc-rs/aws-lc-rs/build.rs	4
external/ring/build.rs	1
external/aws-lc-rs/aws-lc-rs/src/test.rs	8
spdmlib_crypto_aws_lc/src/pqc_cert_verify_impl.rs	3
spdmlib/src/crypto/bytes_mut_scrubbed.rs	7
tdisp/src/pci_tdisp.rs	2
external/aws-lc-rs/aws-lc-rs/src/key_wrap.rs	11
external/aws-lc-rs/aws-lc-rs/src/digest/digest_ctx.rs	5
spdmlib/src/error.rs	2
test/spdm-emu/src/socket_io_transport.rs	12
codec/src/codec.rs	3
external/aws-lc-rs/aws-lc-rs/src/ptr.rs	1
external/aws-lc-rs/aws-lc-rs/src/fips.rs	8
spdmlib_crypto_aws_lc/src/aead_impl.rs	1
test/spdm-emu/src/crypto_callback.rs	5
spdmlib_crypto_aws_lc/src/hash_impl.rs	3
external/ring/src/polyfill/slice.rs	3
spdmlib/src/protocol/mod.rs	6
spdmlib/src/crypto/spdm_x509/src/certificate/mod.rs	1
test/spdmlib-test/src/responder_tests/context.rs	15
test/spdmlib-test/src/common/device_io.rs	7
spdmlib/src/responder/capability_rsp.rs	10
spdmlib/src/common/session.rs	6
test/spdm-emu/src/async_runtime.rs	3
test/spdm-requester-emu/src/main.rs	8
external/ring/src/io/der_writer.rs	11
external/ring/src/io/writer.rs	3
fuzz-target/fuzzlib/src/fake_device_io.rs	2
test/spdmlib-test/src/requester_tests/get_version_req.rs	13

Fuzzer: key_update_req

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	476	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	476	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
475	0	EP	call site: 00000	ResponderContext::build_supported_algorithms_block

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

9

Reachable functions

10

Percentage of reachable functions covered

10.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
spdmlib/fuzz/fuzz_targets/key_update_req.rs	4
fuzz-target/requester/key_update_req/src/main.rs	6
spdmlib_crypto_aws_lc/src/pqc_cert_verify_impl.rs	3
spdmlib/src/crypto/bytes_mut_scrubbed.rs	6
test/spdmlib-test/src/common/util.rs	41
test/spdmlib-test/src/common/crypto_callback.rs	3
spdmlib_crypto_aws_lc/src/hash_impl.rs	5
external/aws-lc-rs/aws-lc-rs/src/test.rs	8
test/spdm-emu/src/spdm_emu.rs	7
tdisp/src/pci_tdisp.rs	2
external/aws-lc-rs/aws-lc-rs/src/key_wrap.rs	11
external/aws-lc-rs/aws-lc-rs/src/digest/digest_ctx.rs	5
spdmlib/src/error.rs	2
test/spdm-emu/src/socket_io_transport.rs	14
codec/src/codec.rs	3
external/aws-lc-rs/aws-lc-rs/src/ptr.rs	1
external/aws-lc-rs/aws-lc-rs/src/fips.rs	4
spdmlib_crypto_aws_lc/src/aead_impl.rs	1
test/spdm-emu/src/crypto_callback.rs	5
external/ring/src/polyfill/slice.rs	3
spdmlib/src/protocol/mod.rs	6
spdmlib/src/crypto/spdm_x509/src/certificate/mod.rs	1
test/spdmlib-test/src/responder_tests/context.rs	15
test/spdmlib-test/src/common/device_io.rs	3
spdmlib/src/responder/capability_rsp.rs	10
spdmlib/src/common/session.rs	6
test/spdm-emu/src/async_runtime.rs	3

Fuzzer: finish_rsp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	974	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	974	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
973	0	EP	call site: 00000	SpdmKeySchedule::derive_master_secret

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

76

Reachable functions

79

Percentage of reachable functions covered

3.8%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
spdmlib/fuzz/fuzz_targets/finish_rsp.rs	4
fuzz-target/responder/finish_rsp/src/main.rs	29
spdmlib_crypto_aws_lc/src/pqc_cert_verify_impl.rs	3
spdmlib/src/crypto/bytes_mut_scrubbed.rs	13
test/spdmlib-test/src/common/util.rs	43
test/spdm-emu/src/spdm_emu.rs	25
external/aws-lc-rs/aws-lc-rs/build.rs	4
external/ring/build.rs	1
external/aws-lc-rs/aws-lc-rs/src/test.rs	8
tdisp/src/pci_tdisp.rs	2
external/aws-lc-rs/aws-lc-rs/src/key_wrap.rs	11
external/aws-lc-rs/aws-lc-rs/src/digest/digest_ctx.rs	5
spdmlib/src/error.rs	2
test/spdm-emu/src/socket_io_transport.rs	15
codec/src/codec.rs	4
external/aws-lc-rs/aws-lc-rs/src/ptr.rs	1
external/aws-lc-rs/aws-lc-rs/src/fips.rs	8
spdmlib_crypto_aws_lc/src/aead_impl.rs	1
test/spdm-emu/src/crypto_callback.rs	5
spdmlib_crypto_aws_lc/src/hash_impl.rs	7
external/ring/src/polyfill/slice.rs	3
spdmlib/src/protocol/mod.rs	6
spdmlib/src/crypto/spdm_x509/src/certificate/mod.rs	1
test/spdmlib-test/src/responder_tests/context.rs	15
test/spdmlib-test/src/common/device_io.rs	7
spdmlib/src/responder/capability_rsp.rs	10
spdmlib/src/common/session.rs	9
test/spdm-emu/src/async_runtime.rs	3
test/spdm-requester-emu/src/main.rs	8
external/ring/src/io/der_writer.rs	11
external/ring/src/io/writer.rs	3
test/spdmlib-test/src/common/crypto_callback.rs	4
spdmlib/src/common/key_schedule.rs	21
spdmlib/src/protocol/algo.rs	4
test/spdmlib-test/src/responder_tests/finish_rsp.rs	21
spdmlib/src/common/mod.rs	4

Fuzzer: digest_req

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	895	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	895	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
894	0	EP	call site: 00000	SpdmDigestsResponsePayload::spdm_read

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

69

Reachable functions

70

Percentage of reachable functions covered

1.43%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
spdmlib/fuzz/fuzz_targets/digest_req.rs	4
fuzz-target/requester/encapsulated_request_digest_req/src/main.rs	20
spdmlib_crypto_aws_lc/src/pqc_cert_verify_impl.rs	3
spdmlib/src/crypto/bytes_mut_scrubbed.rs	7
test/spdmlib-test/src/common/util.rs	43
test/spdm-emu/src/spdm_emu.rs	31
external/aws-lc-rs/aws-lc-rs/build.rs	4
external/ring/build.rs	1
external/aws-lc-rs/aws-lc-rs/src/test.rs	8
tdisp/src/pci_tdisp.rs	3
external/aws-lc-rs/aws-lc-rs/src/key_wrap.rs	11
external/aws-lc-rs/aws-lc-rs/src/digest/digest_ctx.rs	5
spdmlib/src/error.rs	2
test/spdm-emu/src/socket_io_transport.rs	16
codec/src/codec.rs	3
external/aws-lc-rs/aws-lc-rs/src/ptr.rs	1
external/aws-lc-rs/aws-lc-rs/src/fips.rs	8
spdmlib_crypto_aws_lc/src/aead_impl.rs	1
test/spdm-emu/src/crypto_callback.rs	5
spdmlib_crypto_aws_lc/src/hash_impl.rs	5
external/ring/src/polyfill/slice.rs	3
spdmlib/src/protocol/mod.rs	6
spdmlib/src/crypto/spdm_x509/src/certificate/mod.rs	1
test/spdmlib-test/src/responder_tests/context.rs	15
test/spdmlib-test/src/common/device_io.rs	7
spdmlib/src/responder/capability_rsp.rs	10
spdmlib/src/common/session.rs	6
test/spdm-emu/src/async_runtime.rs	3
test/spdm-requester-emu/src/main.rs	8
external/ring/src/io/der_writer.rs	11
external/ring/src/io/writer.rs	3
test/spdmlib-test/src/common/crypto_callback.rs	3
test/spdmlib-test/src/requester_tests/encap_digest.rs	17
spdmlib/src/message/heartbeat.rs	12
spdmlib/src/common/mod.rs	1
spdmlib/src/crypto/spdm_x509/src/x509/signature.rs	2

Fuzzer: psk_finish_rsp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	813	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	813	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
812	0	EP	call site: 00000	ResponderContext::build_supported_algorithms_block

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

62

Reachable functions

65

Percentage of reachable functions covered

4.62%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
spdmlib/fuzz/fuzz_targets/psk_finish_rsp.rs	4
fuzz-target/responder/psk_finish_rsp/src/main.rs	24
spdmlib_crypto_aws_lc/src/pqc_cert_verify_impl.rs	3
spdmlib/src/crypto/bytes_mut_scrubbed.rs	13
test/spdmlib-test/src/common/util.rs	39
test/spdm-emu/src/spdm_emu.rs	27
external/aws-lc-rs/aws-lc-rs/build.rs	4
external/ring/build.rs	1
external/aws-lc-rs/aws-lc-rs/src/test.rs	8
tdisp/src/pci_tdisp.rs	2
external/aws-lc-rs/aws-lc-rs/src/key_wrap.rs	11
external/aws-lc-rs/aws-lc-rs/src/digest/digest_ctx.rs	5
spdmlib/src/error.rs	2
test/spdm-emu/src/socket_io_transport.rs	11
codec/src/codec.rs	4
external/aws-lc-rs/aws-lc-rs/src/ptr.rs	1
external/aws-lc-rs/aws-lc-rs/src/fips.rs	8
spdmlib_crypto_aws_lc/src/aead_impl.rs	1
test/spdm-emu/src/crypto_callback.rs	5
spdmlib_crypto_aws_lc/src/hash_impl.rs	7
external/ring/src/polyfill/slice.rs	3
spdmlib/src/protocol/mod.rs	6
spdmlib/src/crypto/spdm_x509/src/certificate/mod.rs	1
test/spdmlib-test/src/responder_tests/context.rs	15
test/spdmlib-test/src/common/device_io.rs	7
spdmlib/src/responder/capability_rsp.rs	10
spdmlib/src/common/session.rs	6
test/spdm-emu/src/async_runtime.rs	3
test/spdm-requester-emu/src/main.rs	8
external/ring/src/io/der_writer.rs	11
external/ring/src/io/writer.rs	3
test/spdmlib-test/src/responder_tests/psk_finish_rsp.rs	22
spdmlib/src/message/heartbeat.rs	3
spdmlib/src/common/mod.rs	4

Fuzzer: key_exchange_req

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	856	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	856	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
855	0	EP	call site: 00000	fuzz_send_receive_spdm_key_exchange

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

54

Reachable functions

57

Percentage of reachable functions covered

5.26%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
spdmlib/fuzz/fuzz_targets/key_exchange_req.rs	4
fuzz-target/requester/key_exchange_req/src/main.rs	18
spdmlib_crypto_aws_lc/src/pqc_cert_verify_impl.rs	3
spdmlib/src/crypto/bytes_mut_scrubbed.rs	7
test/spdmlib-test/src/common/util.rs	43
test/spdm-emu/src/spdm_emu.rs	25
external/aws-lc-rs/aws-lc-rs/build.rs	4
external/ring/build.rs	1
external/aws-lc-rs/aws-lc-rs/src/test.rs	8
tdisp/src/pci_tdisp.rs	2
external/aws-lc-rs/aws-lc-rs/src/key_wrap.rs	11
external/aws-lc-rs/aws-lc-rs/src/digest/digest_ctx.rs	5
spdmlib/src/error.rs	2
test/spdm-emu/src/socket_io_transport.rs	16
codec/src/codec.rs	3
external/aws-lc-rs/aws-lc-rs/src/ptr.rs	1
external/aws-lc-rs/aws-lc-rs/src/fips.rs	8
spdmlib_crypto_aws_lc/src/aead_impl.rs	1
test/spdm-emu/src/crypto_callback.rs	5
spdmlib_crypto_aws_lc/src/hash_impl.rs	5
external/ring/src/polyfill/slice.rs	3
spdmlib/src/protocol/mod.rs	6
spdmlib/src/crypto/spdm_x509/src/certificate/mod.rs	1
test/spdmlib-test/src/responder_tests/context.rs	15
test/spdmlib-test/src/common/device_io.rs	7
spdmlib/src/responder/capability_rsp.rs	10
spdmlib/src/common/session.rs	6
test/spdm-emu/src/async_runtime.rs	3
test/spdm-requester-emu/src/main.rs	8
external/ring/src/io/der_writer.rs	11
external/ring/src/io/writer.rs	3
fuzz-target/fuzzlib/src/fake_device_io.rs	2
test/spdmlib-test/src/common/crypto_callback.rs	3
spdmlib/src/common/mod.rs	1
test/spdmlib-test/src/requester_tests/key_exchange_req.rs	17

Fuzzer: heartbeat_req

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	758	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	758	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
757	0	EP	call site: 00000	ResponderContext::build_supported_algorithms_block

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

56

Reachable functions

59

Percentage of reachable functions covered

5.08%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
spdmlib/fuzz/fuzz_targets/heartbeat_req.rs	4
fuzz-target/requester/heartbeat_req/src/main.rs	17
spdmlib_crypto_aws_lc/src/pqc_cert_verify_impl.rs	3
spdmlib/src/crypto/bytes_mut_scrubbed.rs	7
test/spdmlib-test/src/common/util.rs	39
test/spdm-emu/src/spdm_emu.rs	25
external/aws-lc-rs/aws-lc-rs/build.rs	4
external/ring/build.rs	1
external/aws-lc-rs/aws-lc-rs/src/test.rs	8
tdisp/src/pci_tdisp.rs	2
external/aws-lc-rs/aws-lc-rs/src/key_wrap.rs	11
external/aws-lc-rs/aws-lc-rs/src/digest/digest_ctx.rs	5
spdmlib/src/error.rs	2
test/spdm-emu/src/socket_io_transport.rs	12
codec/src/codec.rs	3
external/aws-lc-rs/aws-lc-rs/src/ptr.rs	1
external/aws-lc-rs/aws-lc-rs/src/fips.rs	8
spdmlib_crypto_aws_lc/src/aead_impl.rs	1
test/spdm-emu/src/crypto_callback.rs	5
spdmlib_crypto_aws_lc/src/hash_impl.rs	3
external/ring/src/polyfill/slice.rs	3
spdmlib/src/protocol/mod.rs	6
spdmlib/src/crypto/spdm_x509/src/certificate/mod.rs	1
test/spdmlib-test/src/responder_tests/context.rs	15
test/spdmlib-test/src/common/device_io.rs	7
spdmlib/src/responder/capability_rsp.rs	10
spdmlib/src/common/session.rs	6
test/spdm-emu/src/async_runtime.rs	3
test/spdm-requester-emu/src/main.rs	8
external/ring/src/io/der_writer.rs	11
external/ring/src/io/writer.rs	3
fuzz-target/fuzzlib/src/fake_device_io.rs	2
test/spdmlib-test/src/requester_tests/heartbeat_req.rs	20

Fuzzer: algorithm_rsp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1913	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	1913	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1912	0	EP	call site: 00000	SpdmMessage::spdm_read

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

39

Reachable functions

42

Percentage of reachable functions covered

7.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
spdmlib/fuzz/fuzz_targets/algorithm_rsp.rs	4
fuzz-target/responder/algorithm_rsp/src/main.rs	11
test/spdmlib-test/src/common/util.rs	39
test/spdm-emu/src/spdm_emu.rs	45
external/aws-lc-rs/aws-lc-rs/build.rs	4
external/ring/build.rs	1
external/aws-lc-rs/aws-lc-rs/src/test.rs	8
spdmlib_crypto_aws_lc/src/pqc_cert_verify_impl.rs	3
spdmlib/src/crypto/bytes_mut_scrubbed.rs	7
tdisp/src/pci_tdisp.rs	3
external/aws-lc-rs/aws-lc-rs/src/key_wrap.rs	11
external/aws-lc-rs/aws-lc-rs/src/digest/digest_ctx.rs	5
spdmlib/src/error.rs	2
test/spdm-emu/src/socket_io_transport.rs	11
codec/src/codec.rs	4
external/aws-lc-rs/aws-lc-rs/src/ptr.rs	1
external/aws-lc-rs/aws-lc-rs/src/fips.rs	8
spdmlib_crypto_aws_lc/src/aead_impl.rs	1
test/spdm-emu/src/crypto_callback.rs	5
spdmlib_crypto_aws_lc/src/hash_impl.rs	3
external/ring/src/polyfill/slice.rs	3
spdmlib/src/protocol/mod.rs	6
spdmlib/src/crypto/spdm_x509/src/certificate/mod.rs	1
test/spdmlib-test/src/responder_tests/context.rs	15
test/spdmlib-test/src/common/device_io.rs	7
spdmlib/src/responder/capability_rsp.rs	10
spdmlib/src/common/session.rs	6
test/spdm-emu/src/async_runtime.rs	3
test/spdm-requester-emu/src/main.rs	8
external/ring/src/io/der_writer.rs	11
external/ring/src/io/writer.rs	3
test/spdmlib-test/src/responder_tests/algorithm_rsp.rs	30
spdmlib/src/message/heartbeat.rs	73
spdmlib/src/crypto/spdm_x509/src/x509/signature.rs	2
spdmlib/src/message/mod.rs	60
spdmlib/src/message/vendor.rs	2
spdmlib/src/protocol/algo.rs	3
spdmlib/src/common/mod.rs	6
spdmlib/src/common/spdm_codec.rs	6

Fuzzer: capability_rsp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1906	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	1906	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1905	0	EP	call site: 00000	SpdmMessage::spdm_read

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

39

Reachable functions

42

Percentage of reachable functions covered

7.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
spdmlib/fuzz/fuzz_targets/capability_rsp.rs	4
fuzz-target/responder/capability_rsp/src/main.rs	11
test/spdmlib-test/src/common/util.rs	39
test/spdm-emu/src/spdm_emu.rs	45
external/aws-lc-rs/aws-lc-rs/build.rs	4
external/ring/build.rs	1
external/aws-lc-rs/aws-lc-rs/src/test.rs	8
spdmlib_crypto_aws_lc/src/pqc_cert_verify_impl.rs	3
spdmlib/src/crypto/bytes_mut_scrubbed.rs	7
tdisp/src/pci_tdisp.rs	3
external/aws-lc-rs/aws-lc-rs/src/key_wrap.rs	11
external/aws-lc-rs/aws-lc-rs/src/digest/digest_ctx.rs	5
spdmlib/src/error.rs	2
test/spdm-emu/src/socket_io_transport.rs	11
codec/src/codec.rs	4
external/aws-lc-rs/aws-lc-rs/src/ptr.rs	1
external/aws-lc-rs/aws-lc-rs/src/fips.rs	8
spdmlib_crypto_aws_lc/src/aead_impl.rs	1
test/spdm-emu/src/crypto_callback.rs	5
spdmlib_crypto_aws_lc/src/hash_impl.rs	3
external/ring/src/polyfill/slice.rs	3
spdmlib/src/protocol/mod.rs	6
spdmlib/src/crypto/spdm_x509/src/certificate/mod.rs	1
test/spdmlib-test/src/responder_tests/context.rs	15
test/spdmlib-test/src/common/device_io.rs	7
spdmlib/src/responder/capability_rsp.rs	10
spdmlib/src/common/session.rs	6
test/spdm-emu/src/async_runtime.rs	3
test/spdm-requester-emu/src/main.rs	8
external/ring/src/io/der_writer.rs	11
external/ring/src/io/writer.rs	3
test/spdmlib-test/src/responder_tests/capability_rsp.rs	23
spdmlib/src/message/heartbeat.rs	73
spdmlib/src/crypto/spdm_x509/src/x509/signature.rs	2
spdmlib/src/message/mod.rs	60
spdmlib/src/message/vendor.rs	2
spdmlib/src/protocol/algo.rs	3
spdmlib/src/common/mod.rs	6
spdmlib/src/common/spdm_codec.rs	6

Fuzzer: end_session_req

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	799	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	799	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
798	0	EP	call site: 00000	ResponderContext::build_supported_algorithms_block

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

56

Reachable functions

59

Percentage of reachable functions covered

5.08%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
spdmlib/fuzz/fuzz_targets/end_session_req.rs	4
fuzz-target/requester/end_session_req/src/main.rs	17
spdmlib_crypto_aws_lc/src/pqc_cert_verify_impl.rs	3
spdmlib/src/crypto/bytes_mut_scrubbed.rs	7
test/spdmlib-test/src/common/util.rs	39
test/spdm-emu/src/spdm_emu.rs	25
external/aws-lc-rs/aws-lc-rs/build.rs	4
external/ring/build.rs	1
external/aws-lc-rs/aws-lc-rs/src/test.rs	8
tdisp/src/pci_tdisp.rs	2
external/aws-lc-rs/aws-lc-rs/src/key_wrap.rs	11
external/aws-lc-rs/aws-lc-rs/src/digest/digest_ctx.rs	5
spdmlib/src/error.rs	2
test/spdm-emu/src/socket_io_transport.rs	12
codec/src/codec.rs	3
external/aws-lc-rs/aws-lc-rs/src/ptr.rs	1
external/aws-lc-rs/aws-lc-rs/src/fips.rs	8
spdmlib_crypto_aws_lc/src/aead_impl.rs	1
test/spdm-emu/src/crypto_callback.rs	5
spdmlib_crypto_aws_lc/src/hash_impl.rs	3
external/ring/src/polyfill/slice.rs	3
spdmlib/src/protocol/mod.rs	6
spdmlib/src/crypto/spdm_x509/src/certificate/mod.rs	1
test/spdmlib-test/src/responder_tests/context.rs	15
test/spdmlib-test/src/common/device_io.rs	7
spdmlib/src/responder/capability_rsp.rs	10
spdmlib/src/common/session.rs	6
test/spdm-emu/src/async_runtime.rs	3
test/spdm-requester-emu/src/main.rs	8
external/ring/src/io/der_writer.rs	11
external/ring/src/io/writer.rs	3
fuzz-target/fuzzlib/src/fake_device_io.rs	2
test/spdmlib-test/src/requester_tests/end_session_req.rs	20

Fuzzer: psk_exchange_req

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	785	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	785	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
784	0	EP	call site: 00000	fuzz_send_receive_spdm_psk_exchange

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

42

Reachable functions

45

Percentage of reachable functions covered

6.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
spdmlib/fuzz/fuzz_targets/psk_exchange_req.rs	4
fuzz-target/requester/psk_exchange_req/src/main.rs	14
spdmlib_crypto_aws_lc/src/pqc_cert_verify_impl.rs	3
spdmlib/src/crypto/bytes_mut_scrubbed.rs	7
test/spdmlib-test/src/common/util.rs	39
test/spdm-emu/src/spdm_emu.rs	25
external/aws-lc-rs/aws-lc-rs/build.rs	4
external/ring/build.rs	1
external/aws-lc-rs/aws-lc-rs/src/test.rs	8
tdisp/src/pci_tdisp.rs	2
external/aws-lc-rs/aws-lc-rs/src/key_wrap.rs	11
external/aws-lc-rs/aws-lc-rs/src/digest/digest_ctx.rs	5
spdmlib/src/error.rs	2
test/spdm-emu/src/socket_io_transport.rs	12
codec/src/codec.rs	3
external/aws-lc-rs/aws-lc-rs/src/ptr.rs	1
external/aws-lc-rs/aws-lc-rs/src/fips.rs	8
spdmlib_crypto_aws_lc/src/aead_impl.rs	1
test/spdm-emu/src/crypto_callback.rs	5
spdmlib_crypto_aws_lc/src/hash_impl.rs	3
external/ring/src/polyfill/slice.rs	3
spdmlib/src/protocol/mod.rs	6
spdmlib/src/crypto/spdm_x509/src/certificate/mod.rs	1
test/spdmlib-test/src/responder_tests/context.rs	15
test/spdmlib-test/src/common/device_io.rs	7
spdmlib/src/responder/capability_rsp.rs	10
spdmlib/src/common/session.rs	6
test/spdm-emu/src/async_runtime.rs	3
test/spdm-requester-emu/src/main.rs	8
external/ring/src/io/der_writer.rs	11
external/ring/src/io/writer.rs	3
fuzz-target/fuzzlib/src/fake_device_io.rs	2
test/spdmlib-test/src/requester_tests/psk_exchange_req.rs	16

Fuzzer: certificate_rsp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1958	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	1958	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1957	0	EP	call site: 00000	SpdmMessage::spdm_read

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

66

Reachable functions

69

Percentage of reachable functions covered

4.35%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
spdmlib/fuzz/fuzz_targets/certificate_rsp.rs	4
fuzz-target/responder/certificate_rsp/src/main.rs	19
spdmlib_crypto_aws_lc/src/pqc_cert_verify_impl.rs	3
spdmlib/src/crypto/bytes_mut_scrubbed.rs	7
test/spdmlib-test/src/common/util.rs	43
test/spdm-emu/src/spdm_emu.rs	45
external/aws-lc-rs/aws-lc-rs/build.rs	4
external/ring/build.rs	1
external/aws-lc-rs/aws-lc-rs/src/test.rs	8
tdisp/src/pci_tdisp.rs	3
external/aws-lc-rs/aws-lc-rs/src/key_wrap.rs	11
external/aws-lc-rs/aws-lc-rs/src/digest/digest_ctx.rs	5
spdmlib/src/error.rs	2
test/spdm-emu/src/socket_io_transport.rs	15
codec/src/codec.rs	4
external/aws-lc-rs/aws-lc-rs/src/ptr.rs	1
external/aws-lc-rs/aws-lc-rs/src/fips.rs	8
spdmlib_crypto_aws_lc/src/aead_impl.rs	1
test/spdm-emu/src/crypto_callback.rs	5
spdmlib_crypto_aws_lc/src/hash_impl.rs	5
external/ring/src/polyfill/slice.rs	3
spdmlib/src/protocol/mod.rs	6
spdmlib/src/crypto/spdm_x509/src/certificate/mod.rs	1
test/spdmlib-test/src/responder_tests/context.rs	15
test/spdmlib-test/src/common/device_io.rs	7
spdmlib/src/responder/capability_rsp.rs	10
spdmlib/src/common/session.rs	6
test/spdm-emu/src/async_runtime.rs	3
test/spdm-requester-emu/src/main.rs	8
external/ring/src/io/der_writer.rs	11
external/ring/src/io/writer.rs	3
test/spdmlib-test/src/common/crypto_callback.rs	3
test/spdmlib-test/src/responder_tests/certificate_rsp.rs	23
spdmlib/src/message/heartbeat.rs	73
spdmlib/src/message/mod.rs	60
spdmlib/src/message/vendor.rs	2
spdmlib/src/crypto/spdm_x509/src/x509/signature.rs	2
spdmlib/src/protocol/algo.rs	3
spdmlib/src/common/mod.rs	6
spdmlib/src/common/spdm_codec.rs	6

Fuzzer: pskexchange_rsp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	795	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	795	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
794	0	EP	call site: 00000	ResponderContext::build_supported_algorithms_block

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

56

Reachable functions

59

Percentage of reachable functions covered

5.08%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
spdmlib/fuzz/fuzz_targets/pskexchange_rsp.rs	4
fuzz-target/responder/pskexchange_rsp/src/main.rs	17
spdmlib_crypto_aws_lc/src/pqc_cert_verify_impl.rs	3
spdmlib/src/crypto/bytes_mut_scrubbed.rs	7
test/spdmlib-test/src/common/util.rs	39
test/spdm-emu/src/spdm_emu.rs	25
external/aws-lc-rs/aws-lc-rs/build.rs	4
external/ring/build.rs	1
external/aws-lc-rs/aws-lc-rs/src/test.rs	8
tdisp/src/pci_tdisp.rs	2
external/aws-lc-rs/aws-lc-rs/src/key_wrap.rs	11
external/aws-lc-rs/aws-lc-rs/src/digest/digest_ctx.rs	5
spdmlib/src/error.rs	2
test/spdm-emu/src/socket_io_transport.rs	11
codec/src/codec.rs	3
external/aws-lc-rs/aws-lc-rs/src/ptr.rs	1
external/aws-lc-rs/aws-lc-rs/src/fips.rs	8
spdmlib_crypto_aws_lc/src/aead_impl.rs	1
test/spdm-emu/src/crypto_callback.rs	5
spdmlib_crypto_aws_lc/src/hash_impl.rs	3
external/ring/src/polyfill/slice.rs	3
spdmlib/src/protocol/mod.rs	6
spdmlib/src/crypto/spdm_x509/src/certificate/mod.rs	1
test/spdmlib-test/src/responder_tests/context.rs	15
test/spdmlib-test/src/common/device_io.rs	7
spdmlib/src/responder/capability_rsp.rs	10
spdmlib/src/common/session.rs	6
test/spdm-emu/src/async_runtime.rs	3
test/spdm-requester-emu/src/main.rs	8
external/ring/src/io/der_writer.rs	11
external/ring/src/io/writer.rs	3
spdmlib/src/common/mod.rs	1
test/spdmlib-test/src/responder_tests/psk_exchange_rsp.rs	15
spdmlib/src/common/opaque.rs	3
spdmlib/src/message/heartbeat.rs	3

Fuzzer: fuzz_spdm_x509

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	86	63.2%
gold	[1:9]	0	0.0%
yellow	[10:29]	2	1.47%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	48	35.2%
All colors	136	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
41	85	validate_hardware_identity	call site: 00085	check_hardware_identity_in_extension
15	8	cert_operation::verify_cert_chain	call site: 00008	SocketIoTransport::new
14	34	spdm_x509::Certificate::from_der	call site: 00034	Extensions::decode_value
5	79	find_extension	call site: 00079
2	5	cert_operation::get_cert_from_cert_chain	call site: 00005	cert_operation::verify_cert_chain
2	129	spdmlib::crypto::check_leaf_certificate	call site: 00129
1	0	EP	call site: 00000	cert_operation::get_cert_from_cert_chain
1	3	cert_operation::get_cert_from_cert_chain	call site: 00003
1	31	cert_operation::verify_cert_chain	call site: 00031
1	53	spdmlib::crypto::check_leaf_certificate	call site: 00053
1	56	Extensions::find	call site: 00056	SocketIoTransport::new
1	75	spdmlib::crypto::check_leaf_certificate	call site: 00075	validate_hardware_identity

Runtime coverage analysis

Covered functions

758

Functions that are reachable but not covered

5

Reachable functions

10

Percentage of reachable functions covered

50.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
spdmlib/fuzz/fuzz_targets/fuzz_spdm_x509.rs	5
test/spdmlib-test/src/common/crypto_callback.rs	5
spdmlib/src/crypto/bytes_mut_scrubbed.rs	3
spdmlib/src/crypto/spdm_x509/src/x509/signature.rs	2
spdmlib/src/crypto/spdm_x509/src/certificate/mod.rs	11
spdmlib/src/crypto/mod.rs	11
spdmlib/src/crypto/spdm_x509/src/x509/extensions.rs	4
spdmlib/src/crypto/spdm_x509/src/x509/spdm_validator.rs	22
tdisp/src/pci_tdisp.rs	1

Fuzzer: algorithm_req

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	738	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	738	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
737	0	EP	call site: 00000	ResponderContext::build_supported_algorithms_block

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

39

Reachable functions

42

Percentage of reachable functions covered

7.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
spdmlib/fuzz/fuzz_targets/algorithm_req.rs	4
fuzz-target/requester/algorithm_req/src/main.rs	11
test/spdmlib-test/src/common/util.rs	39
test/spdm-emu/src/spdm_emu.rs	25
external/aws-lc-rs/aws-lc-rs/build.rs	4
external/ring/build.rs	1
external/aws-lc-rs/aws-lc-rs/src/test.rs	8
spdmlib_crypto_aws_lc/src/pqc_cert_verify_impl.rs	3
spdmlib/src/crypto/bytes_mut_scrubbed.rs	7
tdisp/src/pci_tdisp.rs	2
external/aws-lc-rs/aws-lc-rs/src/key_wrap.rs	11
external/aws-lc-rs/aws-lc-rs/src/digest/digest_ctx.rs	5
spdmlib/src/error.rs	2
test/spdm-emu/src/socket_io_transport.rs	12
codec/src/codec.rs	3
external/aws-lc-rs/aws-lc-rs/src/ptr.rs	1
external/aws-lc-rs/aws-lc-rs/src/fips.rs	8
spdmlib_crypto_aws_lc/src/aead_impl.rs	1
test/spdm-emu/src/crypto_callback.rs	5
spdmlib_crypto_aws_lc/src/hash_impl.rs	3
external/ring/src/polyfill/slice.rs	3
spdmlib/src/protocol/mod.rs	6
spdmlib/src/crypto/spdm_x509/src/certificate/mod.rs	1
test/spdmlib-test/src/responder_tests/context.rs	15
test/spdmlib-test/src/common/device_io.rs	7
spdmlib/src/responder/capability_rsp.rs	10
spdmlib/src/common/session.rs	6
test/spdm-emu/src/async_runtime.rs	3
test/spdm-requester-emu/src/main.rs	8
external/ring/src/io/der_writer.rs	11
external/ring/src/io/writer.rs	3
fuzz-target/fuzzlib/src/fake_device_io.rs	2
test/spdmlib-test/src/requester_tests/negotiate_algorithms_req.rs	14

Fuzzer: keyexchange_rsp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1391	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	1391	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1390	0	EP	call site: 00000	SpdmKeySchedule::derive_aead_key_iv

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

51

Reachable functions

54

Percentage of reachable functions covered

5.56%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
spdmlib/fuzz/fuzz_targets/keyexchange_rsp.rs	4
fuzz-target/responder/keyexchange_rsp/src/main.rs	15
spdmlib_crypto_aws_lc/src/pqc_cert_verify_impl.rs	3
spdmlib/src/crypto/bytes_mut_scrubbed.rs	13
test/spdmlib-test/src/common/util.rs	43
test/spdm-emu/src/spdm_emu.rs	27
external/aws-lc-rs/aws-lc-rs/build.rs	4
external/ring/build.rs	1
external/aws-lc-rs/aws-lc-rs/src/test.rs	8
tdisp/src/pci_tdisp.rs	5
external/aws-lc-rs/aws-lc-rs/src/key_wrap.rs	11
external/aws-lc-rs/aws-lc-rs/src/digest/digest_ctx.rs	5
spdmlib/src/error.rs	2
test/spdm-emu/src/socket_io_transport.rs	16
codec/src/codec.rs	4
external/aws-lc-rs/aws-lc-rs/src/ptr.rs	5
external/aws-lc-rs/aws-lc-rs/src/fips.rs	8
spdmlib_crypto_aws_lc/src/aead_impl.rs	1
test/spdm-emu/src/crypto_callback.rs	5
spdmlib_crypto_aws_lc/src/hash_impl.rs	7
external/ring/src/polyfill/slice.rs	3
spdmlib/src/protocol/mod.rs	6
spdmlib/src/crypto/spdm_x509/src/certificate/mod.rs	1
test/spdmlib-test/src/responder_tests/context.rs	15
test/spdmlib-test/src/common/device_io.rs	7
spdmlib/src/responder/capability_rsp.rs	10
spdmlib/src/common/session.rs	20
test/spdm-emu/src/async_runtime.rs	3
test/spdm-requester-emu/src/main.rs	8
external/ring/src/io/der_writer.rs	11
external/ring/src/io/writer.rs	3
test/spdmlib-test/src/common/crypto_callback.rs	7
spdmlib/src/common/mod.rs	1
test/spdmlib-test/src/responder_tests/key_exchange_rsp.rs	27
external/aws-lc-rs/aws-lc-rs/src/ed25519.rs	3
external/ring/src/cpu.rs	1
external/ring/src/polyfill/once_cell/race.rs	5
spdmlib/src/message/heartbeat.rs	9
spdmlib/src/message/mod_test.common.inc.rs	5
external/aws-lc-rs/aws-lc-rs/src/agreement.rs	5
external/aws-lc-rs/aws-lc-rs/src/ec/encoding.rs	13
external/aws-lc-rs/aws-lc-rs/src/cbb.rs	6
test/spdmlib-test/src/requester_tests/finish_req.rs	29
spdmlib/src/common/key_schedule.rs	35
spdmlib/src/protocol/algo.rs	4
spdmlib/src/secret/mod.rs	3
external/aws-lc-rs/aws-lc-rs/src/evp_pkey.rs	6
spdmlib/src/common/opaque.rs	3

Fuzzer: digest_rsp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	716	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	716	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
715	0	EP	call site: 00000	ResponderContext::build_supported_algorithms_block

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

40

Reachable functions

41

Percentage of reachable functions covered

2.44%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
spdmlib/fuzz/fuzz_targets/digest_rsp.rs	4
fuzz-target/responder/deliver_encapsulated_response_digest_rsp/src/main.rs	12
spdmlib_crypto_aws_lc/src/pqc_cert_verify_impl.rs	3
spdmlib/src/crypto/bytes_mut_scrubbed.rs	7
test/spdmlib-test/src/common/util.rs	39
test/spdm-emu/src/spdm_emu.rs	25
external/aws-lc-rs/aws-lc-rs/build.rs	4
external/ring/build.rs	1
external/aws-lc-rs/aws-lc-rs/src/test.rs	8
tdisp/src/pci_tdisp.rs	2
external/aws-lc-rs/aws-lc-rs/src/key_wrap.rs	11
external/aws-lc-rs/aws-lc-rs/src/digest/digest_ctx.rs	5
spdmlib/src/error.rs	2
test/spdm-emu/src/socket_io_transport.rs	11
codec/src/codec.rs	3
external/aws-lc-rs/aws-lc-rs/src/ptr.rs	1
external/aws-lc-rs/aws-lc-rs/src/fips.rs	8
spdmlib_crypto_aws_lc/src/aead_impl.rs	1
test/spdm-emu/src/crypto_callback.rs	5
spdmlib_crypto_aws_lc/src/hash_impl.rs	3
external/ring/src/polyfill/slice.rs	3
spdmlib/src/protocol/mod.rs	6
spdmlib/src/crypto/spdm_x509/src/certificate/mod.rs	1
test/spdmlib-test/src/responder_tests/context.rs	15
test/spdmlib-test/src/common/device_io.rs	7
spdmlib/src/responder/capability_rsp.rs	10
spdmlib/src/common/session.rs	6
test/spdm-emu/src/async_runtime.rs	3
test/spdm-requester-emu/src/main.rs	8
external/ring/src/io/der_writer.rs	11
external/ring/src/io/writer.rs	3
test/spdmlib-test/src/responder_tests/encap_get_digest.rs	13

Fuzzer: measurement_rsp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1963	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	1963	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1962	0	EP	call site: 00000	SpdmMessage::spdm_read

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

66

Reachable functions

69

Percentage of reachable functions covered

4.35%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
spdmlib/fuzz/fuzz_targets/measurement_rsp.rs	4
fuzz-target/responder/measurement_rsp/src/main.rs	19
spdmlib_crypto_aws_lc/src/pqc_cert_verify_impl.rs	3
spdmlib/src/crypto/bytes_mut_scrubbed.rs	7
test/spdmlib-test/src/common/util.rs	43
test/spdm-emu/src/spdm_emu.rs	45
external/aws-lc-rs/aws-lc-rs/build.rs	4
external/ring/build.rs	1
external/aws-lc-rs/aws-lc-rs/src/test.rs	8
tdisp/src/pci_tdisp.rs	3
external/aws-lc-rs/aws-lc-rs/src/key_wrap.rs	11
external/aws-lc-rs/aws-lc-rs/src/digest/digest_ctx.rs	5
spdmlib/src/error.rs	2
test/spdm-emu/src/socket_io_transport.rs	15
codec/src/codec.rs	4
external/aws-lc-rs/aws-lc-rs/src/ptr.rs	1
external/aws-lc-rs/aws-lc-rs/src/fips.rs	8
spdmlib_crypto_aws_lc/src/aead_impl.rs	1
test/spdm-emu/src/crypto_callback.rs	5
spdmlib_crypto_aws_lc/src/hash_impl.rs	5
external/ring/src/polyfill/slice.rs	3
spdmlib/src/protocol/mod.rs	6
spdmlib/src/crypto/spdm_x509/src/certificate/mod.rs	1
test/spdmlib-test/src/responder_tests/context.rs	15
test/spdmlib-test/src/common/device_io.rs	7
spdmlib/src/responder/capability_rsp.rs	10
spdmlib/src/common/session.rs	6
test/spdm-emu/src/async_runtime.rs	3
test/spdm-requester-emu/src/main.rs	8
external/ring/src/io/der_writer.rs	11
external/ring/src/io/writer.rs	3
test/spdmlib-test/src/common/crypto_callback.rs	3
test/spdmlib-test/src/responder_tests/measurement_rsp.rs	25
spdmlib/src/message/heartbeat.rs	73
spdmlib/src/crypto/spdm_x509/src/x509/signature.rs	2
spdmlib/src/message/mod.rs	60
spdmlib/src/message/vendor.rs	2
spdmlib/src/protocol/algo.rs	3
spdmlib/src/common/mod.rs	6
spdmlib/src/common/spdm_codec.rs	6

Fuzzer: psk_finish_req

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	933	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	933	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
932	0	EP	call site: 00000	SpdmKeySchedule::derive_aead_key_iv

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

60

Reachable functions

63

Percentage of reachable functions covered

4.76%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
spdmlib/fuzz/fuzz_targets/psk_finish_req.rs	4
fuzz-target/requester/psk_finish_req/src/main.rs	22
spdmlib_crypto_aws_lc/src/pqc_cert_verify_impl.rs	3
spdmlib/src/crypto/bytes_mut_scrubbed.rs	13
test/spdmlib-test/src/common/util.rs	39
test/spdm-emu/src/spdm_emu.rs	25
external/aws-lc-rs/aws-lc-rs/build.rs	4
external/ring/build.rs	1
external/aws-lc-rs/aws-lc-rs/src/test.rs	8
tdisp/src/pci_tdisp.rs	2
external/aws-lc-rs/aws-lc-rs/src/key_wrap.rs	11
external/aws-lc-rs/aws-lc-rs/src/digest/digest_ctx.rs	5
spdmlib/src/error.rs	2
test/spdm-emu/src/socket_io_transport.rs	12
codec/src/codec.rs	4
external/aws-lc-rs/aws-lc-rs/src/ptr.rs	1
external/aws-lc-rs/aws-lc-rs/src/fips.rs	8
spdmlib_crypto_aws_lc/src/aead_impl.rs	1
test/spdm-emu/src/crypto_callback.rs	5
spdmlib_crypto_aws_lc/src/hash_impl.rs	7
external/ring/src/polyfill/slice.rs	3
spdmlib/src/protocol/mod.rs	6
spdmlib/src/crypto/spdm_x509/src/certificate/mod.rs	1
test/spdmlib-test/src/responder_tests/context.rs	15
test/spdmlib-test/src/common/device_io.rs	7
spdmlib/src/responder/capability_rsp.rs	10
spdmlib/src/common/session.rs	14
test/spdm-emu/src/async_runtime.rs	3
test/spdm-requester-emu/src/main.rs	8
external/ring/src/io/der_writer.rs	11
external/ring/src/io/writer.rs	3
fuzz-target/fuzzlib/src/fake_device_io.rs	2
test/spdmlib-test/src/requester_tests/psk_finish_req.rs	24
spdmlib/src/common/key_schedule.rs	24
test/spdmlib-test/src/common/crypto_callback.rs	3
spdmlib/src/protocol/algo.rs	4
spdmlib/src/secret/mod.rs	3

Fuzzer: vendor_req

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1257	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	1257	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1256	0	EP	call site: 00000	RequesterContext::send_receive_spdm_vendor_defined_request

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

39

Reachable functions

42

Percentage of reachable functions covered

7.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
spdmlib/fuzz/fuzz_targets/vendor_req.rs	4
fuzz-target/requester/vendor_req/src/main.rs	11
spdmlib_crypto_aws_lc/src/pqc_cert_verify_impl.rs	3
spdmlib/src/crypto/bytes_mut_scrubbed.rs	8
test/spdmlib-test/src/common/util.rs	39
test/spdm-emu/src/spdm_emu.rs	49
external/aws-lc-rs/aws-lc-rs/build.rs	4
external/ring/build.rs	1
external/aws-lc-rs/aws-lc-rs/src/test.rs	8
tdisp/src/pci_tdisp.rs	3
external/aws-lc-rs/aws-lc-rs/src/key_wrap.rs	11
external/aws-lc-rs/aws-lc-rs/src/digest/digest_ctx.rs	5
spdmlib/src/error.rs	6
test/spdm-emu/src/socket_io_transport.rs	12
codec/src/codec.rs	4
external/aws-lc-rs/aws-lc-rs/src/ptr.rs	1
external/aws-lc-rs/aws-lc-rs/src/fips.rs	8
spdmlib_crypto_aws_lc/src/aead_impl.rs	1
test/spdm-emu/src/crypto_callback.rs	5
spdmlib_crypto_aws_lc/src/hash_impl.rs	3
external/ring/src/polyfill/slice.rs	3
spdmlib/src/protocol/mod.rs	6
spdmlib/src/crypto/spdm_x509/src/certificate/mod.rs	3
test/spdmlib-test/src/responder_tests/context.rs	15
test/spdmlib-test/src/common/device_io.rs	7
spdmlib/src/responder/capability_rsp.rs	10
spdmlib/src/common/session.rs	29
test/spdm-emu/src/async_runtime.rs	3
test/spdm-requester-emu/src/main.rs	8
external/ring/src/io/der_writer.rs	11
external/ring/src/io/writer.rs	3
fuzz-target/fuzzlib/src/fake_device_io.rs	2
test/spdmlib-test/src/requester_tests/vendor_req.rs	19
spdmlib/src/requester/vendor_req.rs	10
spdmlib/src/common/mod.rs	21
spdmlib/src/message/heartbeat.rs	18
spdmlib/src/requester/context.rs	42
test/spdmlib-test/src/common/crypto_callback.rs	3
test/spdm-emu/src/tcp_transport.rs	6
spdmlib/src/crypto/spdm_x509/src/x509/signature.rs	2
external/aws-lc-rs/aws-lc-rs/tests/unsealed_rand_test.rs	3
spdmlib/src/requester/handle_error_response_req.rs	10
spdmlib/src/message/vendor.rs	6

Fuzzer: key_update_rsp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	945	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	945	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
944	0	EP	call site: 00000	SpdmKeySchedule::derive_aead_key_iv

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

55

Reachable functions

58

Percentage of reachable functions covered

5.17%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
spdmlib/fuzz/fuzz_targets/key_update_rsp.rs	4
fuzz-target/responder/key_update_rsp/src/main.rs	16
test/spdmlib-test/src/common/util.rs	39
test/spdm-emu/src/spdm_emu.rs	25
external/aws-lc-rs/aws-lc-rs/build.rs	4
external/ring/build.rs	1
external/aws-lc-rs/aws-lc-rs/src/test.rs	8
spdmlib_crypto_aws_lc/src/pqc_cert_verify_impl.rs	3
spdmlib/src/crypto/bytes_mut_scrubbed.rs	13
tdisp/src/pci_tdisp.rs	2
external/aws-lc-rs/aws-lc-rs/src/key_wrap.rs	11
external/aws-lc-rs/aws-lc-rs/src/digest/digest_ctx.rs	5
spdmlib/src/error.rs	2
test/spdm-emu/src/socket_io_transport.rs	11
codec/src/codec.rs	4
external/aws-lc-rs/aws-lc-rs/src/ptr.rs	1
external/aws-lc-rs/aws-lc-rs/src/fips.rs	8
spdmlib_crypto_aws_lc/src/aead_impl.rs	1
test/spdm-emu/src/crypto_callback.rs	5
spdmlib_crypto_aws_lc/src/hash_impl.rs	3
external/ring/src/polyfill/slice.rs	3
spdmlib/src/protocol/mod.rs	6
spdmlib/src/crypto/spdm_x509/src/certificate/mod.rs	1
test/spdmlib-test/src/responder_tests/context.rs	15
test/spdmlib-test/src/common/device_io.rs	7
spdmlib/src/responder/capability_rsp.rs	10
spdmlib/src/common/session.rs	20
test/spdm-emu/src/async_runtime.rs	3
test/spdm-requester-emu/src/main.rs	8
external/ring/src/io/der_writer.rs	11
external/ring/src/io/writer.rs	3
test/spdmlib-test/src/responder_tests/key_update_rsp.rs	23
spdmlib/src/common/key_schedule.rs	35
test/spdmlib-test/src/common/crypto_callback.rs	3
spdmlib/src/protocol/algo.rs	4
spdmlib/src/secret/mod.rs	3

Fuzzer: end_session_rsp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	724	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	724	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
723	0	EP	call site: 00000	ResponderContext::build_supported_algorithms_block

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

55

Reachable functions

58

Percentage of reachable functions covered

5.17%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
spdmlib/fuzz/fuzz_targets/end_session_rsp.rs	4
fuzz-target/responder/end_session_rsp/src/main.rs	16
spdmlib_crypto_aws_lc/src/pqc_cert_verify_impl.rs	3
spdmlib/src/crypto/bytes_mut_scrubbed.rs	7
test/spdmlib-test/src/common/util.rs	39
test/spdm-emu/src/spdm_emu.rs	25
external/aws-lc-rs/aws-lc-rs/build.rs	4
external/ring/build.rs	1
external/aws-lc-rs/aws-lc-rs/src/test.rs	8
tdisp/src/pci_tdisp.rs	2
external/aws-lc-rs/aws-lc-rs/src/key_wrap.rs	11
external/aws-lc-rs/aws-lc-rs/src/digest/digest_ctx.rs	5
spdmlib/src/error.rs	2
test/spdm-emu/src/socket_io_transport.rs	11
codec/src/codec.rs	3
external/aws-lc-rs/aws-lc-rs/src/ptr.rs	1
external/aws-lc-rs/aws-lc-rs/src/fips.rs	8
spdmlib_crypto_aws_lc/src/aead_impl.rs	1
test/spdm-emu/src/crypto_callback.rs	5
spdmlib_crypto_aws_lc/src/hash_impl.rs	3
external/ring/src/polyfill/slice.rs	3
spdmlib/src/protocol/mod.rs	6
spdmlib/src/crypto/spdm_x509/src/certificate/mod.rs	1
test/spdmlib-test/src/responder_tests/context.rs	15
test/spdmlib-test/src/common/device_io.rs	7
spdmlib/src/responder/capability_rsp.rs	10
spdmlib/src/common/session.rs	6
test/spdm-emu/src/async_runtime.rs	3
test/spdm-requester-emu/src/main.rs	8
external/ring/src/io/der_writer.rs	11
external/ring/src/io/writer.rs	3
test/spdmlib-test/src/responder_tests/end_session_rsp.rs	20

Fuzzer: finish_req

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	933	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	933	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
932	0	EP	call site: 00000	SpdmKeySchedule::derive_aead_key_iv

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

62

Reachable functions

63

Percentage of reachable functions covered

1.59%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
spdmlib/fuzz/fuzz_targets/finish_req.rs	4
fuzz-target/requester/psk_finish_req/src/main.rs	22
spdmlib_crypto_aws_lc/src/pqc_cert_verify_impl.rs	3
spdmlib/src/crypto/bytes_mut_scrubbed.rs	13
test/spdmlib-test/src/common/util.rs	39
test/spdm-emu/src/spdm_emu.rs	25
external/aws-lc-rs/aws-lc-rs/build.rs	4
external/ring/build.rs	1
external/aws-lc-rs/aws-lc-rs/src/test.rs	8
tdisp/src/pci_tdisp.rs	2
external/aws-lc-rs/aws-lc-rs/src/key_wrap.rs	11
external/aws-lc-rs/aws-lc-rs/src/digest/digest_ctx.rs	5
spdmlib/src/error.rs	2
test/spdm-emu/src/socket_io_transport.rs	12
codec/src/codec.rs	4
external/aws-lc-rs/aws-lc-rs/src/ptr.rs	1
external/aws-lc-rs/aws-lc-rs/src/fips.rs	8
spdmlib_crypto_aws_lc/src/aead_impl.rs	1
test/spdm-emu/src/crypto_callback.rs	5
spdmlib_crypto_aws_lc/src/hash_impl.rs	7
external/ring/src/polyfill/slice.rs	3
spdmlib/src/protocol/mod.rs	6
spdmlib/src/crypto/spdm_x509/src/certificate/mod.rs	1
test/spdmlib-test/src/responder_tests/context.rs	15
test/spdmlib-test/src/common/device_io.rs	7
spdmlib/src/responder/capability_rsp.rs	10
spdmlib/src/common/session.rs	14
test/spdm-emu/src/async_runtime.rs	3
test/spdm-requester-emu/src/main.rs	8
external/ring/src/io/der_writer.rs	11
external/ring/src/io/writer.rs	3
fuzz-target/fuzzlib/src/fake_device_io.rs	2
test/spdmlib-test/src/requester_tests/psk_finish_req.rs	24
spdmlib/src/common/key_schedule.rs	24
test/spdmlib-test/src/common/crypto_callback.rs	3
spdmlib/src/protocol/algo.rs	4
spdmlib/src/secret/mod.rs	3

Fuzzer: encapsulated_request_certificate_req

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	878	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	878	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
877	0	EP	call site: 00000	SpdmCertificateResponsePayload::spdm_read

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

66

Reachable functions

69

Percentage of reachable functions covered

4.35%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
spdmlib/fuzz/fuzz_targets/encapsulated_request_certificate_req.rs	4
fuzz-target/requester/encapsulated_request_certificate_req/src/main.rs	19
spdmlib_crypto_aws_lc/src/pqc_cert_verify_impl.rs	3
spdmlib/src/crypto/bytes_mut_scrubbed.rs	7
test/spdmlib-test/src/common/util.rs	43
test/spdm-emu/src/spdm_emu.rs	29
external/aws-lc-rs/aws-lc-rs/build.rs	4
external/ring/build.rs	1
external/aws-lc-rs/aws-lc-rs/src/test.rs	8
tdisp/src/pci_tdisp.rs	3
external/aws-lc-rs/aws-lc-rs/src/key_wrap.rs	11
external/aws-lc-rs/aws-lc-rs/src/digest/digest_ctx.rs	5
spdmlib/src/error.rs	2
test/spdm-emu/src/socket_io_transport.rs	16
codec/src/codec.rs	3
external/aws-lc-rs/aws-lc-rs/src/ptr.rs	1
external/aws-lc-rs/aws-lc-rs/src/fips.rs	8
spdmlib_crypto_aws_lc/src/aead_impl.rs	1
test/spdm-emu/src/crypto_callback.rs	5
spdmlib_crypto_aws_lc/src/hash_impl.rs	5
external/ring/src/polyfill/slice.rs	3
spdmlib/src/protocol/mod.rs	6
spdmlib/src/crypto/spdm_x509/src/certificate/mod.rs	1
test/spdmlib-test/src/responder_tests/context.rs	15
test/spdmlib-test/src/common/device_io.rs	7
spdmlib/src/responder/capability_rsp.rs	10
spdmlib/src/common/session.rs	6
test/spdm-emu/src/async_runtime.rs	3
test/spdm-requester-emu/src/main.rs	8
external/ring/src/io/der_writer.rs	11
external/ring/src/io/writer.rs	3
test/spdmlib-test/src/common/crypto_callback.rs	3
test/spdmlib-test/src/requester_tests/encap_certificate.rs	17
spdmlib/src/message/heartbeat.rs	8