Fuzz introspector: fuzz_policy
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
39 39 1 :

['defaults_warnx']

39 41 parse_default_entry call site: 00000 /src/sudo/plugins/sudoers/./defaults.c:304
33 33 1 :

['sudo_fatal_nodebug_v1']

33 33 _rs_stir call site: 00000 /src/sudo/lib/util/./arc4random.c:99
30 36 3 :

['__errno_location', 'sudo_warn_nodebug_v1', 'sudo_warn_gettext_v1']

30 342 sudoers_policy_close call site: 00000 /src/sudo/plugins/sudoers/./policy.c:1123
30 30 2 :

['setrlimit', 'sudo_warn_nodebug_v1']

30 32 unlimit_nproc call site: 00000 /src/sudo/plugins/sudoers/./sudoers.c:125
28 28 1 :

['sudo_warn_nodebug_v1']

28 30 restore_nproc call site: 00000 /src/sudo/plugins/sudoers/./sudoers.c:143
10 10 2 :

['fputs', 'putc']

12 14 warning call site: 00144 /src/sudo/lib/util/./fatal.c:192
8 50 4 :

['sudo_parseln_v2', 'strncmp', 'feof', '__ctype_b_loc']

14 101 env_file_next_local call site: 00000 /src/sudo/plugins/sudoers/./env.c:1275
6 6 4 :

['setlocale', 'strdup', 'strcmp', 'free']

6 8 sudoers_setlocale call site: 00000 /src/sudo/plugins/sudoers/./locale.c:117
4 6 3 :

['__errno_location', 'log_warning', 'audit_failure']

4 8 set_cmnd call site: 00000 /src/sudo/plugins/sudoers/./sudoers.c:1190
4 4 3 :

['free', 'getgrouplist', 'reallocarray']

4 10 sudo_getgrouplist2_v1 call site: 00000 /src/sudo/lib/util/./getgrouplist.c:104
2 48 2 :

['sudo_strtoid_v2', 'reallocarray']

8 68 sudo_make_gidlist_item call site: 00000 /src/sudo/plugins/sudoers/./pwutil_impl.c:254
2 34 3 :

['__errno_location', 'sudo_warnx_nodebug_v1', 'sudo_warn_gettext_v1']

2 77 sudo_setenv2 call site: 00000 /src/sudo/plugins/sudoers/./env.c:454

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 open_data [function] [call site] 00001
2 fmemopen [call site] 00002
1 initprogname [function] [call site] 00003
2 initprogname2 [function] [call site] 00004
3 sudo_getprogname [function] [call site] 00005
3 sudo_basename_v1 [function] [call site] 00006
4 strrchr [call site] 00007
3 strcmp [call site] 00008
3 sudo_setprogname [function] [call site] 00009
4 sudo_basename_v1 [function] [call site] 00010
1 sudo_getprogname [function] [call site] 00011
1 sudoers_debug_register [function] [call site] 00012
2 sudo_debug_register_v2 [function] [call site] 00013
2 sudo_debug_set_active_instance_v1 [function] [call site] 00014
1 getenv [call site] 00015
1 sudo_warn_set_conversation_v1 [function] [call site] 00016
1 fuzz_conversation [function] [call site] 00017
1 push [function] [call site] 00018
2 strdup [call site] 00019
2 reallocarray [call site] 00020
1 push [function] [call site] 00021
1 getdelim [call site] 00022
1 strncmp [call site] 00023
1 push [function] [call site] 00024
1 strncmp [call site] 00025
1 push [function] [call site] 00026
1 strncmp [call site] 00027
1 push [function] [call site] 00028
1 strncmp [call site] 00029
1 push [function] [call site] 00030
1 strncmp [call site] 00031
1 push [function] [call site] 00032
1 strncmp [call site] 00033
1 push [function] [call site] 00034
1 strncmp [call site] 00035
1 push [function] [call site] 00036
1 strncmp [call site] 00037
1 push [function] [call site] 00038
1 strncmp [call site] 00039
1 push [function] [call site] 00040
1 strncmp [call site] 00041
1 push [function] [call site] 00042
1 strncmp [call site] 00043
1 push [function] [call site] 00044
1 strncmp [call site] 00045
1 push [function] [call site] 00046
1 strncmp [call site] 00047
1 push [function] [call site] 00048
1 strncmp [call site] 00049
1 push [function] [call site] 00050
1 strncmp [call site] 00051
1 push [function] [call site] 00052
1 strncmp [call site] 00053
1 push [function] [call site] 00054
1 strncmp [call site] 00055
1 push [function] [call site] 00056
1 strncmp [call site] 00057
1 push [function] [call site] 00058
1 strncmp [call site] 00059
1 push [function] [call site] 00060
1 strncmp [call site] 00061
1 push [function] [call site] 00062
1 strncmp [call site] 00063
1 strchr [call site] 00064
1 push [function] [call site] 00065
1 push [function] [call site] 00066
1 fclose [call site] 00067
1 putenv [call site] 00068
1 putenv [call site] 00069
1 fuzz_hook_stub [function] [call site] 00070
1 fuzz_conversation [function] [call site] 00071
1 push [function] [call site] 00072
1 sudoers_cleanup [function] [call site] 00073
2 sudo_debug_enter_v1 [function] [call site] 00074
2 reset_parser [function] [call site] 00075
3 init_parser [function] [call site] 00076
4 sudo_debug_enter_v1 [function] [call site] 00077
4 free_parse_tree [function] [call site] 00078
5 free_userspecs [function] [call site] 00079
6 sudo_debug_enter_v1 [function] [call site] 00080
6 free_userspec [function] [call site] 00081
7 sudo_debug_enter_v1 [function] [call site] 00082
7 free_members [function] [call site] 00083
8 sudo_debug_enter_v1 [function] [call site] 00084
8 free_member [function] [call site] 00085
9 sudo_debug_enter_v1 [function] [call site] 00086
9 sudo_debug_exit_v1 [function] [call site] 00087
8 sudo_debug_exit_v1 [function] [call site] 00088
7 free_privilege [function] [call site] 00089
8 sudo_debug_enter_v1 [function] [call site] 00090
8 free_members [function] [call site] 00091
8 free_cmndspecs [function] [call site] 00092
9 sudo_debug_enter_v1 [function] [call site] 00093
9 free_members [function] [call site] 00094
9 free_members [function] [call site] 00095
9 free_member [function] [call site] 00096
9 sudo_debug_exit_v1 [function] [call site] 00097
8 free_default [function] [call site] 00098
9 sudo_debug_enter_v1 [function] [call site] 00099
9 free_defaults_binding [function] [call site] 00100
10 sudo_debug_enter_v1 [function] [call site] 00101
10 free_members [function] [call site] 00102
10 sudo_debug_exit_v1 [function] [call site] 00103
9 sudo_rcstr_delref [function] [call site] 00104
10 sudo_debug_enter_v1 [function] [call site] 00105
10 sudo_debug_exit_v1 [function] [call site] 00106
9 sudo_debug_exit_v1 [function] [call site] 00107
8 sudo_debug_exit_v1 [function] [call site] 00108
7 sudo_rcstr_delref [function] [call site] 00109
7 sudo_debug_exit_v1 [function] [call site] 00110
6 sudo_debug_exit_v1 [function] [call site] 00111
5 free_defaults [function] [call site] 00112
6 sudo_debug_enter_v1 [function] [call site] 00113
6 free_default [function] [call site] 00114
6 sudo_debug_exit_v1 [function] [call site] 00115
5 free_aliases [function] [call site] 00116
6 sudo_debug_enter_v1 [function] [call site] 00117
6 rbdestroy [function] [call site] 00118
7 sudo_debug_enter_v1 [function] [call site] 00119
7 rbdestroy_int [function] [call site] 00120
8 sudo_debug_enter_v1 [function] [call site] 00121
8 rbdestroy_int [function] [call site] 00122
9 rbdestroy_int [function] [call site] 00123
10 sudo_debug_exit_v1 [function] [call site] 00124
7 sudo_debug_exit_v1 [function] [call site] 00125
6 alias_free [function] [call site] 00126
7 sudo_debug_enter_v1 [function] [call site] 00127
7 sudo_rcstr_delref [function] [call site] 00128
7 free_members [function] [call site] 00129
7 sudo_debug_exit_v1 [function] [call site] 00130
4 parser_leak_init [function] [call site] 00131
5 sudo_debug_enter_v1 [function] [call site] 00132
5 atexit [call site] 00133
5 parser_leak_free [function] [call site] 00134
6 sudo_debug_enter_v1 [function] [call site] 00135
6 free_privilege [function] [call site] 00136
6 free_cmndspecs [function] [call site] 00137
6 free_defaults [function] [call site] 00138
6 free_member [function] [call site] 00139
6 free_member [function] [call site] 00140
6 free_member [function] [call site] 00141
6 sudo_warnx_nodebug_v1 [function] [call site] 00142
7 warning [function] [call site] 00143
8 __errno_location [call site] 00144
8 sudo_getprogname [function] [call site] 00145
8 vsnprintf [call site] 00146
8 vsnprintf [call site] 00147
8 sudo_getprogname [function] [call site] 00148
8 fputs [call site] 00149
8 fputs [call site] 00150
8 vfprintf [call site] 00151
8 fputs [call site] 00152
8 fputs [call site] 00153
8 putc [call site] 00154
8 __errno_location [call site] 00155
6 sudo_debug_exit_v1 [function] [call site] 00156
5 sudo_debug_exit_v1 [function] [call site] 00157
5 parser_leak_free [function] [call site] 00158
5 sudo_debug_exit_v1 [function] [call site] 00159
4 init_lexer [function] [call site] 00160
5 sudo_debug_enter_v1 [function] [call site] 00161
5 sudo_lbuf_init_v1 [function] [call site] 00162
6 sudo_debug_enter_v1 [function] [call site] 00163
6 sudo_debug_exit_v1 [function] [call site] 00164
5 sudo_rcstr_delref [function] [call site] 00165
5 sudo_rcstr_delref [function] [call site] 00166
5 fclose [call site] 00167
5 sudoers_delete_buffer [function] [call site] 00168
6 sudoersfree [function] [call site] 00169
6 sudoersfree [function] [call site] 00170
5 sudo_debug_exit_v1 [function] [call site] 00171
4 sudo_rcstr_delref [function] [call site] 00172
4 sudo_rcstr_dup [function] [call site] 00173
5 strlen [call site] 00174
5 sudo_debug_enter_v1 [function] [call site] 00175
5 sudo_rcstr_alloc [function] [call site] 00176
6 sudo_debug_enter_v1 [function] [call site] 00177
6 sudo_debug_exit_ptr_v1 [function] [call site] 00178
5 sudo_debug_exit_ptr_v1 [function] [call site] 00179
4 sudo_warn_gettext_v1 [function] [call site] 00180
5 dgettext [call site] 00181
4 sudo_rcstr_delref [function] [call site] 00182
4 sudo_rcstr_dup [function] [call site] 00183
4 sudo_warn_gettext_v1 [function] [call site] 00184
4 sudo_debug_exit_bool_v1 [function] [call site] 00185
2 group_plugin_unload [function] [call site] 00186
2 sudo_user_free [function] [call site] 00187
3 sudo_debug_enter_v1 [function] [call site] 00188
3 sudo_pw_delref [function] [call site] 00189
4 sudo_debug_enter_v1 [function] [call site] 00190
4 sudo_pw_delref_item [function] [call site] 00191
5 sudo_debug_enter_v1 [function] [call site] 00192
5 sudo_debug_exit_v1 [function] [call site] 00193
4 sudo_debug_exit_v1 [function] [call site] 00194
3 sudo_pw_delref [function] [call site] 00195
3 sudo_gr_delref [function] [call site] 00196
4 sudo_debug_enter_v1 [function] [call site] 00197
4 sudo_gr_delref_item [function] [call site] 00198
5 sudo_debug_enter_v1 [function] [call site] 00199
5 sudo_debug_exit_v1 [function] [call site] 00200
4 sudo_debug_exit_v1 [function] [call site] 00201
3 sudo_gidlist_delref [function] [call site] 00202
4 sudo_debug_enter_v1 [function] [call site] 00203
4 sudo_gidlist_delref_item [function] [call site] 00204
5 sudo_debug_enter_v1 [function] [call site] 00205
5 sudo_debug_exit_v1 [function] [call site] 00206
4 sudo_debug_exit_v1 [function] [call site] 00207
3 canon_path_free [function] [call site] 00208
4 sudo_debug_enter_v1 [function] [call site] 00209
4 canon_path_free_item [function] [call site] 00210
5 sudo_debug_enter_v1 [function] [call site] 00211
5 sudo_debug_exit_v1 [function] [call site] 00212
3 sudo_debug_exit_v1 [function] [call site] 00213
2 sudo_freepwcache [function] [call site] 00214
3 sudo_debug_enter_v1 [function] [call site] 00215
3 rbdestroy [function] [call site] 00216
3 sudo_pw_delref_item [function] [call site] 00217
3 rbdestroy [function] [call site] 00218
3 sudo_pw_delref_item [function] [call site] 00219
3 sudo_debug_exit_v1 [function] [call site] 00220
2 sudo_freegrcache [function] [call site] 00221
3 sudo_debug_enter_v1 [function] [call site] 00222
3 rbdestroy [function] [call site] 00223
3 sudo_gr_delref_item [function] [call site] 00224
3 rbdestroy [function] [call site] 00225
3 sudo_gr_delref_item [function] [call site] 00226
3 rbdestroy [function] [call site] 00227
3 sudo_grlist_delref_item [function] [call site] 00228
4 sudo_debug_enter_v1 [function] [call site] 00229
4 sudo_debug_exit_v1 [function] [call site] 00230
3 rbdestroy [function] [call site] 00231
3 sudo_gidlist_delref_item [function] [call site] 00232
3 sudo_debug_exit_v1 [function] [call site] 00233
2 canon_path_free_cache [function] [call site] 00234
3 rbdestroy [function] [call site] 00235
3 canon_path_free_item [function] [call site] 00236
3 sudo_debug_exit_v1 [function] [call site] 00237
2 env_init [function] [call site] 00238
3 sudo_debug_enter_v1 [function] [call site] 00239
3 sudoers_gc_remove [function] [call site] 00240
4 sudo_debug_enter_v1 [function] [call site] 00241
4 sudo_debug_exit_bool_v1 [function] [call site] 00242
4 sudo_warnx_nodebug_v1 [function] [call site] 00243
4 sudo_warnx_nodebug_v1 [function] [call site] 00244
4 abort [call site] 00245
4 sudo_debug_exit_bool_v1 [function] [call site] 00246
3 reallocarray [call site] 00247
3 sudo_warn_gettext_v1 [function] [call site] 00248
3 sudo_debug_exit_bool_v1 [function] [call site] 00249
3 sudoers_gc_add [function] [call site] 00250
4 sudo_debug_enter_v1 [function] [call site] 00251
4 sudo_debug_exit_bool_v1 [function] [call site] 00252
4 calloc [call site] 00253
4 sudo_warn_gettext_v1 [function] [call site] 00254
4 sudo_debug_exit_bool_v1 [function] [call site] 00255
4 sudo_warnx_nodebug_v1 [function] [call site] 00256
4 sudo_debug_exit_bool_v1 [function] [call site] 00257
3 sudoers_gc_remove [function] [call site] 00258
3 sudo_debug_exit_bool_v1 [function] [call site] 00259
2 sudoers_gc_run [function] [call site] 00260
3 sudo_debug_enter_v1 [function] [call site] 00261
3 sudo_warnx_nodebug_v1 [function] [call site] 00262
3 sudo_debug_exit_v1 [function] [call site] 00263
2 sudo_debug_exit_v1 [function] [call site] 00264
1 fuzz_hook_stub [function] [call site] 00265
1 free_dynamic_array [function] [call site] 00266
2 free_strvec [function] [call site] 00267
1 free_dynamic_array [function] [call site] 00268
1 free_dynamic_array [function] [call site] 00269
1 free_dynamic_array [function] [call site] 00270
1 free_dynamic_array [function] [call site] 00271
1 sudoers_debug_deregister [function] [call site] 00272
2 sudo_debug_enter_v1 [function] [call site] 00273
2 sudo_debug_exit_v1 [function] [call site] 00274
1 fflush [call site] 00275