High level conclusions

Fuzzers reach 60.19% of cyclomatic complexity.

Fuzzers reach 55.87% of all functions.

Fuzzer Tss2_Sys_Import_Complete is blocked:

The runtime code coverage of Tss2_Sys_Import_Complete covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_SelfTest_Complete is blocked:

The runtime code coverage of Tss2_Sys_SelfTest_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_Hash_Complete is blocked:

The runtime code coverage of Tss2_Sys_Hash_Complete covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PolicyTemplate_Prepare is blocked:

The runtime code coverage of Tss2_Sys_PolicyTemplate_Prepare covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_ACT_SetTimeout_Prepare is blocked:

The runtime code coverage of Tss2_Sys_ACT_SetTimeout_Prepare covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_ChangePPS_Complete is blocked:

The runtime code coverage of Tss2_Sys_ChangePPS_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_ECDH_ZGen_Prepare is blocked:

The runtime code coverage of Tss2_Sys_ECDH_ZGen_Prepare covers 2.890% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PolicySigned_Prepare is blocked:

The runtime code coverage of Tss2_Sys_PolicySigned_Prepare covers 2.824% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_ActivateCredential_Prepare is blocked:

The runtime code coverage of Tss2_Sys_ActivateCredential_Prepare covers 2.906% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PCR_Extend_Complete is blocked:

The runtime code coverage of Tss2_Sys_PCR_Extend_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PolicyCommandCode_Complete is blocked:

The runtime code coverage of Tss2_Sys_PolicyCommandCode_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_EvictControl_Complete is blocked:

The runtime code coverage of Tss2_Sys_EvictControl_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_GetTime_Complete is blocked:

The runtime code coverage of Tss2_Sys_GetTime_Complete covers 2.840% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PP_Commands_Prepare is blocked:

The runtime code coverage of Tss2_Sys_PP_Commands_Prepare covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PolicyAuthorizeNV_Prepare is blocked:

The runtime code coverage of Tss2_Sys_PolicyAuthorizeNV_Prepare covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PolicyNameHash_Complete is blocked:

The runtime code coverage of Tss2_Sys_PolicyNameHash_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_AC_GetCapability_Complete is blocked:

The runtime code coverage of Tss2_Sys_AC_GetCapability_Complete covers 2.923% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PolicyCpHash_Complete is blocked:

The runtime code coverage of Tss2_Sys_PolicyCpHash_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_NV_Certify_Complete is blocked:

The runtime code coverage of Tss2_Sys_NV_Certify_Complete covers 2.840% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_NV_Increment_Prepare is blocked:

The runtime code coverage of Tss2_Sys_NV_Increment_Prepare covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_GetCapability_Complete is blocked:

The runtime code coverage of Tss2_Sys_GetCapability_Complete covers 2.976% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_Load_Complete is blocked:

The runtime code coverage of Tss2_Sys_Load_Complete covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PP_Commands_Complete is blocked:

The runtime code coverage of Tss2_Sys_PP_Commands_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_SetPrimaryPolicy_Prepare is blocked:

The runtime code coverage of Tss2_Sys_SetPrimaryPolicy_Prepare covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PCR_SetAuthValue_Complete is blocked:

The runtime code coverage of Tss2_Sys_PCR_SetAuthValue_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PolicyLocality_Complete is blocked:

The runtime code coverage of Tss2_Sys_PolicyLocality_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PCR_Allocate_Prepare is blocked:

The runtime code coverage of Tss2_Sys_PCR_Allocate_Prepare covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PCR_Reset_Complete is blocked:

The runtime code coverage of Tss2_Sys_PCR_Reset_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_GetSessionAuditDigest_Prepare is blocked:

The runtime code coverage of Tss2_Sys_GetSessionAuditDigest_Prepare covers 2.857% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_FieldUpgradeStart_Complete is blocked:

The runtime code coverage of Tss2_Sys_FieldUpgradeStart_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PolicyOR_Prepare is blocked:

The runtime code coverage of Tss2_Sys_PolicyOR_Prepare covers 2.923% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_DictionaryAttackParameters_Prepare is blocked:

The runtime code coverage of Tss2_Sys_DictionaryAttackParameters_Prepare covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PCR_Read_Complete is blocked:

The runtime code coverage of Tss2_Sys_PCR_Read_Complete covers 2.976% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PolicyAuthValue_Complete is blocked:

The runtime code coverage of Tss2_Sys_PolicyAuthValue_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_SequenceUpdate_Prepare is blocked:

The runtime code coverage of Tss2_Sys_SequenceUpdate_Prepare covers 2.923% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_Create_Prepare is blocked:

The runtime code coverage of Tss2_Sys_Create_Prepare covers 2.512% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_NV_ChangeAuth_Prepare is blocked:

The runtime code coverage of Tss2_Sys_NV_ChangeAuth_Prepare covers 2.923% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_MakeCredential_Prepare is blocked:

The runtime code coverage of Tss2_Sys_MakeCredential_Prepare covers 2.923% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_Duplicate_Prepare is blocked:

The runtime code coverage of Tss2_Sys_Duplicate_Prepare covers 2.873% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PolicyRestart_Complete is blocked:

The runtime code coverage of Tss2_Sys_PolicyRestart_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_MAC_Start_Prepare is blocked:

The runtime code coverage of Tss2_Sys_MAC_Start_Prepare covers 2.923% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_ActivateCredential_Complete is blocked:

The runtime code coverage of Tss2_Sys_ActivateCredential_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_ZGen_2Phase_Complete is blocked:

The runtime code coverage of Tss2_Sys_ZGen_2Phase_Complete covers 2.906% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_ZGen_2Phase_Prepare is blocked:

The runtime code coverage of Tss2_Sys_ZGen_2Phase_Prepare covers 2.890% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_ObjectChangeAuth_Prepare is blocked:

The runtime code coverage of Tss2_Sys_ObjectChangeAuth_Prepare covers 2.923% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_Create_Complete is blocked:

The runtime code coverage of Tss2_Sys_Create_Complete covers 2.487% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PolicyCounterTimer_Prepare is blocked:

The runtime code coverage of Tss2_Sys_PolicyCounterTimer_Prepare covers 2.923% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_ClockSet_Complete is blocked:

The runtime code coverage of Tss2_Sys_ClockSet_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_Unseal_Complete is blocked:

The runtime code coverage of Tss2_Sys_Unseal_Complete covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PolicyDuplicationSelect_Complete is blocked:

The runtime code coverage of Tss2_Sys_PolicyDuplicationSelect_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_CertifyX509_Prepare is blocked:

The runtime code coverage of Tss2_Sys_CertifyX509_Prepare covers 2.840% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PolicyLocality_Prepare is blocked:

The runtime code coverage of Tss2_Sys_PolicyLocality_Prepare covers 2.923% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PCR_Extend_Prepare is blocked:

The runtime code coverage of Tss2_Sys_PCR_Extend_Prepare covers 2.923% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_ContextSave_Complete is blocked:

The runtime code coverage of Tss2_Sys_ContextSave_Complete covers 2.890% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PolicySigned_Complete is blocked:

The runtime code coverage of Tss2_Sys_PolicySigned_Complete covers 2.923% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PolicyAuthValue_Prepare is blocked:

The runtime code coverage of Tss2_Sys_PolicyAuthValue_Prepare covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_IncrementalSelfTest_Complete is blocked:

The runtime code coverage of Tss2_Sys_IncrementalSelfTest_Complete covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_Clear_Complete is blocked:

The runtime code coverage of Tss2_Sys_Clear_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PolicyPhysicalPresence_Prepare is blocked:

The runtime code coverage of Tss2_Sys_PolicyPhysicalPresence_Prepare covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PolicySecret_Prepare is blocked:

The runtime code coverage of Tss2_Sys_PolicySecret_Prepare covers 2.923% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PCR_Event_Prepare is blocked:

The runtime code coverage of Tss2_Sys_PCR_Event_Prepare covers 2.923% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_EC_Ephemeral_Complete is blocked:

The runtime code coverage of Tss2_Sys_EC_Ephemeral_Complete covers 2.906% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_VerifySignature_Prepare is blocked:

The runtime code coverage of Tss2_Sys_VerifySignature_Prepare covers 2.840% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_CreateLoaded_Prepare is blocked:

The runtime code coverage of Tss2_Sys_CreateLoaded_Prepare covers 2.873% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PolicyCommandCode_Prepare is blocked:

The runtime code coverage of Tss2_Sys_PolicyCommandCode_Prepare covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_NV_ChangeAuth_Complete is blocked:

The runtime code coverage of Tss2_Sys_NV_ChangeAuth_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_FirmwareRead_Complete is blocked:

The runtime code coverage of Tss2_Sys_FirmwareRead_Complete covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_NV_Certify_Prepare is blocked:

The runtime code coverage of Tss2_Sys_NV_Certify_Prepare covers 2.857% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_FieldUpgradeData_Complete is blocked:

The runtime code coverage of Tss2_Sys_FieldUpgradeData_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_AC_Send_Prepare is blocked:

The runtime code coverage of Tss2_Sys_AC_Send_Prepare covers 2.923% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_LoadExternal_Complete is blocked:

The runtime code coverage of Tss2_Sys_LoadExternal_Complete covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_EncryptDecrypt2_Prepare is blocked:

The runtime code coverage of Tss2_Sys_EncryptDecrypt2_Prepare covers 2.906% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PolicyAuthorize_Complete is blocked:

The runtime code coverage of Tss2_Sys_PolicyAuthorize_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_RSA_Encrypt_Complete is blocked:

The runtime code coverage of Tss2_Sys_RSA_Encrypt_Complete covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_NV_Extend_Prepare is blocked:

The runtime code coverage of Tss2_Sys_NV_Extend_Prepare covers 2.923% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_GetRandom_Complete is blocked:

The runtime code coverage of Tss2_Sys_GetRandom_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PolicyNV_Prepare is blocked:

The runtime code coverage of Tss2_Sys_PolicyNV_Prepare covers 2.923% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_GetTime_Prepare is blocked:

The runtime code coverage of Tss2_Sys_GetTime_Prepare covers 2.857% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_ObjectChangeAuth_Complete is blocked:

The runtime code coverage of Tss2_Sys_ObjectChangeAuth_Complete covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_Load_Prepare is blocked:

The runtime code coverage of Tss2_Sys_Load_Prepare covers 2.551% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PolicyGetDigest_Complete is blocked:

The runtime code coverage of Tss2_Sys_PolicyGetDigest_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_AC_Send_Complete is blocked:

The runtime code coverage of Tss2_Sys_AC_Send_Complete covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PolicyTemplate_Complete is blocked:

The runtime code coverage of Tss2_Sys_PolicyTemplate_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_NV_ReadLock_Complete is blocked:

The runtime code coverage of Tss2_Sys_NV_ReadLock_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_NV_GlobalWriteLock_Prepare is blocked:

The runtime code coverage of Tss2_Sys_NV_GlobalWriteLock_Prepare covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_NV_UndefineSpace_Complete is blocked:

The runtime code coverage of Tss2_Sys_NV_UndefineSpace_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_StirRandom_Prepare is blocked:

The runtime code coverage of Tss2_Sys_StirRandom_Prepare covers 2.923% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_DictionaryAttackLockReset_Complete is blocked:

The runtime code coverage of Tss2_Sys_DictionaryAttackLockReset_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_ACT_SetTimeout_Complete is blocked:

The runtime code coverage of Tss2_Sys_ACT_SetTimeout_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_HashSequenceStart_Complete is blocked:

The runtime code coverage of Tss2_Sys_HashSequenceStart_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_ClearControl_Complete is blocked:

The runtime code coverage of Tss2_Sys_ClearControl_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_SequenceUpdate_Complete is blocked:

The runtime code coverage of Tss2_Sys_SequenceUpdate_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PolicyAuthorizeNV_Complete is blocked:

The runtime code coverage of Tss2_Sys_PolicyAuthorizeNV_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PCR_Event_Complete is blocked:

The runtime code coverage of Tss2_Sys_PCR_Event_Complete covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PolicyPhysicalPresence_Complete is blocked:

The runtime code coverage of Tss2_Sys_PolicyPhysicalPresence_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_ECC_Encrypt_Prepare is blocked:

The runtime code coverage of Tss2_Sys_ECC_Encrypt_Prepare covers 2.873% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_HierarchyControl_Complete is blocked:

The runtime code coverage of Tss2_Sys_HierarchyControl_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_EvictControl_Prepare is blocked:

The runtime code coverage of Tss2_Sys_EvictControl_Prepare covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_NV_SetBits_Prepare is blocked:

The runtime code coverage of Tss2_Sys_NV_SetBits_Prepare covers 2.906% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_Policy_AC_SendSelect_Prepare is blocked:

The runtime code coverage of Tss2_Sys_Policy_AC_SendSelect_Prepare covers 2.923% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_HMAC_Start_Prepare is blocked:

The runtime code coverage of Tss2_Sys_HMAC_Start_Prepare covers 2.923% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_SetAlgorithmSet_Prepare is blocked:

The runtime code coverage of Tss2_Sys_SetAlgorithmSet_Prepare covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PolicyPCR_Complete is blocked:

The runtime code coverage of Tss2_Sys_PolicyPCR_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_MAC_Start_Complete is blocked:

The runtime code coverage of Tss2_Sys_MAC_Start_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_HMAC_Prepare is blocked:

The runtime code coverage of Tss2_Sys_HMAC_Prepare covers 2.923% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_GetTestResult_Complete is blocked:

The runtime code coverage of Tss2_Sys_GetTestResult_Complete covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_SetCommandCodeAuditStatus_Complete is blocked:

The runtime code coverage of Tss2_Sys_SetCommandCodeAuditStatus_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PolicySecret_Complete is blocked:

The runtime code coverage of Tss2_Sys_PolicySecret_Complete covers 2.923% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PolicyTicket_Complete is blocked:

The runtime code coverage of Tss2_Sys_PolicyTicket_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_HierarchyChangeAuth_Prepare is blocked:

The runtime code coverage of Tss2_Sys_HierarchyChangeAuth_Prepare covers 2.923% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_RSA_Decrypt_Complete is blocked:

The runtime code coverage of Tss2_Sys_RSA_Decrypt_Complete covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PolicyDuplicationSelect_Prepare is blocked:

The runtime code coverage of Tss2_Sys_PolicyDuplicationSelect_Prepare covers 2.923% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_GetCommandAuditDigest_Prepare is blocked:

The runtime code coverage of Tss2_Sys_GetCommandAuditDigest_Prepare covers 2.857% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_Certify_Complete is blocked:

The runtime code coverage of Tss2_Sys_Certify_Complete covers 2.840% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_CertifyCreation_Complete is blocked:

The runtime code coverage of Tss2_Sys_CertifyCreation_Complete covers 2.840% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_GetCommandAuditDigest_Complete is blocked:

The runtime code coverage of Tss2_Sys_GetCommandAuditDigest_Complete covers 2.840% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_ECC_Decrypt_Complete is blocked:

The runtime code coverage of Tss2_Sys_ECC_Decrypt_Complete covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_AC_GetCapability_Prepare is blocked:

The runtime code coverage of Tss2_Sys_AC_GetCapability_Prepare covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_ECDH_KeyGen_Complete is blocked:

The runtime code coverage of Tss2_Sys_ECDH_KeyGen_Complete covers 2.906% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_Rewrap_Prepare is blocked:

The runtime code coverage of Tss2_Sys_Rewrap_Prepare covers 2.890% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_CreatePrimary_Prepare is blocked:

The runtime code coverage of Tss2_Sys_CreatePrimary_Prepare covers 2.512% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_RSA_Decrypt_Prepare is blocked:

The runtime code coverage of Tss2_Sys_RSA_Decrypt_Prepare covers 2.840% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PCR_SetAuthPolicy_Prepare is blocked:

The runtime code coverage of Tss2_Sys_PCR_SetAuthPolicy_Prepare covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_Commit_Prepare is blocked:

The runtime code coverage of Tss2_Sys_Commit_Prepare covers 2.873% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PCR_Read_Prepare is blocked:

The runtime code coverage of Tss2_Sys_PCR_Read_Prepare covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PolicyAuthorize_Prepare is blocked:

The runtime code coverage of Tss2_Sys_PolicyAuthorize_Prepare covers 2.890% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_TestParms_Prepare is blocked:

The runtime code coverage of Tss2_Sys_TestParms_Prepare covers 2.645% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_ECC_Parameters_Complete is blocked:

The runtime code coverage of Tss2_Sys_ECC_Parameters_Complete covers 2.824% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_DictionaryAttackParameters_Complete is blocked:

The runtime code coverage of Tss2_Sys_DictionaryAttackParameters_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_Policy_AC_SendSelect_Complete is blocked:

The runtime code coverage of Tss2_Sys_Policy_AC_SendSelect_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_DictionaryAttackLockReset_Prepare is blocked:

The runtime code coverage of Tss2_Sys_DictionaryAttackLockReset_Prepare covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PolicyGetDigest_Prepare is blocked:

The runtime code coverage of Tss2_Sys_PolicyGetDigest_Prepare covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_CreateLoaded_Complete is blocked:

The runtime code coverage of Tss2_Sys_CreateLoaded_Complete covers 2.551% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_NV_UndefineSpace_Prepare is blocked:

The runtime code coverage of Tss2_Sys_NV_UndefineSpace_Prepare covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_EventSequenceComplete_Complete is blocked:

The runtime code coverage of Tss2_Sys_EventSequenceComplete_Complete covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_MakeCredential_Complete is blocked:

The runtime code coverage of Tss2_Sys_MakeCredential_Complete covers 2.923% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_Rewrap_Complete is blocked:

The runtime code coverage of Tss2_Sys_Rewrap_Complete covers 2.923% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_HMAC_Start_Complete is blocked:

The runtime code coverage of Tss2_Sys_HMAC_Start_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_HierarchyControl_Prepare is blocked:

The runtime code coverage of Tss2_Sys_HierarchyControl_Prepare covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_EncryptDecrypt2_Complete is blocked:

The runtime code coverage of Tss2_Sys_EncryptDecrypt2_Complete covers 2.923% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_TestParms_Complete is blocked:

The runtime code coverage of Tss2_Sys_TestParms_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_SequenceComplete_Prepare is blocked:

The runtime code coverage of Tss2_Sys_SequenceComplete_Prepare covers 2.923% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_EncryptDecrypt_Complete is blocked:

The runtime code coverage of Tss2_Sys_EncryptDecrypt_Complete covers 2.923% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_FlushContext_Complete is blocked:

The runtime code coverage of Tss2_Sys_FlushContext_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_Startup_Complete is blocked:

The runtime code coverage of Tss2_Sys_Startup_Complete covers 2.976% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_EncryptDecrypt_Prepare is blocked:

The runtime code coverage of Tss2_Sys_EncryptDecrypt_Prepare covers 2.906% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_MAC_Complete is blocked:

The runtime code coverage of Tss2_Sys_MAC_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_ECDH_ZGen_Complete is blocked:

The runtime code coverage of Tss2_Sys_ECDH_ZGen_Complete covers 2.906% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_NV_WriteLock_Prepare is blocked:

The runtime code coverage of Tss2_Sys_NV_WriteLock_Prepare covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_SequenceComplete_Complete is blocked:

The runtime code coverage of Tss2_Sys_SequenceComplete_Complete covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PolicyCpHash_Prepare is blocked:

The runtime code coverage of Tss2_Sys_PolicyCpHash_Prepare covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_NV_WriteLock_Complete is blocked:

The runtime code coverage of Tss2_Sys_NV_WriteLock_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_ClearControl_Prepare is blocked:

The runtime code coverage of Tss2_Sys_ClearControl_Prepare covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PolicyNvWritten_Prepare is blocked:

The runtime code coverage of Tss2_Sys_PolicyNvWritten_Prepare covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_Import_Prepare is blocked:

The runtime code coverage of Tss2_Sys_Import_Prepare covers 2.525% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PolicyPCR_Prepare is blocked:

The runtime code coverage of Tss2_Sys_PolicyPCR_Prepare covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_Commit_Complete is blocked:

The runtime code coverage of Tss2_Sys_Commit_Complete covers 2.906% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PolicyCounterTimer_Complete is blocked:

The runtime code coverage of Tss2_Sys_PolicyCounterTimer_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_CreatePrimary_Complete is blocked:

The runtime code coverage of Tss2_Sys_CreatePrimary_Complete covers 2.5% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_HMAC_Complete is blocked:

The runtime code coverage of Tss2_Sys_HMAC_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_GetCapability_Prepare is blocked:

The runtime code coverage of Tss2_Sys_GetCapability_Prepare covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_Duplicate_Complete is blocked:

The runtime code coverage of Tss2_Sys_Duplicate_Complete covers 2.906% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_HashSequenceStart_Prepare is blocked:

The runtime code coverage of Tss2_Sys_HashSequenceStart_Prepare covers 2.923% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_EventSequenceComplete_Prepare is blocked:

The runtime code coverage of Tss2_Sys_EventSequenceComplete_Prepare covers 2.923% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_NV_Increment_Complete is blocked:

The runtime code coverage of Tss2_Sys_NV_Increment_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_SetPrimaryPolicy_Complete is blocked:

The runtime code coverage of Tss2_Sys_SetPrimaryPolicy_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_Certify_Prepare is blocked:

The runtime code coverage of Tss2_Sys_Certify_Prepare covers 2.857% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_NV_Extend_Complete is blocked:

The runtime code coverage of Tss2_Sys_NV_Extend_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_NV_UndefineSpaceSpecial_Prepare is blocked:

The runtime code coverage of Tss2_Sys_NV_UndefineSpaceSpecial_Prepare covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_ClockRateAdjust_Prepare is blocked:

The runtime code coverage of Tss2_Sys_ClockRateAdjust_Prepare covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_Sign_Prepare is blocked:

The runtime code coverage of Tss2_Sys_Sign_Prepare covers 2.857% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_LoadExternal_Prepare is blocked:

The runtime code coverage of Tss2_Sys_LoadExternal_Prepare covers 2.487% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_ReadClock_Complete is blocked:

The runtime code coverage of Tss2_Sys_ReadClock_Complete covers 2.890% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PolicyNvWritten_Complete is blocked:

The runtime code coverage of Tss2_Sys_PolicyNvWritten_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_FieldUpgradeData_Prepare is blocked:

The runtime code coverage of Tss2_Sys_FieldUpgradeData_Prepare covers 2.923% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_NV_UndefineSpaceSpecial_Complete is blocked:

The runtime code coverage of Tss2_Sys_NV_UndefineSpaceSpecial_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_Quote_Complete is blocked:

The runtime code coverage of Tss2_Sys_Quote_Complete covers 2.840% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_StirRandom_Complete is blocked:

The runtime code coverage of Tss2_Sys_StirRandom_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PCR_SetAuthPolicy_Complete is blocked:

The runtime code coverage of Tss2_Sys_PCR_SetAuthPolicy_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_FieldUpgradeStart_Prepare is blocked:

The runtime code coverage of Tss2_Sys_FieldUpgradeStart_Prepare covers 2.840% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_MAC_Prepare is blocked:

The runtime code coverage of Tss2_Sys_MAC_Prepare covers 2.923% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_NV_Read_Prepare is blocked:

The runtime code coverage of Tss2_Sys_NV_Read_Prepare covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_Vendor_TCG_Test_Complete is blocked:

The runtime code coverage of Tss2_Sys_Vendor_TCG_Test_Complete covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_RSA_Encrypt_Prepare is blocked:

The runtime code coverage of Tss2_Sys_RSA_Encrypt_Prepare covers 2.840% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_NV_ReadPublic_Complete is blocked:

The runtime code coverage of Tss2_Sys_NV_ReadPublic_Complete covers 2.890% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_VerifySignature_Complete is blocked:

The runtime code coverage of Tss2_Sys_VerifySignature_Complete covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_Hash_Prepare is blocked:

The runtime code coverage of Tss2_Sys_Hash_Prepare covers 2.923% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_HierarchyChangeAuth_Complete is blocked:

The runtime code coverage of Tss2_Sys_HierarchyChangeAuth_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_CertifyCreation_Prepare is blocked:

The runtime code coverage of Tss2_Sys_CertifyCreation_Prepare covers 2.840% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_ChangeEPS_Complete is blocked:

The runtime code coverage of Tss2_Sys_ChangeEPS_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_NV_Write_Complete is blocked:

The runtime code coverage of Tss2_Sys_NV_Write_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_GetSessionAuditDigest_Complete is blocked:

The runtime code coverage of Tss2_Sys_GetSessionAuditDigest_Complete covers 2.840% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_StartAuthSession_Complete is blocked:

The runtime code coverage of Tss2_Sys_StartAuthSession_Complete covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PCR_SetAuthValue_Prepare is blocked:

The runtime code coverage of Tss2_Sys_PCR_SetAuthValue_Prepare covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_SetCommandCodeAuditStatus_Prepare is blocked:

The runtime code coverage of Tss2_Sys_SetCommandCodeAuditStatus_Prepare covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_NV_GlobalWriteLock_Complete is blocked:

The runtime code coverage of Tss2_Sys_NV_GlobalWriteLock_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PolicyNameHash_Prepare is blocked:

The runtime code coverage of Tss2_Sys_PolicyNameHash_Prepare covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_SetAlgorithmSet_Complete is blocked:

The runtime code coverage of Tss2_Sys_SetAlgorithmSet_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_NV_ReadLock_Prepare is blocked:

The runtime code coverage of Tss2_Sys_NV_ReadLock_Prepare covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_StartAuthSession_Prepare is blocked:

The runtime code coverage of Tss2_Sys_StartAuthSession_Prepare covers 2.857% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PolicyTicket_Prepare is blocked:

The runtime code coverage of Tss2_Sys_PolicyTicket_Prepare covers 2.873% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_Sign_Complete is blocked:

The runtime code coverage of Tss2_Sys_Sign_Complete covers 2.857% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_CertifyX509_Complete is blocked:

The runtime code coverage of Tss2_Sys_CertifyX509_Complete covers 2.840% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PolicyOR_Complete is blocked:

The runtime code coverage of Tss2_Sys_PolicyOR_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_Quote_Prepare is blocked:

The runtime code coverage of Tss2_Sys_Quote_Prepare covers 2.857% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_NV_DefineSpace_Prepare is blocked:

The runtime code coverage of Tss2_Sys_NV_DefineSpace_Prepare covers 2.873% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PCR_Allocate_Complete is blocked:

The runtime code coverage of Tss2_Sys_PCR_Allocate_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_ECC_Encrypt_Complete is blocked:

The runtime code coverage of Tss2_Sys_ECC_Encrypt_Complete covers 2.890% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_NV_SetBits_Complete is blocked:

The runtime code coverage of Tss2_Sys_NV_SetBits_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PolicyNV_Complete is blocked:

The runtime code coverage of Tss2_Sys_PolicyNV_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_ClockRateAdjust_Complete is blocked:

The runtime code coverage of Tss2_Sys_ClockRateAdjust_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_NV_Write_Prepare is blocked:

The runtime code coverage of Tss2_Sys_NV_Write_Prepare covers 2.923% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_PolicyPassword_Complete is blocked:

The runtime code coverage of Tss2_Sys_PolicyPassword_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_ContextLoad_Complete is blocked:

The runtime code coverage of Tss2_Sys_ContextLoad_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_Shutdown_Complete is blocked:

The runtime code coverage of Tss2_Sys_Shutdown_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_ECC_Decrypt_Prepare is blocked:

The runtime code coverage of Tss2_Sys_ECC_Decrypt_Prepare covers 2.824% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_NV_DefineSpace_Complete is blocked:

The runtime code coverage of Tss2_Sys_NV_DefineSpace_Complete covers 2.958% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_ReadPublic_Complete is blocked:

The runtime code coverage of Tss2_Sys_ReadPublic_Complete covers 2.564% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer Tss2_Sys_NV_Read_Complete is blocked:

The runtime code coverage of Tss2_Sys_NV_Read_Complete covers 2.941% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

490 / 877

Cyclomatic complexity statically reachable by fuzzers

4006 / 6655

Runtime code coverage of functions

4 / 877

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: Tss2_Sys_NV_Read_Complete

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	442	96.7%
gold	[1:9]	14	3.06%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.21%
All colors	457	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
427	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

165

Reachable functions

170

Percentage of reachable functions covered

2.94%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	16
src/tss2-mu/tpm2b-types.c	5
src/tss2-mu/tpma-types.c	6
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	18
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	2
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	1
test/fuzz/Tss2_Sys_NV_Read_Complete.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_NV_Read.c	1

Fuzzer: Tss2_Sys_ReadPublic_Complete

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	525	97.2%
gold	[1:9]	14	2.59%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.18%
All colors	540	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
510	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

190

Reachable functions

195

Percentage of reachable functions covered

2.56%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	24
src/tss2-mu/tpm2b-types.c	8
src/tss2-mu/tpma-types.c	7
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	25
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	8
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	1
test/fuzz/Tss2_Sys_ReadPublic_Complete.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_ReadPublic.c	1

Fuzzer: Tss2_Sys_NV_DefineSpace_Complete

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	440	96.7%
gold	[1:9]	14	3.07%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.21%
All colors	455	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
425	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

164

Reachable functions

169

Percentage of reachable functions covered

2.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	16
src/tss2-mu/tpm2b-types.c	4
src/tss2-mu/tpma-types.c	6
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	18
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	2
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	1
test/fuzz/Tss2_Sys_NV_DefineSpace_Complete.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_NV_DefineSpace.c	1

Fuzzer: Tss2_Sys_ECC_Decrypt_Prepare

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	467	96.8%
gold	[1:9]	14	2.90%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.20%
All colors	482	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
452	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

172

Reachable functions

177

Percentage of reachable functions covered

2.82%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	18
src/tss2-mu/tpm2b-types.c	7
src/tss2-mu/tpma-types.c	6
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	19
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	3
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	2
test/fuzz/Tss2_Sys_ECC_Decrypt_Prepare.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_ECC_Decrypt.c	1

Fuzzer: Tss2_Sys_Shutdown_Complete

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	438	96.6%
gold	[1:9]	14	3.09%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.22%
All colors	453	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
423	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

164

Reachable functions

169

Percentage of reachable functions covered

2.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	16
src/tss2-mu/tpm2b-types.c	4
src/tss2-mu/tpma-types.c	6
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	18
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	2
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	1
test/fuzz/Tss2_Sys_Shutdown_Complete.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_Shutdown.c	1

Fuzzer: Tss2_Sys_ContextLoad_Complete

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	439	96.6%
gold	[1:9]	14	3.08%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.22%
All colors	454	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
424	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

164

Reachable functions

169

Percentage of reachable functions covered

2.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	16
src/tss2-mu/tpm2b-types.c	4
src/tss2-mu/tpma-types.c	6
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	18
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	2
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	1
test/fuzz/Tss2_Sys_ContextLoad_Complete.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_ContextLoad.c	1

Fuzzer: Tss2_Sys_PolicyPassword_Complete

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	438	96.6%
gold	[1:9]	14	3.09%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.22%
All colors	453	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
423	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

164

Reachable functions

169

Percentage of reachable functions covered

2.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	16
src/tss2-mu/tpm2b-types.c	4
src/tss2-mu/tpma-types.c	6
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	18
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	2
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	1
test/fuzz/Tss2_Sys_PolicyPassword_Complete.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_PolicyPassword.c	1

Fuzzer: Tss2_Sys_NV_Write_Prepare

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	450	96.7%
gold	[1:9]	14	3.01%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.21%
All colors	465	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
435	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

166

Reachable functions

171

Percentage of reachable functions covered

2.92%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	16
src/tss2-mu/tpm2b-types.c	5
src/tss2-mu/tpma-types.c	6
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	18
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	2
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	2
test/fuzz/Tss2_Sys_NV_Write_Prepare.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_NV_Write.c	1

Fuzzer: Tss2_Sys_ClockRateAdjust_Complete

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	439	96.6%
gold	[1:9]	14	3.08%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.22%
All colors	454	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
424	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

164

Reachable functions

169

Percentage of reachable functions covered

2.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	16
src/tss2-mu/tpm2b-types.c	4
src/tss2-mu/tpma-types.c	6
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	18
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	2
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	1
test/fuzz/Tss2_Sys_ClockRateAdjust_Complete.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_ClockRateAdjust.c	1

Fuzzer: Tss2_Sys_PolicyNV_Complete

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	440	96.7%
gold	[1:9]	14	3.07%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.21%
All colors	455	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
425	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

164

Reachable functions

169

Percentage of reachable functions covered

2.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	16
src/tss2-mu/tpm2b-types.c	4
src/tss2-mu/tpma-types.c	6
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	18
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	2
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	1
test/fuzz/Tss2_Sys_PolicyNV_Complete.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_PolicyNV.c	1

Fuzzer: Tss2_Sys_NV_SetBits_Complete

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	439	96.6%
gold	[1:9]	14	3.08%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.22%
All colors	454	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
424	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

164

Reachable functions

169

Percentage of reachable functions covered

2.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	16
src/tss2-mu/tpm2b-types.c	4
src/tss2-mu/tpma-types.c	6
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	18
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	2
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	1
test/fuzz/Tss2_Sys_NV_SetBits_Complete.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_NV_SetBits.c	1

Fuzzer: Tss2_Sys_ECC_Encrypt_Complete

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	452	96.7%
gold	[1:9]	14	2.99%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.21%
All colors	467	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
437	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

168

Reachable functions

173

Percentage of reachable functions covered

2.89%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	17
src/tss2-mu/tpm2b-types.c	7
src/tss2-mu/tpma-types.c	6
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	18
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	2
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	1
test/fuzz/Tss2_Sys_ECC_Encrypt_Complete.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_ECC_Encrypt.c	1

Fuzzer: Tss2_Sys_PCR_Allocate_Complete

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	442	96.7%
gold	[1:9]	14	3.06%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.21%
All colors	457	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
427	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

164

Reachable functions

169

Percentage of reachable functions covered

2.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	16
src/tss2-mu/tpm2b-types.c	4
src/tss2-mu/tpma-types.c	6
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	18
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	2
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	1
test/fuzz/Tss2_Sys_PCR_Allocate_Complete.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_PCR_Allocate.c	1

Fuzzer: Tss2_Sys_NV_DefineSpace_Prepare

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	462	96.8%
gold	[1:9]	14	2.93%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.20%
All colors	477	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
447	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

169

Reachable functions

174

Percentage of reachable functions covered

2.87%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	17
src/tss2-mu/tpm2b-types.c	6
src/tss2-mu/tpma-types.c	7
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	18
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	2
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	2
test/fuzz/Tss2_Sys_NV_DefineSpace_Prepare.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_NV_DefineSpace.c	1

Fuzzer: Tss2_Sys_Quote_Prepare

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	461	96.8%
gold	[1:9]	14	2.94%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.21%
All colors	476	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
446	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

170

Reachable functions

175

Percentage of reachable functions covered

2.86%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	18
src/tss2-mu/tpm2b-types.c	5
src/tss2-mu/tpma-types.c	6
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	19
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	3
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	2
test/fuzz/Tss2_Sys_Quote_Prepare.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_Quote.c	1

Fuzzer: Tss2_Sys_PolicyOR_Complete

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	440	96.7%
gold	[1:9]	14	3.07%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.21%
All colors	455	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
425	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

164

Reachable functions

169

Percentage of reachable functions covered

2.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	16
src/tss2-mu/tpm2b-types.c	4
src/tss2-mu/tpma-types.c	6
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	18
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	2
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	1
test/fuzz/Tss2_Sys_PolicyOR_Complete.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_PolicyOR.c	1

Fuzzer: Tss2_Sys_CertifyX509_Complete

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	463	96.8%
gold	[1:9]	14	2.92%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.20%
All colors	478	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
448	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

171

Reachable functions

176

Percentage of reachable functions covered

2.84%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	18
src/tss2-mu/tpm2b-types.c	7
src/tss2-mu/tpma-types.c	6
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	19
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	3
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	1
test/fuzz/Tss2_Sys_CertifyX509_Complete.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_CertifyX509.c	1

Fuzzer: Tss2_Sys_Sign_Complete

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	459	96.8%
gold	[1:9]	14	2.95%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.21%
All colors	474	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
444	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

170

Reachable functions

175

Percentage of reachable functions covered

2.86%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	18
src/tss2-mu/tpm2b-types.c	6
src/tss2-mu/tpma-types.c	6
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	19
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	3
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	1
test/fuzz/Tss2_Sys_Sign_Complete.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_Sign.c	1

Fuzzer: Tss2_Sys_PolicyTicket_Prepare

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	464	96.8%
gold	[1:9]	14	2.92%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.20%
All colors	479	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
449	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

169

Reachable functions

174

Percentage of reachable functions covered

2.87%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	16
src/tss2-mu/tpm2b-types.c	7
src/tss2-mu/tpma-types.c	6
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	18
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	3
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	2
test/fuzz/Tss2_Sys_PolicyTicket_Prepare.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_PolicyTicket.c	1

Fuzzer: Tss2_Sys_StartAuthSession_Prepare

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	467	96.8%
gold	[1:9]	14	2.90%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.20%
All colors	482	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
452	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

170

Reachable functions

175

Percentage of reachable functions covered

2.86%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	16
src/tss2-mu/tpm2b-types.c	6
src/tss2-mu/tpma-types.c	6
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	20
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	3
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	2
test/fuzz/Tss2_Sys_StartAuthSession_Prepare.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_StartAuthSession.c	1

Fuzzer: Tss2_Sys_NV_ReadLock_Prepare

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	446	96.7%
gold	[1:9]	14	3.03%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.21%
All colors	461	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
431	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

165

Reachable functions

170

Percentage of reachable functions covered

2.94%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	16
src/tss2-mu/tpm2b-types.c	4
src/tss2-mu/tpma-types.c	6
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	18
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	2
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	2
test/fuzz/Tss2_Sys_NV_ReadLock_Prepare.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_NV_ReadLock.c	1

Fuzzer: Tss2_Sys_SetAlgorithmSet_Complete

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	440	96.7%
gold	[1:9]	14	3.07%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.21%
All colors	455	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
425	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

164

Reachable functions

169

Percentage of reachable functions covered

2.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	16
src/tss2-mu/tpm2b-types.c	4
src/tss2-mu/tpma-types.c	6
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	18
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	2
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	1
test/fuzz/Tss2_Sys_SetAlgorithmSet_Complete.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_SetAlgorithmSet.c	1

Fuzzer: Tss2_Sys_PolicyNameHash_Prepare

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	447	96.7%
gold	[1:9]	14	3.03%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.21%
All colors	462	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
432	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

165

Reachable functions

170

Percentage of reachable functions covered

2.94%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	16
src/tss2-mu/tpm2b-types.c	4
src/tss2-mu/tpma-types.c	6
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	18
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	2
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	2
test/fuzz/Tss2_Sys_PolicyNameHash_Prepare.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_PolicyNameHash.c	1

Fuzzer: Tss2_Sys_NV_GlobalWriteLock_Complete

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	438	96.6%
gold	[1:9]	14	3.09%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.22%
All colors	453	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
423	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

164

Reachable functions

169

Percentage of reachable functions covered

2.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	16
src/tss2-mu/tpm2b-types.c	4
src/tss2-mu/tpma-types.c	6
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	18
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	2
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	1
test/fuzz/Tss2_Sys_NV_GlobalWriteLock_Complete.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_NV_GlobalWriteLock.c	1

Fuzzer: Tss2_Sys_SetCommandCodeAuditStatus_Prepare

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	447	96.7%
gold	[1:9]	14	3.03%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.21%
All colors	462	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
432	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

165

Reachable functions

170

Percentage of reachable functions covered

2.94%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	16
src/tss2-mu/tpm2b-types.c	4
src/tss2-mu/tpma-types.c	6
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	18
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	2
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	2
test/fuzz/Tss2_Sys_SetCommandCodeAuditStatus_Prepare.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_SetCommandCodeAuditStatus.c	1

Fuzzer: Tss2_Sys_PCR_SetAuthValue_Prepare

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	446	96.7%
gold	[1:9]	14	3.03%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.21%
All colors	461	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
431	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

165

Reachable functions

170

Percentage of reachable functions covered

2.94%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	16
src/tss2-mu/tpm2b-types.c	4
src/tss2-mu/tpma-types.c	6
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	18
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	2
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	2
test/fuzz/Tss2_Sys_PCR_SetAuthValue_Prepare.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_PCR_SetAuthValue.c	1

Fuzzer: Tss2_Sys_StartAuthSession_Complete

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	444	96.7%
gold	[1:9]	14	3.05%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.21%
All colors	459	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
429	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

165

Reachable functions

170

Percentage of reachable functions covered

2.94%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	16
src/tss2-mu/tpm2b-types.c	5
src/tss2-mu/tpma-types.c	6
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	18
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	2
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	1
test/fuzz/Tss2_Sys_StartAuthSession_Complete.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_StartAuthSession.c	1

Fuzzer: Tss2_Sys_GetSessionAuditDigest_Complete

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	461	96.8%
gold	[1:9]	14	2.94%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.21%
All colors	476	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
446	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

171

Reachable functions

176

Percentage of reachable functions covered

2.84%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	18
src/tss2-mu/tpm2b-types.c	7
src/tss2-mu/tpma-types.c	6
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	19
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	3
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	1
test/fuzz/Tss2_Sys_GetSessionAuditDigest_Complete.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_GetSessionAuditDigest.c	1

Fuzzer: Tss2_Sys_NV_Write_Complete

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	440	96.7%
gold	[1:9]	14	3.07%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.21%
All colors	455	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
425	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

164

Reachable functions

169

Percentage of reachable functions covered

2.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	16
src/tss2-mu/tpm2b-types.c	4
src/tss2-mu/tpma-types.c	6
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	18
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	2
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	1
test/fuzz/Tss2_Sys_NV_Write_Complete.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_NV_Write.c	1

Fuzzer: Tss2_Sys_ChangeEPS_Complete

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	438	96.6%
gold	[1:9]	14	3.09%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.22%
All colors	453	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
423	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

164

Reachable functions

169

Percentage of reachable functions covered

2.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	16
src/tss2-mu/tpm2b-types.c	4
src/tss2-mu/tpma-types.c	6
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	18
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	2
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	1
test/fuzz/Tss2_Sys_ChangeEPS_Complete.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_ChangeEPS.c	1

Fuzzer: Tss2_Sys_CertifyCreation_Prepare

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	467	96.8%
gold	[1:9]	14	2.90%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.20%
All colors	482	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
452	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

171

Reachable functions

176

Percentage of reachable functions covered

2.84%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	18
src/tss2-mu/tpm2b-types.c	5
src/tss2-mu/tpma-types.c	6
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	19
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	4
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	2
test/fuzz/Tss2_Sys_CertifyCreation_Prepare.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_CertifyCreation.c	1

Fuzzer: Tss2_Sys_HierarchyChangeAuth_Complete

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	440	96.7%
gold	[1:9]	14	3.07%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.21%
All colors	455	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
425	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

164

Reachable functions

169

Percentage of reachable functions covered

2.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	16
src/tss2-mu/tpm2b-types.c	4
src/tss2-mu/tpma-types.c	6
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	18
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	2
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	1
test/fuzz/Tss2_Sys_HierarchyChangeAuth_Complete.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_HierarchyChangeAuth.c	1

Fuzzer: Tss2_Sys_Hash_Prepare

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	450	96.7%
gold	[1:9]	14	3.01%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.21%
All colors	465	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
435	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

166

Reachable functions

171

Percentage of reachable functions covered

2.92%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	16
src/tss2-mu/tpm2b-types.c	5
src/tss2-mu/tpma-types.c	6
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	18
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	2
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	2
test/fuzz/Tss2_Sys_Hash_Prepare.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_Hash.c	1

Fuzzer: Tss2_Sys_VerifySignature_Complete

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	445	96.7%
gold	[1:9]	14	3.04%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.21%
All colors	460	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
430	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

165

Reachable functions

170

Percentage of reachable functions covered

2.94%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	16
src/tss2-mu/tpm2b-types.c	4
src/tss2-mu/tpma-types.c	6
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	18
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	3
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	1
test/fuzz/Tss2_Sys_VerifySignature_Complete.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_VerifySignature.c	1

Fuzzer: Tss2_Sys_NV_ReadPublic_Complete

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	453	96.7%
gold	[1:9]	14	2.99%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.21%
All colors	468	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
438	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

168

Reachable functions

173

Percentage of reachable functions covered

2.89%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	17
src/tss2-mu/tpm2b-types.c	6
src/tss2-mu/tpma-types.c	7
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	18
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	2
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	1
test/fuzz/Tss2_Sys_NV_ReadPublic_Complete.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_NV_ReadPublic.c	1

Fuzzer: Tss2_Sys_RSA_Encrypt_Prepare

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	464	96.8%
gold	[1:9]	14	2.92%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.20%
All colors	479	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
449	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

171

Reachable functions

176

Percentage of reachable functions covered

2.84%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	18
src/tss2-mu/tpm2b-types.c	6
src/tss2-mu/tpma-types.c	6
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	19
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	3
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	2
test/fuzz/Tss2_Sys_RSA_Encrypt_Prepare.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_RSA_Encrypt.c	1

Fuzzer: Tss2_Sys_Vendor_TCG_Test_Complete

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	443	96.7%
gold	[1:9]	14	3.05%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.21%
All colors	458	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
428	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

165

Reachable functions

170

Percentage of reachable functions covered

2.94%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	16
src/tss2-mu/tpm2b-types.c	5
src/tss2-mu/tpma-types.c	6
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	18
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	2
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	1
test/fuzz/Tss2_Sys_Vendor_TCG_Test_Complete.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_Vendor_TCG_Test.c	1

Fuzzer: Tss2_Sys_NV_Read_Prepare

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	447	96.7%
gold	[1:9]	14	3.03%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.21%
All colors	462	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
432	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

165

Reachable functions

170

Percentage of reachable functions covered

2.94%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	16
src/tss2-mu/tpm2b-types.c	4
src/tss2-mu/tpma-types.c	6
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	18
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	2
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	2
test/fuzz/Tss2_Sys_NV_Read_Prepare.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_NV_Read.c	1

Fuzzer: Tss2_Sys_MAC_Prepare

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	450	96.7%
gold	[1:9]	14	3.01%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.21%
All colors	465	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
435	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

166

Reachable functions

171

Percentage of reachable functions covered

2.92%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	16
src/tss2-mu/tpm2b-types.c	5
src/tss2-mu/tpma-types.c	6
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	18
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	2
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	2
test/fuzz/Tss2_Sys_MAC_Prepare.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_MAC.c	1

Fuzzer: Tss2_Sys_FieldUpgradeStart_Prepare

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	466	96.8%
gold	[1:9]	14	2.91%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.20%
All colors	481	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
451	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

171

Reachable functions

176

Percentage of reachable functions covered

2.84%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	18
src/tss2-mu/tpm2b-types.c	6
src/tss2-mu/tpma-types.c	6
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	19
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	3
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	2
test/fuzz/Tss2_Sys_FieldUpgradeStart_Prepare.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_FieldUpgradeStart.c	1

Fuzzer: Tss2_Sys_PCR_SetAuthPolicy_Complete

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	440	96.7%
gold	[1:9]	14	3.07%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.21%
All colors	455	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
425	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

164

Reachable functions

169

Percentage of reachable functions covered

2.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	16
src/tss2-mu/tpm2b-types.c	4
src/tss2-mu/tpma-types.c	6
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	18
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	2
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	1
test/fuzz/Tss2_Sys_PCR_SetAuthPolicy_Complete.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_PCR_SetAuthPolicy.c	1

Fuzzer: Tss2_Sys_StirRandom_Complete

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	440	96.7%
gold	[1:9]	14	3.07%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.21%
All colors	455	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
425	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

164

Reachable functions

169

Percentage of reachable functions covered

2.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	16
src/tss2-mu/tpm2b-types.c	4
src/tss2-mu/tpma-types.c	6
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	18
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	2
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	1
test/fuzz/Tss2_Sys_StirRandom_Complete.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_StirRandom.c	1

Fuzzer: Tss2_Sys_Quote_Complete

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	461	96.8%
gold	[1:9]	14	2.94%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.21%
All colors	476	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
446	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

171

Reachable functions

176

Percentage of reachable functions covered

2.84%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	18
src/tss2-mu/tpm2b-types.c	7
src/tss2-mu/tpma-types.c	6
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	19
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	3
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	1
test/fuzz/Tss2_Sys_Quote_Complete.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_Quote.c	1

Fuzzer: Tss2_Sys_NV_UndefineSpaceSpecial_Complete

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	440	96.7%
gold	[1:9]	14	3.07%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.21%
All colors	455	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
425	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

164

Reachable functions

169

Percentage of reachable functions covered

2.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	16
src/tss2-mu/tpm2b-types.c	4
src/tss2-mu/tpma-types.c	6
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	18
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	2
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	1
test/fuzz/Tss2_Sys_NV_UndefineSpaceSpecial_Complete.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_NV_UndefineSpaceSpecial.c	1

Fuzzer: Tss2_Sys_FieldUpgradeData_Prepare

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	446	96.7%
gold	[1:9]	14	3.03%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.21%
All colors	461	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
431	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

166

Reachable functions

171

Percentage of reachable functions covered

2.92%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	16
src/tss2-mu/tpm2b-types.c	5
src/tss2-mu/tpma-types.c	6
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	18
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	2
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	2
test/fuzz/Tss2_Sys_FieldUpgradeData_Prepare.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_FieldUpgradeData.c	1

Fuzzer: Tss2_Sys_PolicyNvWritten_Complete

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	440	96.7%
gold	[1:9]	14	3.07%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.21%
All colors	455	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
425	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

164

Reachable functions

169

Percentage of reachable functions covered

2.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	16
src/tss2-mu/tpm2b-types.c	4
src/tss2-mu/tpma-types.c	6
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	18
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	2
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	1
test/fuzz/Tss2_Sys_PolicyNvWritten_Complete.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_PolicyNvWritten.c	1

Fuzzer: Tss2_Sys_ReadClock_Complete

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	449	96.7%
gold	[1:9]	14	3.01%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.21%
All colors	464	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
434	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

168

Reachable functions

173

Percentage of reachable functions covered

2.89%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	16
/usr/include/x86_64-linux-gnu/bits/byteswap.h	3
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	18
src/tss2-mu/tpm2b-types.c	4
src/tss2-mu/tpma-types.c	6
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	18
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	2
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	1
test/fuzz/Tss2_Sys_ReadClock_Complete.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_ReadClock.c	1

Fuzzer: Tss2_Sys_LoadExternal_Prepare

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	550	97.3%
gold	[1:9]	14	2.47%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.17%
All colors	565	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
535	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

196

Reachable functions

201

Percentage of reachable functions covered

2.49%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
test/fuzz/main-sys.c	1
test/integration/test-common.c	7
src/util/log.c	6
src/tss2-tcti/tctildr.c	10
src/tss2-tcti/tctildr-dl.c	5
src/tss2-sys/api/Tss2_Sys_GetContextSize.c	1
src/tss2-sys/api/Tss2_Sys_Initialize.c	1
./src/tss2-sys/sysapi_util.h	2
src/tss2-sys/sysapi_util.c	10
src/tss2-sys/api/Tss2_Sys_Startup.c	3
src/tss2-mu/base-types.c	15
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
src/tss2-sys/sysapi_util.h	2
src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c	1
src/tss2-mu/tpms-types.c	24
src/tss2-mu/tpm2b-types.c	11
src/tss2-mu/tpma-types.c	7
src/tss2-sys/api/Tss2_Sys_Execute.c	3
src/tss2-sys/api/Tss2_Sys_GetRspAuths.c	1
src/tss2-sys/api/Tss2_Sys_Finalize.c	1
src/tss2-sys/api/Tss2_Sys_GetCapability.c	3
src/tss2-mu/tpmu-types.c	26
src/tss2-mu/tpml-types.c	21
src/tss2-mu/tpmt-types.c	9
src/tss2-sys/api/Tss2_Sys_PCR_Read.c	3
test/fuzz/tcti/tcti-fuzzing.c	2
test/fuzz/Tss2_Sys_LoadExternal_Prepare.fuzz.c	1
src/tss2-sys/api/Tss2_Sys_LoadExternal.c	1

Fuzzer: Tss2_Sys_Sign_Prepare

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	463	96.8%
gold	[1:9]	14	2.92%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.20%
All colors	478	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
448	29	test_sys_setup	call site: 00029	test_sys_checks_pre
9	4	getLogLevel	call site: 00004	log_stringlevel
5	20	getLogFile	call site: 00020	fopen
1	1	LLVMFuzzerTestOneInput	call site: 00001	doLog

Runtime coverage analysis