High level conclusions

Fuzzers reach 60.95% code coverage.

Fuzzers reach 64.48% of cyclomatic complexity.

Fuzzers reach 56.18% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

459 / 817

Cyclomatic complexity statically reachable by fuzzers

3841 / 5956

Runtime code coverage of functions

498 / 817

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzz_iolog_legacy

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	26	28.8%
gold	[1:9]	7	7.77%
yellow	[10:29]	4	4.44%
greenyellow	[30:49]	4	4.44%
lawngreen	50+	49	54.4%
All colors	90	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	28	warning	call site: 00028	sudo_getprogname
5	3	initprogname2	call site: 00003	sudo_setprogname
3	59	iolog_parse_loginfo_legacy	call site: 00059	sudo_warnx_nodebug_v1
2	66	iolog_parse_loginfo_legacy	call site: 00066	sudo_warnx_nodebug_v1
2	72	iolog_parse_loginfo_legacy	call site: 00072	sudo_warnx_nodebug_v1
2	76	iolog_parse_loginfo_legacy	call site: 00076	sudo_warnx_nodebug_v1
2	79	iolog_parse_loginfo_legacy	call site: 00079	sudo_warnx_nodebug_v1
1	1	LLVMFuzzerTestOneInput	call site: 00001	initprogname2
1	49	sudo_strtonumx	call site: 00049	__errno_location

Runtime coverage analysis

Covered functions

15

Functions that are reachable but not covered

24

Reachable functions

39

Percentage of reachable functions covered

38.46%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
lib/iolog/./regress/fuzz/fuzz_iolog_legacy.c	3
lib/util/./progname.c	4
lib/util/./basename.c	1
lib/util/./fatal.c	5
lib/iolog/./iolog_legacy.c	1
lib/util/./strtonum.c	2
lib/util/./sudo_debug.c	1
lib/eventlog/./eventlog_free.c	1

Fuzzer: fuzz_iolog_json

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	23	16.3%
gold	[1:9]	24	17.0%
yellow	[10:29]	14	9.92%
greenyellow	[30:49]	2	1.41%
lawngreen	50+	78	55.3%
All colors	141	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	28	warning	call site: 00028	sudo_getprogname
5	3	initprogname2	call site: 00003	sudo_setprogname
3	42	json_stack_push	call site: 00042	sudo_warnx_nodebug_v1
2	59	json_parse_string	call site: 00059	sudo_warnx_nodebug_v1
2	126	eventlog_json_parse	call site: 00126	sudo_warnx_nodebug_v1
1	1	LLVMFuzzerTestOneInput	call site: 00001	initprogname2
1	105	sudo_strtonumx	call site: 00105	__errno_location
1	122	free_json_items	call site: 00122	sudo_warnx_nodebug_v1

Runtime coverage analysis

Covered functions

58

Functions that are reachable but not covered

21

Reachable functions

48

Percentage of reachable functions covered

56.25%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
lib/iolog/./regress/fuzz/fuzz_iolog_json.c	3
lib/util/./progname.c	4
lib/util/./basename.c	1
lib/util/./fatal.c	4
lib/iolog/./iolog_json.c	1
lib/eventlog/./parse_json.c	11
lib/util/./hexchar.c	1
lib/util/./strtonum.c	2
lib/util/./sudo_debug.c	1
lib/eventlog/./eventlog_free.c	1

Fuzzer: fuzz_iolog_timing

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	86	48.8%
gold	[1:9]	5	2.84%
yellow	[10:29]	8	4.54%
greenyellow	[30:49]	1	0.56%
lawngreen	50+	76	43.1%
All colors	176	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	135	iolog_parse_delay	call site: 00135	sudo_str2sig
10	31	warning	call site: 00031	do_cleanup
8	75	iolog_openat	call site: 00075	iolog_swapids
7	93	iolog_read_timing_record	call site: 00093	__errno_location
7	160	LLVMFuzzerTestOneInput	call site: 00160	gzflush
5	3	initprogname2	call site: 00003	sudo_setprogname
4	23	_rs_stir	call site: 00023	sudo_fatal_nodebug_v1
4	87	iolog_open	call site: 00087	__errno_location
3	14	mktemp_internal	call site: 00014	__errno_location
3	71	iolog_openat	call site: 00071	fstatat
3	168	iolog_close	call site: 00168	__errno_location
2	49	_rs_random_buf	call site: 00049	openat

Runtime coverage analysis

Covered functions

36

Functions that are reachable but not covered

55

Reachable functions

91

Percentage of reachable functions covered

39.56%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
lib/iolog/./regress/fuzz/fuzz_iolog_timing.c	3
lib/util/./progname.c	4
lib/util/./basename.c	1
lib/util/./fatal.c	6
lib/util/./mktemp.c	2
lib/util/./arc4random.c	6
lib/util/./chacha_private.h	3
lib/iolog/./iolog_open.c	1
lib/iolog/./iolog_conf.c	5
lib/util/./sudo_debug.c	1
lib/iolog/./iolog_util.c	1
lib/iolog/./iolog_openat.c	1
lib/iolog/./iolog_timing.c	3
lib/iolog/./iolog_gets.c	1
lib/iolog/./iolog_eof.c	1
lib/util/./strtonum.c	2
lib/util/./str2sig.c	1
lib/iolog/./iolog_close.c	1

Fuzzer: fuzz_sudo_conf

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	60	43.4%
gold	[1:9]	14	10.1%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	64	46.3%
All colors	138	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
10	33	warning	call site: 00033	do_cleanup
10	120	LLVMFuzzerTestOneInput	call site: 00120	sudo_warnx_nodebug_v1
5	5	initprogname2	call site: 00005	sudo_setprogname
4	25	_rs_stir	call site: 00025	sudo_fatal_nodebug_v1
4	62	sudo_conf_read_v1	call site: 00062	sudo_warn_nodebug_v1
4	133	sudo_conf_debug_files_v1	call site: 00133	sudo_warnx_nodebug_v1
3	16	mktemp_internal	call site: 00016	__errno_location
2	53	mktemp_internal	call site: 00053	mkdirat
2	73	sudo_conf_read_v1	call site: 00073	sudo_warn_nodebug_v1
2	76	sudo_conf_read_v1	call site: 00076	sudo_warn_nodebug_v1
2	79	sudo_conf_read_v1	call site: 00079	sudo_warn_nodebug_v1
2	89	sudo_parseln_v2	call site: 00089	__errno_location

Runtime coverage analysis

Covered functions

52

Functions that are reachable but not covered

37

Reachable functions

76

Percentage of reachable functions covered

51.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
lib/util/./regress/fuzz/fuzz_sudo_conf.c	2
lib/util/./sudo_conf.c	15
lib/util/./progname.c	4
lib/util/./basename.c	1
lib/util/./fatal.c	7
lib/util/./mktemp.c	2
lib/util/./arc4random.c	6
lib/util/./chacha_private.h	3
lib/util/./strlcpy.c	1
lib/util/./parseln.c	1
lib/util/./roundup.c	1
lib/util/./sudo_debug.c	1

Fuzzer: fuzz_logsrvd_conf

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	326	67.9%
gold	[1:9]	10	2.08%
yellow	[10:29]	10	2.08%
greenyellow	[30:49]	2	0.41%
lawngreen	50+	132	27.5%
All colors	480	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
214	248	append_address	call site: 00248	init_tls_context
13	464	logsrvd_conf_read	call site: 00464	logsrvd_conf_cleanup
10	31	warning	call site: 00031	do_cleanup
8	141	logsrvd_conf_read	call site: 00141	sudo_open_conf_path_v1
5	3	initprogname2	call site: 00003	sudo_setprogname
5	150	logsrvd_conf_read	call site: 00150	sudo_warn_nodebug_v1
5	233	getaddrinfo	call site: 00233	htons
4	23	_rs_stir	call site: 00023	sudo_fatal_nodebug_v1
4	128	logsrvd_conf_free	call site: 00128	sudo_rcstr_delref
4	242	sudo_gai_warn_nodebug_v1	call site: 00242	sudo_warnx_nodebug_v1
3	14	mktemp_internal	call site: 00014	__errno_location
3	72	logsrvd_conf_alloc	call site: 00072	sudo_warnx_nodebug_v1

Runtime coverage analysis

Covered functions

89

Functions that are reachable but not covered

126

Reachable functions

183

Percentage of reachable functions covered

31.15%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
logsrvd/./regress/fuzz/fuzz_logsrvd_conf.c	5
lib/util/./progname.c	4
lib/util/./basename.c	1
lib/util/./fatal.c	8
lib/util/./mktemp.c	2
lib/util/./arc4random.c	6
lib/util/./chacha_private.h	3
logsrvd/./logsrvd_conf.c	40
lib/util/./logfac.c	1
lib/util/./logpri.c	1
lib/util/./rcstr.c	4
lib/iolog/./iolog_filter.c	4
lib/util/./strlcpy.c	1
lib/util/./secure_path.c	1
lib/util/./strsplit.c	1
lib/util/./parseln.c	1
lib/util/./roundup.c	1
lib/util/./sudo_debug.c	1
lib/iolog/./host_port.c	1
lib/util/./strtonum.c	2
logsrvd/./tls_init.c	5
lib/iolog/./iolog_conf.c	6
lib/eventlog/./eventlog_conf.c	10

Fuzzer: fuzz_sudoers_ldif

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	147	34.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	279	65.4%
All colors	426	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	344	append_default	call site: 00344	sudo_warnx_nodebug_v1
12	409	LLVMFuzzerTestOneInput	call site: 00409	free_userspecs
10	381	sudo_ldap_role_to_priv	call site: 00381	free_privilege
8	31	warning	call site: 00031	sudo_getprogname
6	241	role_to_sudoers	call site: 00241	sudo_fatalx_nodebug_v1
6	392	role_to_sudoers	call site: 00392	free_privilege
5	5	initprogname2	call site: 00005	sudo_setprogname
5	89	sudoers_parse_ldif	call site: 00089	sudo_fatalx_nodebug_v1
4	20	free_defs_val	call site: 00020	sudo_warn_gettext_v1
4	75	init_passprompt_regex	call site: 00075	sudo_warnx_nodebug_v1
4	172	sudo_role_alloc	call site: 00172	sudo_fatalx_nodebug_v1
3	98	ldif_store_options	call site: 00098	sudo_fatalx_nodebug_v1

Runtime coverage analysis

Covered functions

76

Functions that are reachable but not covered

50

Reachable functions

126

Percentage of reachable functions covered

60.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
plugins/sudoers/./regress/fuzz/fuzz_sudoers_ldif.c	4
lib/util/./progname.c	4
lib/util/./basename.c	1
plugins/sudoers/./sudoers_debug.c	2
lib/util/./sudo_debug.c	4
lib/util/./fatal.c	6
plugins/sudoers/./defaults.c	8
lib/util/./logfac.c	1
lib/util/./logpri.c	1
plugins/sudoers/./locale.c	1
plugins/sudoers/./regress/fuzz/fuzz_stubs.c	1
plugins/sudoers/gram.y	11
plugins/sudoers/./parse_ldif.c	13
plugins/sudoers/./redblack.c	6
plugins/sudoers/./ldap_util.c	9
plugins/sudoers/./strlist.c	4
plugins/sudoers/./b64_decode.c	1
plugins/sudoers/./gentime.c	1
lib/util/./rcstr.c	3
plugins/sudoers/./timeout.c	1
plugins/sudoers/./fmtsudoers.c	1
plugins/sudoers/./digestname.c	1
plugins/sudoers/./alias.c	2

Fuzzer: fuzz_sudoers

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1432	84.7%
gold	[1:9]	165	9.76%
yellow	[10:29]	49	2.90%
greenyellow	[30:49]	9	0.53%
lawngreen	50+	34	2.01%
All colors	1689	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
335	443	sudoerslex	call site: 00443	push_include
319	944	sudo_strtoidx_v1	call site: 00944	cmndlist_matches
111	1460	display_privs	call site: 01460	display_priv_short
78	780	alloc_aliases	call site: 00780	alias_error
68	324	fill_args	call site: 00324	fill
48	1317	sudoers_lookup	call site: 01317	update_defaults
33	1420	display_bound_defaults	call site: 01420	sudoers_format_member
32	1275	sudoers_lookup	call site: 01275	cmnd_matches
29	393	fill_cmnd	call site: 00393	fill
25	908	update_defaults	call site: 00908	default_binding_matches
24	1626	check_aliases	call site: 01626	alias_find_used_members
23	221	free_aliases	call site: 00221	parser_leak_init

Runtime coverage analysis

Covered functions

128

Functions that are reachable but not covered

257

Reachable functions

382

Percentage of reachable functions covered

32.72%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
plugins/sudoers/./regress/fuzz/fuzz_sudoers.c	9
lib/util/./progname.c	4
lib/util/./basename.c	1
plugins/sudoers/./sudoers_debug.c	2
lib/util/./sudo_debug.c	5
lib/util/./fatal.c	6
plugins/sudoers/./locale.c	3
plugins/sudoers/./pwutil.c	25
plugins/sudoers/./redblack.c	11
lib/util/./strlcpy.c	1
plugins/sudoers/./regress/fuzz/fuzz_stubs.c	6
plugins/sudoers/gram.y	32
plugins/sudoers/./defaults.c	30
lib/util/./logfac.c	1
lib/util/./logpri.c	1
lib/util/./rcstr.c	4
plugins/sudoers/./alias.c	15
plugins/sudoers/toke.l	11
lib/util/./lbuf.c	8
plugins/sudoers/toke.c	16
plugins/sudoers/gram.c	2
plugins/sudoers/./toke_util.c	6
lib/util/./hexchar.c	1
lib/util/./regex.c	3
lib/util/./digest_openssl.c	6
lib/util/./strsplit.c	1
lib/util/./secure_path.c	3
plugins/sudoers/./parser_warnx.c	2
plugins/sudoers/./gentime.c	1
plugins/sudoers/./timeout.c	1
plugins/sudoers/./match.c	19
lib/util/./gethostname.c	1
lib/util/./strtoid.c	3
lib/util/./strtonum.c	2
plugins/sudoers/./match_addr.c	3
plugins/sudoers/./match_command.c	12
plugins/sudoers/./match_digest.c	1
plugins/sudoers/./filedigest.c	1
plugins/sudoers/./b64_decode.c	1
plugins/sudoers/./digestname.c	1
lib/util/./strtomode.c	1
plugins/sudoers/./lookup.c	5
plugins/sudoers/./display.c	10
lib/util/./roundup.c	1
plugins/sudoers/./fmtsudoers.c	6
plugins/sudoers/./exptilde.c	1
plugins/sudoers/./check_aliases.c	4
plugins/sudoers/./sudoers_ctx_free.c	1
plugins/sudoers/./canon_path.c	2

Fuzzer: fuzz_policy

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	77	39.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	116	60.1%
All colors	193	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
22	117	warning	call site: 00117	parser_leak_free
21	75	sudoers_cleanup	call site: 00075	init_parser
13	99	rbdestroy_int	call site: 00099	parser_leak_init
6	140	sudo_warn_gettext_v1	call site: 00140	sudo_warnx_nodebug_v1
3	7	sudo_basename_v1	call site: 00007	sudo_setprogname
3	176	env_free	call site: 00176	sudo_warnx_nodebug_v1
2	12	LLVMFuzzerTestOneInput	call site: 00012	sudo_debug_register_v2
2	167	sudo_freegrcache	call site: 00167	rbdestroy
1	3	LLVMFuzzerTestOneInput	call site: 00003	initprogname2
1	5	initprogname2	call site: 00005	sudo_basename_v1
1	73	LLVMFuzzerTestOneInput	call site: 00073	sudoers_cleanup
1	181	sudoers_cleanup	call site: 00181	sudo_warnx_nodebug_v1

Runtime coverage analysis

Covered functions

280

Functions that are reachable but not covered

40

Reachable functions

87

Percentage of reachable functions covered

54.02%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
plugins/sudoers/./regress/fuzz/fuzz_policy.c	9
lib/util/./progname.c	4
lib/util/./basename.c	1
plugins/sudoers/./sudoers_debug.c	2
lib/util/./sudo_debug.c	3
lib/util/./fatal.c	4
plugins/sudoers/./sudoers.c	1
plugins/sudoers/gram.y	14
lib/util/./rcstr.c	3
plugins/sudoers/./alias.c	2
plugins/sudoers/./redblack.c	2
plugins/sudoers/toke.l	1
lib/util/./lbuf.c	1
plugins/sudoers/toke.c	2
plugins/sudoers/./sudoers_ctx_free.c	1
plugins/sudoers/./pwutil.c	9
plugins/sudoers/./canon_path.c	3
plugins/sudoers/./env.c	1
plugins/sudoers/./gc.c	2

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
sudoers_policy_check	/src/sudo/plugins/sudoers/./policy.c	7	['int', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A']	13	0	136	21	7	294	0	1978	739
sudoers_policy_open	/src/sudo/plugins/sudoers/./policy.c	8	['int', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A']	12	0	206	37	12	290	0	1726	315
free_cmndspec	/src/sudo/plugins/sudoers/gram.y	2	['N/A', 'N/A']	2	0	578	117	41	2	0	52	41
sudo_lbuf_append_esc_v1	/src/sudo/lib/util/./lbuf.c	3	['N/A', 'int', 'N/A']	2	0	526	77	28	8	0	61	40

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

552 / 817

Cyclomatic complexity statically reachable by fuzzers

4964 / 5956

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

lib/iolog/./regress/fuzz/fuzz_iolog_legacy.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['warning', 'initprogname2', 'iolog_parse_loginfo_legacy', 'LLVMFuzzerTestOneInput', 'sudo_strtonumx']

lib/iolog/./regress/fuzz/fuzz_iolog_json.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['warning', 'initprogname2', 'json_stack_push', 'json_parse_string', 'eventlog_json_parse', 'LLVMFuzzerTestOneInput', 'sudo_strtonumx', 'free_json_items']

lib/iolog/./regress/fuzz/fuzz_iolog_timing.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['iolog_parse_delay', 'warning', 'iolog_openat', 'iolog_read_timing_record', 'LLVMFuzzerTestOneInput', 'initprogname2', '_rs_stir', 'iolog_open', 'mktemp_internal']

lib/util/./regress/fuzz/fuzz_sudo_conf.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['warning', 'LLVMFuzzerTestOneInput', 'initprogname2', '_rs_stir', 'sudo_conf_read_v1', 'sudo_conf_debug_files_v1', 'mktemp_internal']

logsrvd/./regress/fuzz/fuzz_logsrvd_conf.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['append_address', 'logsrvd_conf_read', 'warning', 'initprogname2', 'getaddrinfo', '_rs_stir', 'logsrvd_conf_free', 'sudo_gai_warn_nodebug_v1']

plugins/sudoers/./regress/fuzz/fuzz_sudoers_ldif.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['append_default', 'LLVMFuzzerTestOneInput', 'sudo_ldap_role_to_priv', 'warning', 'role_to_sudoers', 'initprogname2', 'sudoers_parse_ldif', 'free_defs_val', 'init_passprompt_regex']

plugins/sudoers/./regress/fuzz/fuzz_sudoers.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['sudoerslex', 'sudo_strtoidx_v1', 'display_privs', 'alloc_aliases', 'fill_args', 'sudoers_lookup', 'display_bound_defaults', 'fill_cmnd', 'update_defaults']

plugins/sudoers/./regress/fuzz/fuzz_policy.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['warning', 'sudoers_cleanup', 'rbdestroy_int', 'sudo_warn_gettext_v1', 'sudo_basename_v1', 'env_free', 'LLVMFuzzerTestOneInput', 'sudo_freegrcache', 'initprogname2']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
iolog_open	68	35	51.47%	['fuzz_iolog_timing']
iolog_openat	35	13	37.14%	['fuzz_iolog_timing']
logsrvd_conf_apply	114	11	9.649%	['fuzz_logsrvd_conf']
list_op	36	19	52.77%	['fuzz_policy', 'fuzz_sudoers_ldif', 'fuzz_sudoers']
sudo_lbuf_append_v1	74	30	40.54%	['fuzz_sudoers']
sudo_lbuf_expand	33	16	48.48%	['fuzz_sudoers']
alias_find_used	51	12	23.52%	['fuzz_sudoers']
check_aliases	66	19	28.78%	['fuzz_sudoers']
display_defaults	32	11	34.37%	['fuzz_sudoers']
display_bound_defaults_by_type	51	22	43.13%	['fuzz_sudoers']
sudoersparse	1573	259	16.46%	['fuzz_sudoers']
sudoerserrorf	55	9	16.36%	['fuzz_sudoers']
parser_leak_add	42	19	45.23%	['fuzz_sudoers']
parser_leak_remove	51	21	41.17%	['fuzz_sudoers']
parser_leak_free	74	23	31.08%	['fuzz_policy', 'fuzz_sudoers']
sudoers_lookup	47	22	46.80%	['fuzz_policy', 'fuzz_sudoers']
sudoers_lookup_pseudo	128	34	26.56%	['fuzz_sudoers']
sudoers_lookup_check	67	9	13.43%	['fuzz_sudoers']
sudo_set_gidlist	39	21	53.84%	['fuzz_policy', 'fuzz_sudoers']
sudoerslex	1143	229	20.03%	['fuzz_sudoers']
pop_include	41	6	14.63%	['fuzz_sudoers']
fill_cmnd	41	15	36.58%	['fuzz_sudoers']
sudo_getgrouplist2_v1	35	11	31.42%	['fuzz_policy']
parse_default_entry	98	52	53.06%	['fuzz_policy', 'fuzz_sudoers']
wordsplit	38	20	52.63%	['fuzz_policy']
env_update_didvar	32	11	34.37%	['fuzz_policy']
expand_tilde	46	25	54.34%	['fuzz_policy', 'fuzz_sudoers']
sudoers_check_common	213	111	52.11%	['fuzz_policy']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/sudo/lib/util/./mktemp.c	['fuzz_iolog_timing', 'fuzz_sudo_conf', 'fuzz_logsrvd_conf']	[]
/src/sudo/plugins/sudoers/./match_digest.c	['fuzz_sudoers']	[]
/src/sudo/lib/util/./key_val.c	[]	[]
/src/sudo/plugins/sudoers/./sudoers_ctx_free.c	['fuzz_sudoers', 'fuzz_policy']	[]
/src/sudo/lib/iolog/./iolog_open.c	['fuzz_iolog_timing']	[]
/src/sudo/plugins/sudoers/./sethost.c	[]	[]
/src/sudo/lib/util/./chacha_private.h	['fuzz_iolog_timing', 'fuzz_sudo_conf', 'fuzz_logsrvd_conf']	[]
/src/sudo/lib/iolog/./iolog_legacy.c	['fuzz_iolog_legacy']	[]
/src/sudo/lib/util/./strtonum.c	['fuzz_iolog_legacy', 'fuzz_iolog_json', 'fuzz_iolog_timing', 'fuzz_logsrvd_conf', 'fuzz_sudoers']	[]
/src/sudo/lib/iolog/./iolog_close.c	['fuzz_iolog_timing']	[]
/src/sudo/lib/util/./login_max.c	[]	[]
/src/sudo/lib/util/./uuid.c	[]	[]
/src/sudo/logsrvd/./logsrvd_conf.c	['fuzz_logsrvd_conf']	[]
/src/sudo/plugins/sudoers/./editor.c	[]	[]
/src/sudo/lib/util/./gettime.c	[]	[]
/src/sudo/lib/iolog/./regress/fuzz/fuzz_iolog_json.c	['fuzz_iolog_json']	[]
/src/sudo/plugins/sudoers/./defaults.c	['fuzz_sudoers_ldif', 'fuzz_sudoers']	[]
/src/sudo/lib/util/./logfac.c	['fuzz_logsrvd_conf', 'fuzz_sudoers_ldif', 'fuzz_sudoers']	[]
/src/sudo/plugins/sudoers/./filedigest.c	['fuzz_sudoers']	[]
/src/sudo/plugins/sudoers/./regress/fuzz/fuzz_policy.c	['fuzz_policy']	[]
/src/sudo/lib/util/./strlcat.c	[]	[]
/src/sudo/plugins/sudoers/./toke_util.c	['fuzz_sudoers']	[]
/src/sudo/lib/util/./strtomode.c	['fuzz_sudoers']	[]
/src/sudo/lib/eventlog/./parse_json.c	['fuzz_iolog_json']	[]
/src/sudo/lib/util/./str2sig.c	['fuzz_iolog_timing']	[]
/src/sudo/plugins/sudoers/./pwutil.c	['fuzz_sudoers', 'fuzz_policy']	[]
/src/sudo/lib/util/./secure_path.c	['fuzz_logsrvd_conf', 'fuzz_sudoers']	[]
/src/sudo/lib/util/./lbuf.c	['fuzz_sudoers', 'fuzz_policy']	[]
/src/sudo/plugins/sudoers/gram.c	['fuzz_sudoers']	['fuzz_sudoers']
/src/sudo/plugins/sudoers/./serialize_list.c	[]	[]
/src/sudo/plugins/sudoers/./redblack.c	['fuzz_sudoers_ldif', 'fuzz_sudoers', 'fuzz_policy']	[]
/src/sudo/plugins/sudoers/./sudoers_debug.c	['fuzz_sudoers_ldif', 'fuzz_sudoers', 'fuzz_policy']	[]
/src/sudo/plugins/sudoers/./env_pattern.c	[]	[]
/src/sudo/lib/iolog/./iolog_util.c	['fuzz_iolog_timing']	[]
/src/sudo/plugins/sudoers/./sudoers.c	['fuzz_policy']	[]
/src/sudo/lib/util/./strtoid.c	['fuzz_sudoers']	[]
/src/sudo/lib/iolog/./iolog_conf.c	['fuzz_iolog_timing', 'fuzz_logsrvd_conf']	[]
/src/sudo/lib/iolog/./host_port.c	['fuzz_logsrvd_conf']	[]
/src/sudo/plugins/sudoers/./regress/fuzz/fuzz_stubs.c	['fuzz_sudoers_ldif', 'fuzz_sudoers']	[]
/src/sudo/lib/iolog/./iolog_openat.c	['fuzz_iolog_timing']	[]
/src/sudo/lib/util/./logpri.c	['fuzz_logsrvd_conf', 'fuzz_sudoers_ldif', 'fuzz_sudoers']	[]
/src/sudo/lib/util/./strtobool.c	[]	[]
/src/sudo/plugins/sudoers/./parse_ldif.c	['fuzz_sudoers_ldif']	[]
/src/sudo/plugins/sudoers/./regress/fuzz/fuzz_sudoers_ldif.c	['fuzz_sudoers_ldif']	[]
/src/sudo/lib/util/./strlcpy.c	['fuzz_sudo_conf', 'fuzz_logsrvd_conf', 'fuzz_sudoers']	[]
/src/sudo/lib/util/./fatal.c	['fuzz_iolog_legacy', 'fuzz_iolog_json', 'fuzz_iolog_timing', 'fuzz_sudo_conf', 'fuzz_logsrvd_conf', 'fuzz_sudoers_ldif', 'fuzz_sudoers', 'fuzz_policy']	[]
/src/sudo/lib/iolog/./regress/fuzz/fuzz_iolog_timing.c	['fuzz_iolog_timing']	[]
/src/sudo/lib/util/./regex.c	['fuzz_sudoers']	[]
/src/sudo/plugins/sudoers/gram.y	['fuzz_sudoers_ldif', 'fuzz_sudoers', 'fuzz_policy']	['fuzz_sudoers_ldif', 'fuzz_sudoers', 'fuzz_policy']
/src/sudo/plugins/sudoers/./parser_warnx.c	['fuzz_sudoers']	[]
/src/sudo/lib/util/./gethostname.c	['fuzz_sudoers']	[]
/src/sudo/lib/iolog/./iolog_gets.c	['fuzz_iolog_timing']	[]
/src/sudo/plugins/sudoers/./exptilde.c	['fuzz_sudoers']	[]
/src/sudo/plugins/sudoers/./lookup.c	['fuzz_sudoers']	[]
/src/sudo/plugins/sudoers/toke.c	['fuzz_sudoers', 'fuzz_policy']	['fuzz_sudoers']
/src/sudo/plugins/sudoers/./check_aliases.c	['fuzz_sudoers']	[]
/src/sudo/lib/util/./rcstr.c	['fuzz_logsrvd_conf', 'fuzz_sudoers_ldif', 'fuzz_sudoers', 'fuzz_policy']	[]
/src/sudo/plugins/sudoers/./strvec_join.c	[]	[]
/src/sudo/plugins/sudoers/./regress/fuzz/fuzz_sudoers.c	['fuzz_sudoers']	[]
/src/sudo/plugins/sudoers/./match.c	['fuzz_sudoers']	[]
/src/sudo/lib/util/./basename.c	['fuzz_iolog_legacy', 'fuzz_iolog_json', 'fuzz_iolog_timing', 'fuzz_sudo_conf', 'fuzz_logsrvd_conf', 'fuzz_sudoers_ldif', 'fuzz_sudoers', 'fuzz_policy']	[]
/src/sudo/lib/util/./gidlist.c	[]	[]
/src/sudo/plugins/sudoers/./strlcpy_unesc.c	[]	[]
/src/sudo/plugins/sudoers/./gc.c	['fuzz_policy']	[]
/src/sudo/lib/iolog/./regress/fuzz/fuzz_iolog_legacy.c	['fuzz_iolog_legacy']	[]
/src/sudo/logsrvd/./regress/fuzz/fuzz_logsrvd_conf.c	['fuzz_logsrvd_conf']	[]
/src/sudo/plugins/sudoers/./match_addr.c	['fuzz_sudoers']	[]
/src/sudo/plugins/sudoers/./sudoers_cb.c	[]	[]
/src/sudo/plugins/sudoers/./gentime.c	['fuzz_sudoers_ldif', 'fuzz_sudoers']	[]
/src/sudo/plugins/sudoers/./policy.c	[]	[]
/src/sudo/lib/util/./hexchar.c	['fuzz_iolog_json', 'fuzz_sudoers']	[]
/src/sudo/plugins/sudoers/./fmtsudoers.c	['fuzz_sudoers_ldif', 'fuzz_sudoers']	[]
/src/sudo/plugins/sudoers/./locale.c	['fuzz_sudoers_ldif', 'fuzz_sudoers']	[]
/src/sudo/plugins/sudoers/./ldap_util.c	['fuzz_sudoers_ldif']	[]
/src/sudo/lib/util/./sudo_debug.c	['fuzz_iolog_legacy', 'fuzz_iolog_json', 'fuzz_iolog_timing', 'fuzz_sudo_conf', 'fuzz_logsrvd_conf', 'fuzz_sudoers_ldif', 'fuzz_sudoers', 'fuzz_policy']	[]
/src/sudo/lib/util/./progname.c	['fuzz_iolog_legacy', 'fuzz_iolog_json', 'fuzz_iolog_timing', 'fuzz_sudo_conf', 'fuzz_logsrvd_conf', 'fuzz_sudoers_ldif', 'fuzz_sudoers', 'fuzz_policy']	[]
/src/sudo/lib/eventlog/./eventlog_conf.c	['fuzz_logsrvd_conf']	[]
/src/sudo/lib/eventlog/./eventlog_free.c	['fuzz_iolog_legacy', 'fuzz_iolog_json']	[]
/src/sudo/lib/iolog/./iolog_filter.c	['fuzz_logsrvd_conf']	[]
/src/sudo/lib/iolog/./iolog_json.c	['fuzz_iolog_json']	[]
/src/sudo/plugins/sudoers/./digestname.c	['fuzz_sudoers_ldif', 'fuzz_sudoers']	[]
/src/sudo/lib/util/./regress/fuzz/fuzz_sudo_conf.c	['fuzz_sudo_conf']	[]
/src/sudo/lib/util/./digest_openssl.c	['fuzz_sudoers']	[]
/src/sudo/plugins/sudoers/./strlist.c	['fuzz_sudoers_ldif']	[]
/src/sudo/plugins/sudoers/./alias.c	['fuzz_sudoers_ldif', 'fuzz_sudoers', 'fuzz_policy']	[]
/src/sudo/plugins/sudoers/./timeout.c	['fuzz_sudoers_ldif', 'fuzz_sudoers']	[]
/src/sudo/plugins/sudoers/./canon_path.c	['fuzz_sudoers', 'fuzz_policy']	[]
/src/sudo/plugins/sudoers/./display.c	['fuzz_sudoers']	[]
/src/sudo/plugins/sudoers/./iolog_path_escapes.c	[]	[]
/src/sudo/lib/iolog/./iolog_timing.c	['fuzz_iolog_timing']	[]
/src/sudo/plugins/sudoers/toke.l	['fuzz_sudoers', 'fuzz_policy']	['fuzz_sudoers', 'fuzz_policy']
/src/sudo/lib/util/./parseln.c	['fuzz_sudo_conf', 'fuzz_logsrvd_conf']	[]
/src/sudo/lib/util/./getgrouplist.c	[]	[]
/src/sudo/plugins/sudoers/./pwutil_impl.c	[]	[]
/src/sudo/lib/iolog/./iolog_eof.c	['fuzz_iolog_timing']	[]
/src/sudo/lib/util/./roundup.c	['fuzz_sudo_conf', 'fuzz_logsrvd_conf', 'fuzz_sudoers']	[]
/src/sudo/plugins/sudoers/./env.c	['fuzz_policy']	[]
/src/sudo/logsrvd/./tls_init.c	['fuzz_logsrvd_conf']	[]
/src/sudo/plugins/sudoers/./match_command.c	['fuzz_sudoers']	[]
/src/sudo/lib/util/./arc4random.c	['fuzz_iolog_timing', 'fuzz_sudo_conf', 'fuzz_logsrvd_conf']	[]
/src/sudo/lib/util/./sudo_conf.c	['fuzz_sudo_conf']	[]
/src/sudo/lib/util/./strsplit.c	['fuzz_logsrvd_conf', 'fuzz_sudoers']	[]
/src/sudo/plugins/sudoers/./sudoers_hooks.c	[]	[]
/src/sudo/plugins/sudoers/./b64_decode.c	['fuzz_sudoers_ldif', 'fuzz_sudoers']	[]

Directories in report

Directory
/src/sudo/lib/util/./regress/fuzz/
/src/sudo/lib/util/./
/src/sudo/lib/iolog/./
/src/sudo/plugins/sudoers/./
/src/sudo/lib/iolog/./regress/fuzz/
/src/sudo/lib/eventlog/./
/src/sudo/plugins/sudoers/./regress/fuzz/
/src/sudo/plugins/sudoers/
/src/sudo/logsrvd/./regress/fuzz/
/src/sudo/logsrvd/./