Fuzz introspector
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzzers overview

Fuzzer Fuzzer filename Functions Reached Functions unreached Fuzzer depth Files reached Basic blocks reached Cyclomatic complexity Details
Tss2_Sys_PolicyRestart_Prepare test/fuzz/main-sys.c 64 333 7 16 441 241 main-sys.c
Tss2_Sys_ClockSet_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_ContextLoad_Complete test/fuzz/main-sys.c 58 339 7 16 395 221 main-sys.c
Tss2_Sys_NV_Increment_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_RSA_Encrypt_Prepare test/fuzz/main-sys.c 72 325 7 20 627 310 main-sys.c
Tss2_Sys_IncrementalSelfTest_Complete test/fuzz/main-sys.c 60 337 7 17 463 247 main-sys.c
Tss2_Sys_PolicyAuthorizeNV_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_NV_UndefineSpaceSpecial_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_NV_SetBits_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_MAC_Start_Prepare test/fuzz/main-sys.c 66 331 7 17 512 268 main-sys.c
Tss2_Sys_GetSessionAuditDigest_Complete test/fuzz/main-sys.c 75 322 9 20 789 365 main-sys.c
Tss2_Sys_NV_ChangeAuth_Complete test/fuzz/main-sys.c 58 339 7 14 393 220 main-sys.c
Tss2_Sys_PolicyCommandCode_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_SetAlgorithmSet_Prepare test/fuzz/main-sys.c 64 333 7 16 443 242 main-sys.c
Tss2_Sys_PolicyNvWritten_Prepare test/fuzz/main-sys.c 65 332 7 16 470 252 main-sys.c
Tss2_Sys_SetPrimaryPolicy_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_Load_Complete test/fuzz/main-sys.c 60 337 7 17 458 246 main-sys.c
Tss2_Sys_LoadExternal_Complete test/fuzz/main-sys.c 60 337 7 17 458 246 main-sys.c
Tss2_Sys_Policy_AC_SendSelect_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_NV_ReadLock_Prepare test/fuzz/main-sys.c 64 333 7 16 443 242 main-sys.c
Tss2_Sys_Unseal_Complete test/fuzz/main-sys.c 60 337 7 17 456 245 main-sys.c
Tss2_Sys_StartAuthSession_Prepare test/fuzz/main-sys.c 72 325 7 19 653 313 main-sys.c
Tss2_Sys_TestParms_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_Shutdown_Prepare test/fuzz/main-sys.c 64 333 7 16 441 241 main-sys.c
Tss2_Sys_PolicyCpHash_Prepare test/fuzz/main-sys.c 66 331 7 17 510 267 main-sys.c
Tss2_Sys_NV_Read_Complete test/fuzz/main-sys.c 60 337 7 17 456 245 main-sys.c
Tss2_Sys_NV_ReadLock_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_PolicyTicket_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_PolicyLocality_Prepare test/fuzz/main-sys.c 65 332 7 17 470 252 main-sys.c
Tss2_Sys_PolicyCommandCode_Prepare test/fuzz/main-sys.c 64 333 7 16 443 242 main-sys.c
Tss2_Sys_PCR_Event_Prepare test/fuzz/main-sys.c 66 331 7 17 510 267 main-sys.c
Tss2_Sys_Quote_Complete test/fuzz/main-sys.c 75 322 9 20 789 365 main-sys.c
Tss2_Sys_PCR_SetAuthPolicy_Prepare test/fuzz/main-sys.c 66 331 7 17 514 269 main-sys.c
Tss2_Sys_Load_Prepare test/fuzz/main-sys.c 93 304 10 21 1094 465 main-sys.c
Tss2_Sys_ACT_SetTimeout_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_GetSessionAuditDigest_Prepare test/fuzz/main-sys.c 71 326 7 20 589 296 main-sys.c
Tss2_Sys_DictionaryAttackLockReset_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_PCR_Extend_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_ClockRateAdjust_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_SequenceUpdate_Prepare test/fuzz/main-sys.c 66 331 7 17 510 267 main-sys.c
Tss2_Sys_HierarchyControl_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_Certify_Prepare test/fuzz/main-sys.c 71 326 7 20 587 295 main-sys.c
Tss2_Sys_GetTime_Complete test/fuzz/main-sys.c 75 322 9 20 789 365 main-sys.c
Tss2_Sys_EncryptDecrypt_Prepare test/fuzz/main-sys.c 68 329 7 17 583 295 main-sys.c
Tss2_Sys_CreateLoaded_Prepare test/fuzz/main-sys.c 70 327 7 18 642 319 main-sys.c
Tss2_Sys_ECC_Parameters_Prepare test/fuzz/main-sys.c 64 333 7 16 441 241 main-sys.c
Tss2_Sys_Shutdown_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_PCR_Extend_Prepare test/fuzz/main-sys.c 75 322 8 19 590 299 main-sys.c
Tss2_Sys_SetPrimaryPolicy_Prepare test/fuzz/main-sys.c 66 331 7 17 512 268 main-sys.c
Tss2_Sys_PCR_Read_Prepare test/fuzz/main-sys.c 69 328 7 18 587 297 main-sys.c
Tss2_Sys_ECC_Parameters_Complete test/fuzz/main-sys.c 68 329 7 20 725 337 main-sys.c
Tss2_Sys_NV_Read_Prepare test/fuzz/main-sys.c 65 332 7 16 474 254 main-sys.c
Tss2_Sys_AC_Send_Complete test/fuzz/main-sys.c 59 338 7 17 423 232 main-sys.c
Tss2_Sys_PolicyNameHash_Complete test/fuzz/main-sys.c 58 339 7 14 393 220 main-sys.c
Tss2_Sys_NV_GlobalWriteLock_Prepare test/fuzz/main-sys.c 64 333 7 16 441 241 main-sys.c
Tss2_Sys_ReadPublic_Prepare test/fuzz/main-sys.c 64 333 7 16 441 241 main-sys.c
Tss2_Sys_ContextSave_Complete test/fuzz/main-sys.c 63 334 7 18 523 273 main-sys.c
Tss2_Sys_CreatePrimary_Prepare test/fuzz/main-sys.c 101 296 10 22 1337 560 main-sys.c
Tss2_Sys_ECDH_ZGen_Prepare test/fuzz/main-sys.c 68 329 7 18 564 289 main-sys.c
Tss2_Sys_FlushContext_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_DictionaryAttackParameters_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_FieldUpgradeStart_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_HierarchyControl_Prepare test/fuzz/main-sys.c 65 332 7 16 472 253 main-sys.c
Tss2_Sys_Rewrap_Prepare test/fuzz/main-sys.c 68 329 7 17 596 300 main-sys.c
Tss2_Sys_ClearControl_Prepare test/fuzz/main-sys.c 65 332 7 16 470 252 main-sys.c
Tss2_Sys_HashSequenceStart_Complete test/fuzz/main-sys.c 58 339 7 16 395 221 main-sys.c
Tss2_Sys_Startup_Prepare test/fuzz/main-sys.c 64 333 7 16 441 241 main-sys.c
Tss2_Sys_NV_Certify_Complete test/fuzz/main-sys.c 75 322 9 20 789 365 main-sys.c
Tss2_Sys_SelfTest_Prepare test/fuzz/main-sys.c 64 333 7 16 441 241 main-sys.c
Tss2_Sys_Duplicate_Prepare test/fuzz/main-sys.c 70 327 7 19 580 285 main-sys.c
Tss2_Sys_EvictControl_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_EC_Ephemeral_Complete test/fuzz/main-sys.c 62 335 7 18 521 271 main-sys.c
Tss2_Sys_NV_ChangeAuth_Prepare test/fuzz/main-sys.c 66 331 7 17 510 267 main-sys.c
Tss2_Sys_TestParms_Prepare test/fuzz/main-sys.c 85 312 9 19 827 367 main-sys.c
Tss2_Sys_PolicyNV_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_CertifyCreation_Prepare test/fuzz/main-sys.c 73 324 7 20 650 321 main-sys.c
Tss2_Sys_EventSequenceComplete_Complete test/fuzz/main-sys.c 69 328 8 19 588 293 main-sys.c
Tss2_Sys_PolicySecret_Complete test/fuzz/main-sys.c 62 335 7 18 518 270 main-sys.c
Tss2_Sys_GetCapability_Prepare test/fuzz/main-sys.c 64 333 7 16 445 243 main-sys.c
Tss2_Sys_ReadClock_Complete test/fuzz/main-sys.c 63 334 7 17 518 271 main-sys.c
Tss2_Sys_IncrementalSelfTest_Prepare test/fuzz/main-sys.c 66 331 7 17 504 265 main-sys.c
Tss2_Sys_Vendor_TCG_Test_Complete test/fuzz/main-sys.c 60 337 7 17 456 245 main-sys.c
Tss2_Sys_LoadExternal_Prepare test/fuzz/main-sys.c 98 299 10 21 1244 518 main-sys.c
Tss2_Sys_ContextLoad_Prepare test/fuzz/main-sys.c 69 328 7 18 561 289 main-sys.c
Tss2_Sys_ClearControl_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_ChangePPS_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_ActivateCredential_Complete test/fuzz/main-sys.c 60 337 7 17 456 245 main-sys.c
Tss2_Sys_EncryptDecrypt2_Complete test/fuzz/main-sys.c 61 336 7 17 491 259 main-sys.c
Tss2_Sys_Startup_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_GetCapability_Complete test/fuzz/main-sys.c 93 304 8 21 1462 619 main-sys.c
Tss2_Sys_ZGen_2Phase_Complete test/fuzz/main-sys.c 62 335 7 18 521 271 main-sys.c
Tss2_Sys_PCR_Allocate_Complete test/fuzz/main-sys.c 59 338 7 16 429 235 main-sys.c
Tss2_Sys_PCR_SetAuthPolicy_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_StirRandom_Prepare test/fuzz/main-sys.c 65 332 7 17 481 256 main-sys.c
Tss2_Sys_ChangeEPS_Prepare test/fuzz/main-sys.c 64 333 7 16 441 241 main-sys.c
Tss2_Sys_SequenceComplete_Complete test/fuzz/main-sys.c 61 336 7 18 485 257 main-sys.c
Tss2_Sys_EvictControl_Prepare test/fuzz/main-sys.c 64 333 7 16 445 243 main-sys.c
Tss2_Sys_Commit_Complete test/fuzz/main-sys.c 62 335 7 18 525 273 main-sys.c
Tss2_Sys_PolicyCpHash_Complete test/fuzz/main-sys.c 58 339 7 14 393 220 main-sys.c
Tss2_Sys_EventSequenceComplete_Prepare test/fuzz/main-sys.c 66 331 7 17 512 268 main-sys.c
Tss2_Sys_CertifyX509_Prepare test/fuzz/main-sys.c 72 325 7 20 629 312 main-sys.c
Tss2_Sys_VerifySignature_Prepare test/fuzz/main-sys.c 81 316 9 20 756 359 main-sys.c
Tss2_Sys_HMAC_Complete test/fuzz/main-sys.c 60 337 7 17 456 245 main-sys.c
Tss2_Sys_PolicyGetDigest_Complete test/fuzz/main-sys.c 60 337 7 17 456 245 main-sys.c
Tss2_Sys_Policy_AC_SendSelect_Prepare test/fuzz/main-sys.c 67 330 7 17 549 282 main-sys.c
Tss2_Sys_HierarchyChangeAuth_Complete test/fuzz/main-sys.c 58 339 7 14 393 220 main-sys.c
Tss2_Sys_NV_SetBits_Prepare test/fuzz/main-sys.c 66 331 7 16 473 255 main-sys.c
Tss2_Sys_ECDH_ZGen_Complete test/fuzz/main-sys.c 62 335 7 18 519 270 main-sys.c
Tss2_Sys_RSA_Encrypt_Complete test/fuzz/main-sys.c 60 337 7 17 456 245 main-sys.c
Tss2_Sys_EncryptDecrypt_Complete test/fuzz/main-sys.c 61 336 7 17 491 259 main-sys.c
Tss2_Sys_PolicySigned_Prepare test/fuzz/main-sys.c 82 315 9 20 807 379 main-sys.c
Tss2_Sys_HierarchyChangeAuth_Prepare test/fuzz/main-sys.c 66 331 7 17 510 267 main-sys.c
Tss2_Sys_ChangePPS_Prepare test/fuzz/main-sys.c 64 333 7 16 441 241 main-sys.c
Tss2_Sys_CreatePrimary_Complete test/fuzz/main-sys.c 96 301 10 22 1699 679 main-sys.c
Tss2_Sys_FirmwareRead_Prepare test/fuzz/main-sys.c 64 333 7 16 441 241 main-sys.c
Tss2_Sys_CertifyCreation_Complete test/fuzz/main-sys.c 75 322 9 20 789 365 main-sys.c
Tss2_Sys_NV_UndefineSpaceSpecial_Prepare test/fuzz/main-sys.c 64 333 7 16 443 242 main-sys.c
Tss2_Sys_PCR_Reset_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_Vendor_TCG_Test_Prepare test/fuzz/main-sys.c 65 332 7 17 481 256 main-sys.c
Tss2_Sys_PCR_Reset_Prepare test/fuzz/main-sys.c 64 333 7 16 441 241 main-sys.c
Tss2_Sys_PolicyTemplate_Complete test/fuzz/main-sys.c 58 339 7 14 393 220 main-sys.c
Tss2_Sys_NV_Increment_Prepare test/fuzz/main-sys.c 64 333 7 16 443 242 main-sys.c
Tss2_Sys_MAC_Complete test/fuzz/main-sys.c 60 337 7 17 456 245 main-sys.c
Tss2_Sys_RSA_Decrypt_Complete test/fuzz/main-sys.c 60 337 7 17 456 245 main-sys.c
Tss2_Sys_PolicyOR_Prepare test/fuzz/main-sys.c 67 330 7 18 543 280 main-sys.c
Tss2_Sys_SetAlgorithmSet_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_MakeCredential_Prepare test/fuzz/main-sys.c 67 330 7 17 552 283 main-sys.c
Tss2_Sys_HMAC_Start_Prepare test/fuzz/main-sys.c 66 331 7 17 512 268 main-sys.c
Tss2_Sys_DictionaryAttackParameters_Prepare test/fuzz/main-sys.c 64 333 7 16 447 244 main-sys.c
Tss2_Sys_ReadPublic_Complete test/fuzz/main-sys.c 87 310 10 21 1371 551 main-sys.c
Tss2_Sys_PCR_SetAuthValue_Complete test/fuzz/main-sys.c 58 339 7 14 393 220 main-sys.c
Tss2_Sys_PolicyNvWritten_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_Create_Prepare test/fuzz/main-sys.c 101 296 10 22 1340 561 main-sys.c
Tss2_Sys_CertifyX509_Complete test/fuzz/main-sys.c 76 321 9 20 824 379 main-sys.c
Tss2_Sys_PolicyPhysicalPresence_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_StartAuthSession_Complete test/fuzz/main-sys.c 60 337 7 17 458 246 main-sys.c
Tss2_Sys_Clear_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_MAC_Start_Complete test/fuzz/main-sys.c 58 339 7 16 395 221 main-sys.c
Tss2_Sys_NV_WriteLock_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_GetCommandAuditDigest_Complete test/fuzz/main-sys.c 75 322 9 20 789 365 main-sys.c
Tss2_Sys_PolicyAuthorizeNV_Prepare test/fuzz/main-sys.c 64 333 7 16 445 243 main-sys.c
Tss2_Sys_FlushContext_Prepare test/fuzz/main-sys.c 64 333 7 16 441 241 main-sys.c
Tss2_Sys_PolicyLocality_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_SetCommandCodeAuditStatus_Prepare test/fuzz/main-sys.c 67 330 7 17 539 279 main-sys.c
Tss2_Sys_PolicyRestart_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_PP_Commands_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_GetRandom_Complete test/fuzz/main-sys.c 60 337 7 17 456 245 main-sys.c
Tss2_Sys_PCR_SetAuthValue_Prepare test/fuzz/main-sys.c 66 331 7 17 510 267 main-sys.c
Tss2_Sys_Duplicate_Complete test/fuzz/main-sys.c 62 335 7 17 526 273 main-sys.c
Tss2_Sys_PolicyCounterTimer_Prepare test/fuzz/main-sys.c 66 331 7 17 514 269 main-sys.c
Tss2_Sys_PolicyAuthValue_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_PolicyAuthorize_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_PCR_Read_Complete test/fuzz/main-sys.c 65 332 7 19 644 317 main-sys.c
Tss2_Sys_GetTestResult_Complete test/fuzz/main-sys.c 60 337 7 17 458 246 main-sys.c
Tss2_Sys_PCR_Event_Complete test/fuzz/main-sys.c 69 328 8 19 588 293 main-sys.c
Tss2_Sys_HMAC_Prepare test/fuzz/main-sys.c 66 331 7 17 512 268 main-sys.c
Tss2_Sys_AC_GetCapability_Complete test/fuzz/main-sys.c 61 336 7 18 493 259 main-sys.c
Tss2_Sys_ObjectChangeAuth_Prepare test/fuzz/main-sys.c 66 331 7 17 512 268 main-sys.c
Tss2_Sys_ClockRateAdjust_Prepare test/fuzz/main-sys.c 65 332 7 16 470 252 main-sys.c
Tss2_Sys_MakeCredential_Complete test/fuzz/main-sys.c 61 336 7 17 491 259 main-sys.c
Tss2_Sys_HMAC_Start_Complete test/fuzz/main-sys.c 58 339 7 16 395 221 main-sys.c
Tss2_Sys_PolicyPCR_Prepare test/fuzz/main-sys.c 71 326 7 19 660 325 main-sys.c
Tss2_Sys_PolicyPassword_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_EC_Ephemeral_Prepare test/fuzz/main-sys.c 64 333 7 16 441 241 main-sys.c
Tss2_Sys_ActivateCredential_Prepare test/fuzz/main-sys.c 67 330 7 17 554 284 main-sys.c
Tss2_Sys_Commit_Prepare test/fuzz/main-sys.c 69 328 7 18 611 307 main-sys.c
Tss2_Sys_AC_GetCapability_Prepare test/fuzz/main-sys.c 65 332 7 16 472 253 main-sys.c
Tss2_Sys_SequenceUpdate_Complete test/fuzz/main-sys.c 58 339 7 14 393 220 main-sys.c
Tss2_Sys_GetCommandAuditDigest_Prepare test/fuzz/main-sys.c 71 326 7 20 587 295 main-sys.c
Tss2_Sys_PolicyTicket_Prepare test/fuzz/main-sys.c 70 327 7 18 661 326 main-sys.c
Tss2_Sys_EncryptDecrypt2_Prepare test/fuzz/main-sys.c 68 329 7 17 583 295 main-sys.c
Tss2_Sys_NV_ReadPublic_Complete test/fuzz/main-sys.c 64 333 7 19 599 301 main-sys.c
Tss2_Sys_FieldUpgradeData_Complete test/fuzz/main-sys.c 68 329 7 18 550 279 main-sys.c
Tss2_Sys_DictionaryAttackLockReset_Prepare test/fuzz/main-sys.c 64 333 7 16 441 241 main-sys.c
Tss2_Sys_ECDH_KeyGen_Complete test/fuzz/main-sys.c 62 335 7 18 521 271 main-sys.c
Tss2_Sys_PolicyCounterTimer_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_Import_Prepare test/fuzz/main-sys.c 95 302 10 21 1183 499 main-sys.c
Tss2_Sys_NV_WriteLock_Prepare test/fuzz/main-sys.c 64 333 7 16 443 242 main-sys.c
Tss2_Sys_Create_Complete test/fuzz/main-sys.c 97 300 10 22 1730 691 main-sys.c
Tss2_Sys_Quote_Prepare test/fuzz/main-sys.c 76 321 7 21 734 352 main-sys.c
Tss2_Sys_Unseal_Prepare test/fuzz/main-sys.c 64 333 7 16 441 241 main-sys.c
Tss2_Sys_NV_Write_Prepare test/fuzz/main-sys.c 66 331 7 17 514 269 main-sys.c
Tss2_Sys_PolicySecret_Prepare test/fuzz/main-sys.c 67 330 7 17 561 287 main-sys.c
Tss2_Sys_PolicyNameHash_Prepare test/fuzz/main-sys.c 66 331 7 17 510 267 main-sys.c
Tss2_Sys_ACT_SetTimeout_Prepare test/fuzz/main-sys.c 64 333 7 16 443 242 main-sys.c
Tss2_Sys_PolicyOR_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_PolicyAuthValue_Prepare test/fuzz/main-sys.c 64 333 7 16 441 241 main-sys.c
Tss2_Sys_CreateLoaded_Complete test/fuzz/main-sys.c 88 309 10 21 1406 565 main-sys.c
Tss2_Sys_FieldUpgradeStart_Prepare test/fuzz/main-sys.c 81 316 9 20 758 360 main-sys.c
Tss2_Sys_AC_Send_Prepare test/fuzz/main-sys.c 66 331 7 17 514 269 main-sys.c
Tss2_Sys_SetCommandCodeAuditStatus_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_PolicyDuplicationSelect_Prepare test/fuzz/main-sys.c 67 330 7 17 544 280 main-sys.c
Tss2_Sys_PolicySigned_Complete test/fuzz/main-sys.c 62 335 7 18 518 270 main-sys.c
Tss2_Sys_NV_Extend_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_PP_Commands_Prepare test/fuzz/main-sys.c 66 331 7 17 510 268 main-sys.c
Tss2_Sys_NV_Extend_Prepare test/fuzz/main-sys.c 66 331 7 17 512 268 main-sys.c
Tss2_Sys_PolicyNV_Prepare test/fuzz/main-sys.c 66 331 7 17 518 271 main-sys.c
Tss2_Sys_SequenceComplete_Prepare test/fuzz/main-sys.c 66 331 7 17 512 268 main-sys.c
Tss2_Sys_NV_GlobalWriteLock_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_ClockSet_Prepare test/fuzz/main-sys.c 66 331 7 16 471 254 main-sys.c
Tss2_Sys_Rewrap_Complete test/fuzz/main-sys.c 61 336 7 17 491 259 main-sys.c
Tss2_Sys_PolicyPassword_Prepare test/fuzz/main-sys.c 64 333 7 16 441 241 main-sys.c
Tss2_Sys_Hash_Complete test/fuzz/main-sys.c 61 336 7 18 485 257 main-sys.c
Tss2_Sys_PolicyTemplate_Prepare test/fuzz/main-sys.c 66 331 7 17 510 267 main-sys.c
Tss2_Sys_ZGen_2Phase_Prepare test/fuzz/main-sys.c 68 329 7 18 573 293 main-sys.c
Tss2_Sys_ContextSave_Prepare test/fuzz/main-sys.c 64 333 7 16 441 241 main-sys.c
Tss2_Sys_FirmwareRead_Complete test/fuzz/main-sys.c 60 337 7 17 456 245 main-sys.c
Tss2_Sys_HashSequenceStart_Prepare test/fuzz/main-sys.c 65 332 7 17 483 257 main-sys.c
Tss2_Sys_NV_UndefineSpace_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_PolicyDuplicationSelect_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_VerifySignature_Complete test/fuzz/main-sys.c 61 336 7 18 483 256 main-sys.c
Tss2_Sys_PolicyPCR_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_NV_ReadPublic_Prepare test/fuzz/main-sys.c 64 333 7 16 441 241 main-sys.c
Tss2_Sys_NV_DefineSpace_Prepare test/fuzz/main-sys.c 70 327 7 19 641 319 main-sys.c
Tss2_Sys_NV_Certify_Prepare test/fuzz/main-sys.c 71 326 7 20 593 298 main-sys.c
Tss2_Sys_NV_DefineSpace_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_PolicyAuthorize_Prepare test/fuzz/main-sys.c 69 328 7 18 619 310 main-sys.c
Tss2_Sys_Sign_Complete test/fuzz/main-sys.c 74 323 9 20 754 351 main-sys.c
Tss2_Sys_PolicyGetDigest_Prepare test/fuzz/main-sys.c 64 333 7 16 441 241 main-sys.c
Tss2_Sys_Sign_Prepare test/fuzz/main-sys.c 72 325 7 20 609 305 main-sys.c
Tss2_Sys_Clear_Prepare test/fuzz/main-sys.c 64 333 7 16 441 241 main-sys.c
Tss2_Sys_NV_Write_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_ChangeEPS_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_Hash_Prepare test/fuzz/main-sys.c 66 331 7 17 512 268 main-sys.c
Tss2_Sys_NV_UndefineSpace_Prepare test/fuzz/main-sys.c 64 333 7 16 443 242 main-sys.c
Tss2_Sys_ECDH_KeyGen_Prepare test/fuzz/main-sys.c 64 333 7 16 441 241 main-sys.c
Tss2_Sys_ObjectChangeAuth_Complete test/fuzz/main-sys.c 60 337 7 17 456 245 main-sys.c
Tss2_Sys_Certify_Complete test/fuzz/main-sys.c 75 322 9 20 789 365 main-sys.c
Tss2_Sys_PolicyPhysicalPresence_Prepare test/fuzz/main-sys.c 64 333 7 16 441 241 main-sys.c
Tss2_Sys_GetTime_Prepare test/fuzz/main-sys.c 71 326 7 20 587 295 main-sys.c
Tss2_Sys_FieldUpgradeData_Prepare test/fuzz/main-sys.c 65 332 7 17 481 256 main-sys.c
Tss2_Sys_GetRandom_Prepare test/fuzz/main-sys.c 64 333 7 16 441 241 main-sys.c
Tss2_Sys_PCR_Allocate_Prepare test/fuzz/main-sys.c 69 328 7 18 591 299 main-sys.c
Tss2_Sys_RSA_Decrypt_Prepare test/fuzz/main-sys.c 72 325 7 20 627 310 main-sys.c
Tss2_Sys_StirRandom_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_Import_Complete test/fuzz/main-sys.c 60 337 7 17 456 245 main-sys.c
Tss2_Sys_SelfTest_Complete test/fuzz/main-sys.c 58 339 7 16 393 220 main-sys.c
Tss2_Sys_MAC_Prepare test/fuzz/main-sys.c 66 331 7 17 512 268 main-sys.c

Fuzzer details

Fuzzer: Tss2_Sys_PolicyRestart_Prepare

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 51 46.7%
gold [1:9] 2 1.83%
yellow [10:29] 0 0.0%
greenyellow [30:49] 54 49.5%
lawngreen 50+ 2 1.83%
All colors 109 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
62 62 4 :

['strchr', 'log_stringlevel', 'case_insensitive_strncmp', 'strlen']

62 62 getLogLevel call site: 00017 /src/tpm2-tss/src/util/log.c:251
40 40 2 :

['fflush', 'getLogFile']

40 40 doLog call site: 00016 /src/tpm2-tss/src/util/log.c:214
8 8 1 :

['tcti_type_from_name']

16 16 get_test_opts_from_env call site: 00002 /src/tpm2-tss/test/integration/sys-test-options.c:130
4 4 2 :

['strerror', '__errno_location']

4 4 tcti_fuzzing_init call site: 00058 /src/tpm2-tss/test/integration/sys-context-util.c:160
2 2 1 :

['strtol']

2 2 get_test_opts_from_env call site: 00008 /src/tpm2-tss/test/integration/sys-test-options.c:139
0 0 None 6 6 get_test_opts_from_env call site: 00006 /src/tpm2-tss/test/integration/sys-test-options.c:133
0 0 None 4 4 get_test_opts_from_env call site: 00007 /src/tpm2-tss/test/integration/sys-test-options.c:136
0 0 None 0 181 Tss2_Sys_PolicyRestart_Prepare call site: 00082 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_PolicyRestart.c:22
0 0 None 0 77 CopyCommandHeader call site: 00085 /src/tpm2-tss/src/tss2-sys/sysapi_util.c:46
0 0 None 0 67 Tss2_Sys_Initialize call site: 00068 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_Initialize.c:38
0 0 None 0 67 Tss2_Sys_Initialize call site: 00068 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_Initialize.c:44
0 0 None 0 0 Tss2_Sys_GetContextSize call site: 00064 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_GetContextSize.c:17

Runtime coverage analysis

Covered functions
35
Functions that are reachable but not covered
29
Reachable functions
64
Percentage of reachable functions covered
54.69%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
test/fuzz/main-sys.c 1
test/integration/sys-test-options.c 3
src/util/log.c 5
test/integration/sys-context-util.c 7
test/fuzz/tcti/tcti-fuzzing.c 11
src/tss2-tcti/tcti-common.c 2
src/tss2-sys/api/Tss2_Sys_GetContextSize.c 1
src/tss2-sys/api/Tss2_Sys_Initialize.c 1
./src/tss2-sys/sysapi_util.h 2
src/tss2-sys/sysapi_util.c 8
test/fuzz/Tss2_Sys_PolicyRestart_Prepare.fuzz.c 1
src/tss2-sys/api/Tss2_Sys_PolicyRestart.c 1
src/tss2-mu/base-types.c 2
/usr/include/x86_64-linux-gnu/bits/byteswap.h 2
src/tss2-sys/api/Tss2_Sys_GetTctiContext.c 1
src/tss2-sys/api/Tss2_Sys_Finalize.c 1

Fuzzer: Tss2_Sys_ClockSet_Complete

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 55 56.7%
gold [1:9] 41 42.2%
yellow [10:29] 0 0.0%
greenyellow [30:49] 0 0.0%
lawngreen 50+ 1 1.03%
All colors 97 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
152 152 2 :

['Tss2_MU_UINT32_Unmarshal', 'Tss2_MU_TPM2_ST_Unmarshal']

152 152 CommonComplete call site: 00082 /src/tpm2-tss/src/tss2-sys/sysapi_util.c:123
8 8 1 :

['tcti_type_from_name']

16 16 get_test_opts_from_env call site: 00002 /src/tpm2-tss/test/integration/sys-test-options.c:130
4 4 2 :

['strerror', '__errno_location']

4 4 tcti_fuzzing_init call site: 00058 /src/tpm2-tss/test/integration/sys-context-util.c:160
2 2 1 :

['strtol']

2 2 get_test_opts_from_env call site: 00008 /src/tpm2-tss/test/integration/sys-test-options.c:139
0 0 None 152 154 CommonComplete call site: 00080 /src/tpm2-tss/src/tss2-sys/sysapi_util.c:114
0 0 None 63 67 Tss2_Sys_Initialize call site: 00068 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_Initialize.c:38
0 0 None 63 67 Tss2_Sys_Initialize call site: 00068 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_Initialize.c:44
0 0 None 6 6 get_test_opts_from_env call site: 00006 /src/tpm2-tss/test/integration/sys-test-options.c:133
0 0 None 4 4 get_test_opts_from_env call site: 00007 /src/tpm2-tss/test/integration/sys-test-options.c:136
0 0 None 0 98 Tss2_Sys_ClockSet_Complete call site: 00079 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_ClockSet.c:53
0 0 None 0 0 Tss2_Sys_GetContextSize call site: 00064 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_GetContextSize.c:17
0 0 None 0 0 Tss2_Sys_GetTctiContext call site: 00091 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_GetTctiContext.c:21

Runtime coverage analysis

Covered functions
25
Functions that are reachable but not covered
33
Reachable functions
58
Percentage of reachable functions covered
43.1%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
test/fuzz/main-sys.c 1
test/integration/sys-test-options.c 3
src/util/log.c 5
test/integration/sys-context-util.c 7
test/fuzz/tcti/tcti-fuzzing.c 10
src/tss2-tcti/tcti-common.c 2
src/tss2-sys/api/Tss2_Sys_GetContextSize.c 1
src/tss2-sys/api/Tss2_Sys_Initialize.c 1
./src/tss2-sys/sysapi_util.h 2
src/tss2-sys/sysapi_util.c 3
test/fuzz/Tss2_Sys_ClockSet_Complete.fuzz.c 1
src/tss2-sys/api/Tss2_Sys_ClockSet.c 1
/usr/include/x86_64-linux-gnu/bits/byteswap.h 2
src/tss2-mu/base-types.c 2
src/tss2-sys/api/Tss2_Sys_GetTctiContext.c 1
src/tss2-sys/api/Tss2_Sys_Finalize.c 1

Fuzzer: Tss2_Sys_ContextLoad_Complete

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 53 54.0%
gold [1:9] 44 44.8%
yellow [10:29] 0 0.0%
greenyellow [30:49] 0 0.0%
lawngreen 50+ 1 1.02%
All colors 98 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
76 152 2 :

['Tss2_MU_UINT32_Unmarshal', 'Tss2_MU_TPM2_ST_Unmarshal']

76 152 CommonComplete call site: 00085 /src/tpm2-tss/src/tss2-sys/sysapi_util.c:123
62 62 4 :

['strchr', 'log_stringlevel', 'case_insensitive_strncmp', 'strlen']

62 62 getLogLevel call site: 00017 /src/tpm2-tss/src/util/log.c:251
40 40 2 :

['fflush', 'getLogFile']

40 40 doLog call site: 00016 /src/tpm2-tss/src/util/log.c:214
8 8 1 :

['tcti_type_from_name']

16 16 get_test_opts_from_env call site: 00002 /src/tpm2-tss/test/integration/sys-test-options.c:130
4 4 2 :

['strerror', '__errno_location']

4 4 tcti_fuzzing_init call site: 00058 /src/tpm2-tss/test/integration/sys-context-util.c:160
2 2 1 :

['strtol']

2 2 get_test_opts_from_env call site: 00008 /src/tpm2-tss/test/integration/sys-test-options.c:139
0 0 None 76 154 CommonComplete call site: 00083 /src/tpm2-tss/src/tss2-sys/sysapi_util.c:114
0 0 None 6 6 get_test_opts_from_env call site: 00006 /src/tpm2-tss/test/integration/sys-test-options.c:133
0 0 None 4 4 get_test_opts_from_env call site: 00007 /src/tpm2-tss/test/integration/sys-test-options.c:136
0 0 None 0 174 Tss2_Sys_ContextLoad_Complete call site: 00079 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_ContextLoad.c:49
0 0 None 0 67 Tss2_Sys_Initialize call site: 00068 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_Initialize.c:38
0 0 None 0 67 Tss2_Sys_Initialize call site: 00068 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_Initialize.c:44

Runtime coverage analysis

Covered functions
28
Functions that are reachable but not covered
30
Reachable functions
58
Percentage of reachable functions covered
48.28%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
test/fuzz/main-sys.c 1
test/integration/sys-test-options.c 3
src/util/log.c 5
test/integration/sys-context-util.c 7
test/fuzz/tcti/tcti-fuzzing.c 10
src/tss2-tcti/tcti-common.c 2
src/tss2-sys/api/Tss2_Sys_GetContextSize.c 1
src/tss2-sys/api/Tss2_Sys_Initialize.c 1
./src/tss2-sys/sysapi_util.h 2
src/tss2-sys/sysapi_util.c 3
test/fuzz/Tss2_Sys_ContextLoad_Complete.fuzz.c 1
src/tss2-sys/api/Tss2_Sys_ContextLoad.c 1
src/tss2-mu/base-types.c 2
/usr/include/x86_64-linux-gnu/bits/byteswap.h 2
src/tss2-sys/api/Tss2_Sys_GetTctiContext.c 1
src/tss2-sys/api/Tss2_Sys_Finalize.c 1

Fuzzer: Tss2_Sys_NV_Increment_Complete

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 55 56.7%
gold [1:9] 41 42.2%
yellow [10:29] 0 0.0%
greenyellow [30:49] 0 0.0%
lawngreen 50+ 1 1.03%
All colors 97 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
152 152 2 :

['Tss2_MU_UINT32_Unmarshal', 'Tss2_MU_TPM2_ST_Unmarshal']

152 152 CommonComplete call site: 00082 /src/tpm2-tss/src/tss2-sys/sysapi_util.c:123
8 8 1 :

['tcti_type_from_name']

16 16 get_test_opts_from_env call site: 00002 /src/tpm2-tss/test/integration/sys-test-options.c:130
4 4 2 :

['strerror', '__errno_location']

4 4 tcti_fuzzing_init call site: 00058 /src/tpm2-tss/test/integration/sys-context-util.c:160
2 2 1 :

['strtol']

2 2 get_test_opts_from_env call site: 00008 /src/tpm2-tss/test/integration/sys-test-options.c:139
0 0 None 152 154 CommonComplete call site: 00080 /src/tpm2-tss/src/tss2-sys/sysapi_util.c:114
0 0 None 63 67 Tss2_Sys_Initialize call site: 00068 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_Initialize.c:38
0 0 None 63 67 Tss2_Sys_Initialize call site: 00068 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_Initialize.c:44
0 0 None 6 6 get_test_opts_from_env call site: 00006 /src/tpm2-tss/test/integration/sys-test-options.c:133
0 0 None 4 4 get_test_opts_from_env call site: 00007 /src/tpm2-tss/test/integration/sys-test-options.c:136
0 0 None 0 98 Tss2_Sys_NV_Increment_Complete call site: 00079 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_NV_Increment.c:54
0 0 None 0 0 Tss2_Sys_GetContextSize call site: 00064 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_GetContextSize.c:17
0 0 None 0 0 Tss2_Sys_GetTctiContext call site: 00091 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_GetTctiContext.c:21

Runtime coverage analysis

Covered functions
25
Functions that are reachable but not covered
33
Reachable functions
58
Percentage of reachable functions covered
43.1%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
test/fuzz/main-sys.c 1
test/integration/sys-test-options.c 3
src/util/log.c 5
test/integration/sys-context-util.c 7
test/fuzz/tcti/tcti-fuzzing.c 10
src/tss2-tcti/tcti-common.c 2
src/tss2-sys/api/Tss2_Sys_GetContextSize.c 1
src/tss2-sys/api/Tss2_Sys_Initialize.c 1
./src/tss2-sys/sysapi_util.h 2
src/tss2-sys/sysapi_util.c 3
test/fuzz/Tss2_Sys_NV_Increment_Complete.fuzz.c 1
src/tss2-sys/api/Tss2_Sys_NV_Increment.c 1
/usr/include/x86_64-linux-gnu/bits/byteswap.h 2
src/tss2-mu/base-types.c 2
src/tss2-sys/api/Tss2_Sys_GetTctiContext.c 1
src/tss2-sys/api/Tss2_Sys_Finalize.c 1

Fuzzer: Tss2_Sys_RSA_Encrypt_Prepare

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 58 44.9%
gold [1:9] 6 4.65%
yellow [10:29] 8 6.20%
greenyellow [30:49] 1 0.77%
lawngreen 50+ 56 43.4%
All colors 129 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
62 62 4 :

['strchr', 'log_stringlevel', 'case_insensitive_strncmp', 'strlen']

62 62 getLogLevel call site: 00017 /src/tpm2-tss/src/util/log.c:251
8 8 1 :

['tcti_type_from_name']

16 16 get_test_opts_from_env call site: 00002 /src/tpm2-tss/test/integration/sys-test-options.c:130
4 4 2 :

['strerror', '__errno_location']

4 4 tcti_fuzzing_init call site: 00058 /src/tpm2-tss/test/integration/sys-context-util.c:160
2 2 1 :

['strtol']

2 2 get_test_opts_from_env call site: 00008 /src/tpm2-tss/test/integration/sys-test-options.c:139
0 0 None 6 6 get_test_opts_from_env call site: 00006 /src/tpm2-tss/test/integration/sys-test-options.c:133
0 0 None 4 4 get_test_opts_from_env call site: 00007 /src/tpm2-tss/test/integration/sys-test-options.c:136
0 0 None 0 609 Tss2_Sys_RSA_Encrypt_Prepare call site: 00082 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_RSA_Encrypt.c:25
0 0 None 0 359 Tss2_Sys_RSA_Encrypt_Prepare call site: 00096 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_RSA_Encrypt.c:38
0 0 None 0 103 CommonPreparePrologue call site: 00083 /src/tpm2-tss/src/tss2-sys/sysapi_util.c:72
0 0 None 0 95 Tss2_Sys_RSA_Encrypt_Prepare call site: 00105 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_RSA_Encrypt.c:60
0 0 None 0 77 CopyCommandHeader call site: 00085 /src/tpm2-tss/src/tss2-sys/sysapi_util.c:46
0 0 None 0 67 Tss2_Sys_Initialize call site: 00068 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_Initialize.c:38

Runtime coverage analysis

Covered functions
44
Functions that are reachable but not covered
28
Reachable functions
72
Percentage of reachable functions covered
61.11%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
test/fuzz/main-sys.c 1
test/integration/sys-test-options.c 3
src/util/log.c 5
test/integration/sys-context-util.c 7
test/fuzz/tcti/tcti-fuzzing.c 11
src/tss2-tcti/tcti-common.c 2
src/tss2-sys/api/Tss2_Sys_GetContextSize.c 1
src/tss2-sys/api/Tss2_Sys_Initialize.c 1
./src/tss2-sys/sysapi_util.h 2
src/tss2-sys/sysapi_util.c 8
test/fuzz/Tss2_Sys_RSA_Encrypt_Prepare.fuzz.c 1
src/tss2-sys/api/Tss2_Sys_RSA_Encrypt.c 1
src/tss2-mu/base-types.c 3
/usr/include/x86_64-linux-gnu/bits/byteswap.h 2
src/tss2-mu/tpm2b-types.c 2
src/tss2-mu/tpmt-types.c 1
src/tss2-mu/tpmu-types.c 2
src/tss2-mu/tpms-types.c 1
src/tss2-sys/api/Tss2_Sys_GetTctiContext.c 1
src/tss2-sys/api/Tss2_Sys_Finalize.c 1

Fuzzer: Tss2_Sys_IncrementalSelfTest_Complete

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 58 57.9%
gold [1:9] 41 41.0%
yellow [10:29] 0 0.0%
greenyellow [30:49] 0 0.0%
lawngreen 50+ 1 1.0%
All colors 100 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
152 152 2 :

['Tss2_MU_UINT32_Unmarshal', 'Tss2_MU_TPM2_ST_Unmarshal']

152 152 CommonComplete call site: 00082 /src/tpm2-tss/src/tss2-sys/sysapi_util.c:123
104 104 1 :

['Tss2_MU_TPML_ALG_Unmarshal']

104 104 Tss2_Sys_IncrementalSelfTest_Complete call site: 00080 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_IncrementalSelfTest.c:53
8 8 1 :

['tcti_type_from_name']

16 16 get_test_opts_from_env call site: 00002 /src/tpm2-tss/test/integration/sys-test-options.c:130
4 4 2 :

['strerror', '__errno_location']

4 4 tcti_fuzzing_init call site: 00058 /src/tpm2-tss/test/integration/sys-context-util.c:160
2 2 1 :

['strtol']

2 2 get_test_opts_from_env call site: 00008 /src/tpm2-tss/test/integration/sys-test-options.c:139
0 0 None 152 154 CommonComplete call site: 00080 /src/tpm2-tss/src/tss2-sys/sysapi_util.c:114
0 0 None 104 202 Tss2_Sys_IncrementalSelfTest_Complete call site: 00079 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_IncrementalSelfTest.c:49
0 0 None 63 67 Tss2_Sys_Initialize call site: 00068 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_Initialize.c:38
0 0 None 63 67 Tss2_Sys_Initialize call site: 00068 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_Initialize.c:44
0 0 None 6 6 get_test_opts_from_env call site: 00006 /src/tpm2-tss/test/integration/sys-test-options.c:133
0 0 None 4 4 get_test_opts_from_env call site: 00007 /src/tpm2-tss/test/integration/sys-test-options.c:136
0 0 None 0 0 Tss2_Sys_GetContextSize call site: 00064 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_GetContextSize.c:17

Runtime coverage analysis

Covered functions
25
Functions that are reachable but not covered
35
Reachable functions
60
Percentage of reachable functions covered
41.67%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
test/fuzz/main-sys.c 1
test/integration/sys-test-options.c 3
src/util/log.c 5
test/integration/sys-context-util.c 7
test/fuzz/tcti/tcti-fuzzing.c 10
src/tss2-tcti/tcti-common.c 2
src/tss2-sys/api/Tss2_Sys_GetContextSize.c 1
src/tss2-sys/api/Tss2_Sys_Initialize.c 1
./src/tss2-sys/sysapi_util.h 2
src/tss2-sys/sysapi_util.c 3
test/fuzz/Tss2_Sys_IncrementalSelfTest_Complete.fuzz.c 1
src/tss2-sys/api/Tss2_Sys_IncrementalSelfTest.c 1
/usr/include/x86_64-linux-gnu/bits/byteswap.h 2
src/tss2-mu/base-types.c 2
src/tss2-mu/tpml-types.c 1
src/tss2-sys/api/Tss2_Sys_GetTctiContext.c 1
src/tss2-sys/api/Tss2_Sys_Finalize.c 1

Fuzzer: Tss2_Sys_PolicyAuthorizeNV_Complete

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 55 56.7%
gold [1:9] 41 42.2%
yellow [10:29] 0 0.0%
greenyellow [30:49] 0 0.0%
lawngreen 50+ 1 1.03%
All colors 97 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
152 152 2 :

['Tss2_MU_UINT32_Unmarshal', 'Tss2_MU_TPM2_ST_Unmarshal']

152 152 CommonComplete call site: 00082 /src/tpm2-tss/src/tss2-sys/sysapi_util.c:123
8 8 1 :

['tcti_type_from_name']

16 16 get_test_opts_from_env call site: 00002 /src/tpm2-tss/test/integration/sys-test-options.c:130
4 4 2 :

['strerror', '__errno_location']

4 4 tcti_fuzzing_init call site: 00058 /src/tpm2-tss/test/integration/sys-context-util.c:160
2 2 1 :

['strtol']

2 2 get_test_opts_from_env call site: 00008 /src/tpm2-tss/test/integration/sys-test-options.c:139
0 0 None 152 154 CommonComplete call site: 00080 /src/tpm2-tss/src/tss2-sys/sysapi_util.c:114
0 0 None 63 67 Tss2_Sys_Initialize call site: 00068 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_Initialize.c:38
0 0 None 63 67 Tss2_Sys_Initialize call site: 00068 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_Initialize.c:44
0 0 None 6 6 get_test_opts_from_env call site: 00006 /src/tpm2-tss/test/integration/sys-test-options.c:133
0 0 None 4 4 get_test_opts_from_env call site: 00007 /src/tpm2-tss/test/integration/sys-test-options.c:136
0 0 None 0 98 Tss2_Sys_PolicyAuthorizeNV_Complete call site: 00079 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_PolicyAuthorizeNV.c:61
0 0 None 0 0 Tss2_Sys_GetContextSize call site: 00064 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_GetContextSize.c:17
0 0 None 0 0 Tss2_Sys_GetTctiContext call site: 00091 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_GetTctiContext.c:21

Runtime coverage analysis

Covered functions
25
Functions that are reachable but not covered
33
Reachable functions
58
Percentage of reachable functions covered
43.1%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
test/fuzz/main-sys.c 1
test/integration/sys-test-options.c 3
src/util/log.c 5
test/integration/sys-context-util.c 7
test/fuzz/tcti/tcti-fuzzing.c 10
src/tss2-tcti/tcti-common.c 2
src/tss2-sys/api/Tss2_Sys_GetContextSize.c 1
src/tss2-sys/api/Tss2_Sys_Initialize.c 1
./src/tss2-sys/sysapi_util.h 2
src/tss2-sys/sysapi_util.c 3
test/fuzz/Tss2_Sys_PolicyAuthorizeNV_Complete.fuzz.c 1
src/tss2-sys/api/Tss2_Sys_PolicyAuthorizeNV.c 1
/usr/include/x86_64-linux-gnu/bits/byteswap.h 2
src/tss2-mu/base-types.c 2
src/tss2-sys/api/Tss2_Sys_GetTctiContext.c 1
src/tss2-sys/api/Tss2_Sys_Finalize.c 1

Fuzzer: Tss2_Sys_NV_UndefineSpaceSpecial_Complete

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 55 56.7%
gold [1:9] 41 42.2%
yellow [10:29] 0 0.0%
greenyellow [30:49] 0 0.0%
lawngreen 50+ 1 1.03%
All colors 97 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
152 152 2 :

['Tss2_MU_UINT32_Unmarshal', 'Tss2_MU_TPM2_ST_Unmarshal']

152 152 CommonComplete call site: 00082 /src/tpm2-tss/src/tss2-sys/sysapi_util.c:123
8 8 1 :

['tcti_type_from_name']

16 16 get_test_opts_from_env call site: 00002 /src/tpm2-tss/test/integration/sys-test-options.c:130
4 4 2 :

['strerror', '__errno_location']

4 4 tcti_fuzzing_init call site: 00058 /src/tpm2-tss/test/integration/sys-context-util.c:160
2 2 1 :

['strtol']

2 2 get_test_opts_from_env call site: 00008 /src/tpm2-tss/test/integration/sys-test-options.c:139
0 0 None 152 154 CommonComplete call site: 00080 /src/tpm2-tss/src/tss2-sys/sysapi_util.c:114
0 0 None 63 67 Tss2_Sys_Initialize call site: 00068 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_Initialize.c:38
0 0 None 63 67 Tss2_Sys_Initialize call site: 00068 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_Initialize.c:44
0 0 None 6 6 get_test_opts_from_env call site: 00006 /src/tpm2-tss/test/integration/sys-test-options.c:133
0 0 None 4 4 get_test_opts_from_env call site: 00007 /src/tpm2-tss/test/integration/sys-test-options.c:136
0 0 None 0 98 Tss2_Sys_NV_UndefineSpaceSpecial_Complete call site: 00079 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_NV_UndefineSpaceSpecial.c:54
0 0 None 0 0 Tss2_Sys_GetContextSize call site: 00064 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_GetContextSize.c:17
0 0 None 0 0 Tss2_Sys_GetTctiContext call site: 00091 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_GetTctiContext.c:21

Runtime coverage analysis

Covered functions
25
Functions that are reachable but not covered
33
Reachable functions
58
Percentage of reachable functions covered
43.1%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
test/fuzz/main-sys.c 1
test/integration/sys-test-options.c 3
src/util/log.c 5
test/integration/sys-context-util.c 7
test/fuzz/tcti/tcti-fuzzing.c 10
src/tss2-tcti/tcti-common.c 2
src/tss2-sys/api/Tss2_Sys_GetContextSize.c 1
src/tss2-sys/api/Tss2_Sys_Initialize.c 1
./src/tss2-sys/sysapi_util.h 2
src/tss2-sys/sysapi_util.c 3
test/fuzz/Tss2_Sys_NV_UndefineSpaceSpecial_Complete.fuzz.c 1
src/tss2-sys/api/Tss2_Sys_NV_UndefineSpaceSpecial.c 1
/usr/include/x86_64-linux-gnu/bits/byteswap.h 2
src/tss2-mu/base-types.c 2
src/tss2-sys/api/Tss2_Sys_GetTctiContext.c 1
src/tss2-sys/api/Tss2_Sys_Finalize.c 1

Fuzzer: Tss2_Sys_NV_SetBits_Complete

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 55 56.7%
gold [1:9] 41 42.2%
yellow [10:29] 0 0.0%
greenyellow [30:49] 0 0.0%
lawngreen 50+ 1 1.03%
All colors 97 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
152 152 2 :

['Tss2_MU_UINT32_Unmarshal', 'Tss2_MU_TPM2_ST_Unmarshal']

152 152 CommonComplete call site: 00082 /src/tpm2-tss/src/tss2-sys/sysapi_util.c:123
8 8 1 :

['tcti_type_from_name']

16 16 get_test_opts_from_env call site: 00002 /src/tpm2-tss/test/integration/sys-test-options.c:130
4 4 2 :

['strerror', '__errno_location']

4 4 tcti_fuzzing_init call site: 00058 /src/tpm2-tss/test/integration/sys-context-util.c:160
2 2 1 :

['strtol']

2 2 get_test_opts_from_env call site: 00008 /src/tpm2-tss/test/integration/sys-test-options.c:139
0 0 None 152 154 CommonComplete call site: 00080 /src/tpm2-tss/src/tss2-sys/sysapi_util.c:114
0 0 None 63 67 Tss2_Sys_Initialize call site: 00068 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_Initialize.c:38
0 0 None 63 67 Tss2_Sys_Initialize call site: 00068 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_Initialize.c:44
0 0 None 6 6 get_test_opts_from_env call site: 00006 /src/tpm2-tss/test/integration/sys-test-options.c:133
0 0 None 4 4 get_test_opts_from_env call site: 00007 /src/tpm2-tss/test/integration/sys-test-options.c:136
0 0 None 0 98 Tss2_Sys_NV_SetBits_Complete call site: 00079 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_NV_SetBits.c:61
0 0 None 0 0 Tss2_Sys_GetContextSize call site: 00064 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_GetContextSize.c:17
0 0 None 0 0 Tss2_Sys_GetTctiContext call site: 00091 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_GetTctiContext.c:21

Runtime coverage analysis

Covered functions
25
Functions that are reachable but not covered
33
Reachable functions
58
Percentage of reachable functions covered
43.1%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
test/fuzz/main-sys.c 1
test/integration/sys-test-options.c 3
src/util/log.c 5
test/integration/sys-context-util.c 7
test/fuzz/tcti/tcti-fuzzing.c 10
src/tss2-tcti/tcti-common.c 2
src/tss2-sys/api/Tss2_Sys_GetContextSize.c 1
src/tss2-sys/api/Tss2_Sys_Initialize.c 1
./src/tss2-sys/sysapi_util.h 2
src/tss2-sys/sysapi_util.c 3
test/fuzz/Tss2_Sys_NV_SetBits_Complete.fuzz.c 1
src/tss2-sys/api/Tss2_Sys_NV_SetBits.c 1
/usr/include/x86_64-linux-gnu/bits/byteswap.h 2
src/tss2-mu/base-types.c 2
src/tss2-sys/api/Tss2_Sys_GetTctiContext.c 1
src/tss2-sys/api/Tss2_Sys_Finalize.c 1

Fuzzer: Tss2_Sys_MAC_Start_Prepare

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 47 41.2%
gold [1:9] 6 5.26%
yellow [10:29] 5 4.38%
greenyellow [30:49] 1 0.87%
lawngreen 50+ 55 48.2%
All colors 114 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
62 62 4 :

['strchr', 'log_stringlevel', 'case_insensitive_strncmp', 'strlen']

62 62 getLogLevel call site: 00017 /src/tpm2-tss/src/util/log.c:251
8 8 1 :

['tcti_type_from_name']

16 16 get_test_opts_from_env call site: 00002 /src/tpm2-tss/test/integration/sys-test-options.c:130
4 4 2 :

['strerror', '__errno_location']

4 4 tcti_fuzzing_init call site: 00058 /src/tpm2-tss/test/integration/sys-context-util.c:160
2 2 1 :

['strtol']

2 2 get_test_opts_from_env call site: 00008 /src/tpm2-tss/test/integration/sys-test-options.c:139
0 0 None 6 6 get_test_opts_from_env call site: 00006 /src/tpm2-tss/test/integration/sys-test-options.c:133
0 0 None 4 4 get_test_opts_from_env call site: 00007 /src/tpm2-tss/test/integration/sys-test-options.c:136
0 0 None 0 420 Tss2_Sys_MAC_Start_Prepare call site: 00082 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_MAC_Start.c:24
0 0 None 0 170 Tss2_Sys_MAC_Start_Prepare call site: 00096 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_MAC_Start.c:40
0 0 None 0 77 CopyCommandHeader call site: 00085 /src/tpm2-tss/src/tss2-sys/sysapi_util.c:46
0 0 None 0 67 Tss2_Sys_Initialize call site: 00068 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_Initialize.c:38
0 0 None 0 67 Tss2_Sys_Initialize call site: 00068 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_Initialize.c:44
0 0 None 0 0 Tss2_Sys_GetContextSize call site: 00064 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_GetContextSize.c:17

Runtime coverage analysis

Covered functions
38
Functions that are reachable but not covered
28
Reachable functions
66
Percentage of reachable functions covered
57.58%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
test/fuzz/main-sys.c 1
test/integration/sys-test-options.c 3
src/util/log.c 5
test/integration/sys-context-util.c 7
test/fuzz/tcti/tcti-fuzzing.c 11
src/tss2-tcti/tcti-common.c 2
src/tss2-sys/api/Tss2_Sys_GetContextSize.c 1
src/tss2-sys/api/Tss2_Sys_Initialize.c 1
./src/tss2-sys/sysapi_util.h 2
src/tss2-sys/sysapi_util.c 7
test/fuzz/Tss2_Sys_MAC_Start_Prepare.fuzz.c 1
src/tss2-sys/api/Tss2_Sys_MAC_Start.c 1
src/tss2-mu/base-types.c 3
/usr/include/x86_64-linux-gnu/bits/byteswap.h 2
src/tss2-mu/tpm2b-types.c 1
src/tss2-sys/api/Tss2_Sys_GetTctiContext.c 1
src/tss2-sys/api/Tss2_Sys_Finalize.c 1

Fuzzer: Tss2_Sys_GetSessionAuditDigest_Complete

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 85 66.9%
gold [1:9] 41 32.2%
yellow [10:29] 0 0.0%
greenyellow [30:49] 0 0.0%
lawngreen 50+ 1 0.78%
All colors 127 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
284 284 2 :

['Tss2_MU_TPM2B_ATTEST_Unmarshal', 'Tss2_MU_TPMT_SIGNATURE_Unmarshal']

284 284 Tss2_Sys_GetSessionAuditDigest_Complete call site: 00080 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_GetSessionAuditDigest.c:92
152 152 2 :

['Tss2_MU_UINT32_Unmarshal', 'Tss2_MU_TPM2_ST_Unmarshal']

152 152 CommonComplete call site: 00082 /src/tpm2-tss/src/tss2-sys/sysapi_util.c:123
8 8 1 :

['tcti_type_from_name']

16 16 get_test_opts_from_env call site: 00002 /src/tpm2-tss/test/integration/sys-test-options.c:130
4 4 2 :

['strerror', '__errno_location']

4 4 tcti_fuzzing_init call site: 00058 /src/tpm2-tss/test/integration/sys-context-util.c:160
2 2 1 :

['strtol']

2 2 get_test_opts_from_env call site: 00008 /src/tpm2-tss/test/integration/sys-test-options.c:139
0 0 None 284 382 Tss2_Sys_GetSessionAuditDigest_Complete call site: 00079 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_GetSessionAuditDigest.c:88
0 0 None 152 154 CommonComplete call site: 00080 /src/tpm2-tss/src/tss2-sys/sysapi_util.c:114
0 0 None 63 67 Tss2_Sys_Initialize call site: 00068 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_Initialize.c:38
0 0 None 63 67 Tss2_Sys_Initialize call site: 00068 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_Initialize.c:44
0 0 None 6 6 get_test_opts_from_env call site: 00006 /src/tpm2-tss/test/integration/sys-test-options.c:133
0 0 None 4 4 get_test_opts_from_env call site: 00007 /src/tpm2-tss/test/integration/sys-test-options.c:136
0 0 None 0 0 Tss2_Sys_GetContextSize call site: 00064 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_GetContextSize.c:17

Runtime coverage analysis

Covered functions
25
Functions that are reachable but not covered
50
Reachable functions
75
Percentage of reachable functions covered
33.33%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
test/fuzz/main-sys.c 1
test/integration/sys-test-options.c 3
src/util/log.c 5
test/integration/sys-context-util.c 7
test/fuzz/tcti/tcti-fuzzing.c 10
src/tss2-tcti/tcti-common.c 2
src/tss2-sys/api/Tss2_Sys_GetContextSize.c 1
src/tss2-sys/api/Tss2_Sys_Initialize.c 1
./src/tss2-sys/sysapi_util.h 2
src/tss2-sys/sysapi_util.c 3
test/fuzz/Tss2_Sys_GetSessionAuditDigest_Complete.fuzz.c 1
src/tss2-sys/api/Tss2_Sys_GetSessionAuditDigest.c 1
/usr/include/x86_64-linux-gnu/bits/byteswap.h 2
src/tss2-mu/base-types.c 3
src/tss2-mu/tpm2b-types.c 2
src/tss2-mu/tpmt-types.c 2
src/tss2-mu/tpmu-types.c 5
src/tss2-mu/tpms-types.c 1
src/tss2-sys/api/Tss2_Sys_GetTctiContext.c 1
src/tss2-sys/api/Tss2_Sys_Finalize.c 1

Fuzzer: Tss2_Sys_NV_ChangeAuth_Complete

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 49 55.6%
gold [1:9] 38 43.1%
yellow [10:29] 0 0.0%
greenyellow [30:49] 0 0.0%
lawngreen 50+ 1 1.13%
All colors 88 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
152 152 2 :

['Tss2_MU_UINT32_Unmarshal', 'Tss2_MU_TPM2_ST_Unmarshal']

152 152 CommonComplete call site: 00000 /src/tpm2-tss/src/tss2-sys/sysapi_util.c:123
8 8 1 :

['tcti_type_from_name']

16 16 get_test_opts_from_env call site: 00002 /src/tpm2-tss/test/integration/sys-test-options.c:130
4 4 2 :

['strerror', '__errno_location']

4 4 tcti_fuzzing_init call site: 00058 /src/tpm2-tss/test/integration/sys-context-util.c:160
2 2 1 :

['strtol']

2 2 get_test_opts_from_env call site: 00008 /src/tpm2-tss/test/integration/sys-test-options.c:139
0 0 None 152 154 CommonComplete call site: 00000 /src/tpm2-tss/src/tss2-sys/sysapi_util.c:114
0 0 None 63 67 Tss2_Sys_Initialize call site: 00068 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_Initialize.c:38
0 0 None 63 67 Tss2_Sys_Initialize call site: 00068 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_Initialize.c:44
0 0 None 6 6 get_test_opts_from_env call site: 00006 /src/tpm2-tss/test/integration/sys-test-options.c:133
0 0 None 4 4 get_test_opts_from_env call site: 00007 /src/tpm2-tss/test/integration/sys-test-options.c:136
0 0 None 0 98 Tss2_Sys_NV_ChangeAuth_Complete call site: 00079 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_NV_ChangeAuth.c:63
0 0 None 0 0 Tss2_Sys_GetContextSize call site: 00064 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_GetContextSize.c:17
0 0 None 0 0 Tss2_Sys_GetTctiContext call site: 00082 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_GetTctiContext.c:21

Runtime coverage analysis

Covered functions
25
Functions that are reachable but not covered
33
Reachable functions
58
Percentage of reachable functions covered
43.1%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
test/fuzz/main-sys.c 1
test/integration/sys-test-options.c 3
src/util/log.c 5
test/integration/sys-context-util.c 7
test/fuzz/tcti/tcti-fuzzing.c 10
src/tss2-tcti/tcti-common.c 2
src/tss2-sys/api/Tss2_Sys_GetContextSize.c 1
src/tss2-sys/api/Tss2_Sys_Initialize.c 1
./src/tss2-sys/sysapi_util.h 1
src/tss2-sys/sysapi_util.c 2
test/fuzz/Tss2_Sys_NV_ChangeAuth_Complete.fuzz.c 1
src/tss2-sys/api/Tss2_Sys_NV_ChangeAuth.c 1
src/tss2-sys/api/Tss2_Sys_GetTctiContext.c 1
src/tss2-sys/api/Tss2_Sys_Finalize.c 1

Fuzzer: Tss2_Sys_PolicyCommandCode_Complete

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 55 56.7%
gold [1:9] 41 42.2%
yellow [10:29] 0 0.0%
greenyellow [30:49] 0 0.0%
lawngreen 50+ 1 1.03%
All colors 97 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
152 152 2 :

['Tss2_MU_UINT32_Unmarshal', 'Tss2_MU_TPM2_ST_Unmarshal']

152 152 CommonComplete call site: 00082 /src/tpm2-tss/src/tss2-sys/sysapi_util.c:123
8 8 1 :

['tcti_type_from_name']

16 16 get_test_opts_from_env call site: 00002 /src/tpm2-tss/test/integration/sys-test-options.c:130
4 4 2 :

['strerror', '__errno_location']

4 4 tcti_fuzzing_init call site: 00058 /src/tpm2-tss/test/integration/sys-context-util.c:160
2 2 1 :

['strtol']

2 2 get_test_opts_from_env call site: 00008 /src/tpm2-tss/test/integration/sys-test-options.c:139
0 0 None 152 154 CommonComplete call site: 00080 /src/tpm2-tss/src/tss2-sys/sysapi_util.c:114
0 0 None 63 67 Tss2_Sys_Initialize call site: 00068 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_Initialize.c:38
0 0 None 63 67 Tss2_Sys_Initialize call site: 00068 /src/tpm2-tss/src/tss2-sys/api/Tss2_Sys_Initialize.c:44
0 0 None 6 6 get_test_opts_from_env call site: 00006 /src/tpm2-tss/test/integration/sys-test-options.c:133
0 0 None 4 4 get_test_opts_from_env