Fuzz introspector: fuzz_policy
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
38 38 1 :

['defaults_warnx']

38 38 parse_default_entry call site: 00000 /src/sudo/plugins/sudoers/./defaults.c:326
36 36 1 :

['sudo_fatal_nodebug_v1']

36 36 _rs_stir call site: 00000 /src/sudo/lib/util/./arc4random.c:99
15 15 2 :

['__errno_location', 'sudo_gethostname_v1']

27 68 sudoers_sethost call site: 00000 /src/sudo/plugins/sudoers/./sethost.c:51
10 12 2 :

['sudo_gettime_real_v1', 'sudo_debug_printf2_v1']

10 12 sudo_gettime_awake_v1 call site: 00000 /src/sudo/lib/util/./gettime.c:179
10 10 2 :

['fputs', 'putc']

12 14 warning call site: 00114 /src/sudo/lib/util/./fatal.c:192
8 49 4 :

['strncmp', 'sudo_parseln_v2', '__ctype_b_loc', 'feof']

14 97 env_file_next_local call site: 00000 /src/sudo/plugins/sudoers/./env.c:1302
6 6 4 :

['free', 'strcmp', 'strdup', 'setlocale']

6 6 sudoers_setlocale call site: 00000 /src/sudo/plugins/sudoers/./locale.c:117
4 6 3 :

['__errno_location', 'audit_failure', 'log_warning']

4 6 set_cmnd call site: 00000 /src/sudo/plugins/sudoers/./sudoers.c:1177
4 4 3 :

['reallocarray', 'free', 'sysconf']

6 6 sudo_getgrouplist2_v1 call site: 00000 /src/sudo/lib/util/./getgrouplist.c:82
2 44 2 :

['reallocarray', 'sudo_strtoid_v2']

8 56 sudo_make_gidlist_item call site: 00000 /src/sudo/plugins/sudoers/./pwutil_impl.c:257
2 39 3 :

['__errno_location', 'sudo_warn_gettext_v1', 'sudo_warn_nodebug_v1']

2 277 sudoers_policy_close call site: 00000 /src/sudo/plugins/sudoers/./policy.c:1164
2 37 3 :

['__errno_location', 'sudo_warnx_nodebug_v1', 'sudo_warn_gettext_v1']

2 77 sudo_setenv2 call site: 00000 /src/sudo/plugins/sudoers/./env.c:471

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 open_data [function] [call site] 00001
2 fmemopen [call site] 00002
1 initprogname [function] [call site] 00003
2 initprogname2 [function] [call site] 00004
3 sudo_getprogname [function] [call site] 00005
3 sudo_basename_v1 [function] [call site] 00006
4 strrchr [call site] 00007
3 strcmp [call site] 00008
3 sudo_setprogname [function] [call site] 00009
4 sudo_basename_v1 [function] [call site] 00010
1 sudo_getprogname [function] [call site] 00011
1 sudoers_debug_register [function] [call site] 00012
2 sudo_debug_register_v2 [function] [call site] 00013
2 sudo_debug_set_active_instance_v1 [function] [call site] 00014
1 getenv [call site] 00015
1 sudo_warn_set_conversation_v1 [function] [call site] 00016
1 fuzz_conversation [function] [call site] 00017
1 push [function] [call site] 00018
2 strdup [call site] 00019
2 reallocarray [call site] 00020
1 getdelim [call site] 00022
1 strncmp [call site] 00023
1 strncmp [call site] 00025
1 strncmp [call site] 00027
1 strncmp [call site] 00029
1 strncmp [call site] 00031
1 strncmp [call site] 00033
1 strncmp [call site] 00035
1 strncmp [call site] 00037
1 strncmp [call site] 00039
1 strncmp [call site] 00041
1 strncmp [call site] 00043
1 strncmp [call site] 00045
1 strncmp [call site] 00047
1 strncmp [call site] 00049
1 strncmp [call site] 00051
1 strncmp [call site] 00053
1 strncmp [call site] 00055
1 strncmp [call site] 00057
1 strncmp [call site] 00059
1 strncmp [call site] 00061
1 strncmp [call site] 00063
1 strchr [call site] 00064
1 fclose [call site] 00067
1 putenv [call site] 00068
1 putenv [call site] 00069
1 fuzz_hook_stub [function] [call site] 00070
1 fuzz_conversation [function] [call site] 00071
1 fuzz_printf [function] [call site] 00072
1 sudoers_cleanup [function] [call site] 00074
2 reset_parser [function] [call site] 00075
3 init_parser [function] [call site] 00076
4 free_parse_tree [function] [call site] 00077
5 free_userspecs [function] [call site] 00078
6 free_userspec [function] [call site] 00079
7 free_members [function] [call site] 00080
8 free_member [function] [call site] 00081
7 free_privilege [function] [call site] 00082
8 free_members [function] [call site] 00083
8 free_cmndspecs [function] [call site] 00084
9 free_members [function] [call site] 00085
9 free_members [function] [call site] 00086
9 free_member [function] [call site] 00087
8 free_default [function] [call site] 00088
9 free_defaults_binding [function] [call site] 00089
10 free_members [function] [call site] 00090
9 sudo_rcstr_delref [function] [call site] 00091
7 sudo_rcstr_delref [function] [call site] 00092
5 free_defaults [function] [call site] 00093
6 free_default [function] [call site] 00094
5 free_aliases [function] [call site] 00095
6 rbdestroy [function] [call site] 00096
7 rbdestroy_int [function] [call site] 00097
8 rbdestroy_int [function] [call site] 00098
9 rbdestroy_int [function] [call site] 00099
6 alias_free [function] [call site] 00100
7 sudo_rcstr_delref [function] [call site] 00101
7 free_members [function] [call site] 00102
4 parser_leak_init [function] [call site] 00103
5 atexit [call site] 00104
5 parser_leak_free [function] [call site] 00105
6 free_privilege [function] [call site] 00106
6 free_cmndspecs [function] [call site] 00107
6 free_defaults [function] [call site] 00108
6 free_member [function] [call site] 00109
6 free_member [function] [call site] 00110
6 free_member [function] [call site] 00111
6 sudo_warnx_nodebug_v1 [function] [call site] 00112
7 warning [function] [call site] 00113
8 __errno_location [call site] 00114
8 sudo_getprogname [function] [call site] 00115
8 vsnprintf [call site] 00116
8 vasprintf [call site] 00117
8 sudo_getprogname [function] [call site] 00118
8 fputs [call site] 00119
8 fputs [call site] 00120
8 vfprintf [call site] 00121
8 fputs [call site] 00122
8 fputs [call site] 00123
8 putc [call site] 00124
8 __errno_location [call site] 00125
5 parser_leak_free [function] [call site] 00126
4 init_lexer [function] [call site] 00127
5 sudo_lbuf_init_v1 [function] [call site] 00128
5 sudo_rcstr_delref [function] [call site] 00129
5 sudo_rcstr_delref [function] [call site] 00130
5 fclose [call site] 00131
5 sudoers_delete_buffer [function] [call site] 00132
6 sudoersfree [function] [call site] 00133
6 sudoersfree [function] [call site] 00134
4 sudo_rcstr_delref [function] [call site] 00135
4 sudo_rcstr_dup [function] [call site] 00136
5 strlen [call site] 00137
5 sudo_rcstr_alloc [function] [call site] 00138
4 sudo_warn_gettext_v1 [function] [call site] 00139
5 dgettext [call site] 00140
4 sudo_warnx_nodebug_v1 [function] [call site] 00141
4 sudo_rcstr_delref [function] [call site] 00142
4 sudo_rcstr_dup [function] [call site] 00143
4 sudo_warn_gettext_v1 [function] [call site] 00144
4 sudo_warnx_nodebug_v1 [function] [call site] 00145
2 group_plugin_unload [function] [call site] 00146
2 sudoers_ctx_free [function] [call site] 00147
3 sudo_pw_delref [function] [call site] 00148
4 sudo_pw_delref_item [function] [call site] 00149
3 sudo_gidlist_delref [function] [call site] 00150
4 sudo_gidlist_delref_item [function] [call site] 00151
3 canon_path_free [function] [call site] 00152
4 canon_path_free_item [function] [call site] 00153
3 sudo_pw_delref [function] [call site] 00154
3 sudo_gr_delref [function] [call site] 00155
4 sudo_gr_delref_item [function] [call site] 00156
3 sudo_pw_delref [function] [call site] 00157
2 sudo_freepwcache [function] [call site] 00158
3 rbdestroy [function] [call site] 00159
3 sudo_pw_delref_item [function] [call site] 00160
3 rbdestroy [function] [call site] 00161
3 sudo_pw_delref_item [function] [call site] 00162
2 sudo_freegrcache [function] [call site] 00163
3 rbdestroy [function] [call site] 00164
3 sudo_gr_delref_item [function] [call site] 00165
3 rbdestroy [function] [call site] 00166
3 sudo_gr_delref_item [function] [call site] 00167
3 rbdestroy [function] [call site] 00168
3 sudo_grlist_delref_item [function] [call site] 00169
3 rbdestroy [function] [call site] 00170
3 sudo_gidlist_delref_item [function] [call site] 00171
2 canon_path_free_cache [function] [call site] 00172
3 rbdestroy [function] [call site] 00173
3 canon_path_free_item [function] [call site] 00174
2 env_free [function] [call site] 00175
3 sudoers_gc_remove [function] [call site] 00176
4 sudo_warnx_nodebug_v1 [function] [call site] 00177
4 sudo_warnx_nodebug_v1 [function] [call site] 00178
4 abort [call site] 00179
3 sudoers_gc_remove [function] [call site] 00180
2 sudoers_gc_run [function] [call site] 00181
3 sudo_warnx_nodebug_v1 [function] [call site] 00182
1 fuzz_hook_stub [function] [call site] 00183
1 free_dynamic_array [function] [call site] 00184
2 free_strvec [function] [call site] 00185
1 free_dynamic_array [function] [call site] 00186
1 free_dynamic_array [function] [call site] 00187
1 free_dynamic_array [function] [call site] 00188
1 free_dynamic_array [function] [call site] 00189
1 sudoers_debug_deregister [function] [call site] 00190
2 sudo_debug_deregister_v1 [function] [call site] 00191
1 fflush [call site] 00192