High level conclusions

Fuzzers reach 89.09% of cyclomatic complexity.

Fuzzers reach 66.11% of all functions.

Fuzzer fuzzer_listen is blocked:

The runtime code coverage of fuzzer_listen covers 25.90% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

595 / 900

Cyclomatic complexity statically reachable by fuzzers

16651 / 18690

Runtime code coverage of functions

383 / 900

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzzer_listen

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4599	88.3%
gold	[1:9]	296	5.68%
yellow	[10:29]	15	0.28%
greenyellow	[30:49]	6	0.11%
lawngreen	50+	287	5.51%
All colors	5203	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
115419	133237	41 : View List ['sctp_handle_cookie_echo', 'terminate_non_graceful.255', 'sctp_timer_start', 'sctp_handle_error', 'pthread_mutex_unlock', 'sctp_handle_heartbeat_ack', 'pthread_mutex_lock', 'sctp_handle_forward_tsn', 'sctp_m_getptr', 'sctp_handle_packet_dropped', 'sctp_abort_an_association', 'sctp_send_abort', 'sctp_handle_ecn_cwr', 'sctp_get_mbuf_for_msg', 'sctp_misc_ints', 'sctp_handle_ecn_echo', 'pthread_mutex_trylock', 'sctp_handle_shutdown_ack', 'sctp_chunk_output', 'sctp_handle_init_ack', 'sctp_abort_association', 'sctp_handle_init', 'sctp_queue_op_err', 'sctp_handle_auth', '__bswap_16.256', 'sctp_free_assoc', 'sctp_handle_shutdown', 'sctp_handle_abort', 'm_freem', 'm_copym', 'sctp_ulp_notify', 'sctp_express_handle_sack', 'sctp_handle_asconf', 'sctp_handle_shutdown_complete', '__bswap_32', 'sctp_handle_sack', 'sctp_send_asconf_ack', 'sctp_handle_stream_reset', 'sctp_handle_asconf_ack', 'sctp_handle_cookie_ack', 'sctp_send_heartbeat_ack']	115419	133540	sctp_process_control	call site: 02178	/src/usrsctp/usrsctplib/netinet/sctp_input.c:4853
110379	128500	40 : View List ['sctp_handle_cookie_echo', 'sctp_timer_start', 'sctp_handle_error', 'sctp_handle_heartbeat_ack', 'pthread_mutex_lock', 'sctp_handle_forward_tsn', 'sctp_m_getptr', 'sctp_handle_packet_dropped', 'sctp_abort_an_association', 'sctp_send_abort', 'sctp_handle_ecn_cwr', 'sctp_generate_cause', 'sctp_get_mbuf_for_msg', 'sctp_misc_ints', 'sctp_handle_ecn_echo', 'pthread_mutex_trylock', 'sctp_handle_shutdown_ack', 'sctp_chunk_output', 'sctp_handle_init_ack', 'sctp_abort_association', 'sctp_handle_init', 'sctp_queue_op_err', 'sctp_handle_auth', '__bswap_16.256', 'sctp_free_assoc', 'sctp_handle_shutdown', 'sctp_handle_abort', 'm_freem', 'm_copym', 'sctp_ulp_notify', 'sctp_express_handle_sack', 'sctp_handle_asconf', 'sctp_handle_shutdown_complete', '__bswap_32', 'sctp_handle_sack', 'sctp_send_asconf_ack', 'sctp_handle_stream_reset', 'sctp_handle_asconf_ack', 'sctp_handle_cookie_ack', 'sctp_send_heartbeat_ack']	110391	128512	sctp_process_control	call site: 03435	/src/usrsctp/usrsctplib/netinet/sctp_input.c:5364
5039	5039	2 : View List ['sctp_chunk_output', 'sctp_send_shutdown_ack']	5039	5039	sctp_handle_init	call site: 02279	/src/usrsctp/usrsctplib/netinet/sctp_input.c:163
702	702	1 : View List ['sctp_source_address_selection']	718	3450	sctp_send_initiate_ack	call site: 02334	/src/usrsctp/usrsctplib/netinet/sctp_output.c:6154
130	130	2 : View List ['sctp_add_addr_to_mbuf', 'sctp_is_address_in_scope']	132	132	sctp_add_addresses_to_i_ia	call site: 02423	/src/usrsctp/usrsctplib/netinet/sctp_output.c:2230
30	30	1 : View List ['m_tag_delete']	30	30	m_tag_delete_chain	call site: 00124	/src/usrsctp/usrsctplib/user_mbuf.c:708
8	8	3 : View List ['terminate_non_graceful.1229', 'pthread_mutex_unlock', 'pthread_mutex_lock']	8	8	sctp_setopt	call site: 04878	/src/usrsctp/usrsctplib/netinet/sctp_usrreq.c:7071
4	4	2 : View List ['perror', 'exit']	4	4	init_fuzzer	call site: 05064	/src/usrsctp/fuzzer/fuzzer_listen.c:149
2	2	1 : View List ['pthread_rwlock_rdlock']	4	174	sctp_pcb_findep	call site: 01953	/src/usrsctp/usrsctplib/netinet/sctp_pcb.c:2262
2	2	1 : View List ['__errno_location']	2	2	usrsctp_set_non_blocking	call site: 04258	/src/usrsctp/usrsctplib/user_socket.c:1821
2	2	1 : View List ['__errno_location']	2	2	usrsctp_setsockopt	call site: 04298	/src/usrsctp/usrsctplib/user_socket.c:2130
2	2	1 : View List ['__errno_location']	2	2	usrsctp_set_upcall	call site: 05107	/src/usrsctp/usrsctplib/user_socket.c:3367

Runtime coverage analysis

Covered functions

154

Functions that are reachable but not covered

429

Reachable functions

579

Percentage of reachable functions covered

25.91%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzer/fuzzer_listen.c	5
usrsctplib/user_socket.c	42
usrsctplib/netinet/sctp_usrreq.c	15
usrsctplib/user_environment.c	2
usrsctplib/netinet/sctp_sysctl.c	1
usrsctplib/netinet/sctp_pcb.c	61
usrsctplib/netinet/sctputil.c	78
usrsctplib/netinet/sctp_callout.c	7
usrsctplib/netinet/sctp_bsd_addr.c	8
usrsctplib/netinet/sctp_userspace.c	4
usrsctplib/user_environment.h	1
usrsctplib/netinet/sctp_output.c	69
usrsctplib/netinet/sctp_auth.c	53
usrsctplib/netinet/sctp_indata.c	35
usrsctplib/user_mbuf.c	30
usrsctplib/netinet/sctp_os_userspace.h	2
usrsctplib/netinet/sctp_timer.c	16
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
usrsctplib/netinet6/sctp6_usrreq.c	4
usrsctplib/netinet/sctp_sha1.c	4
usrsctplib/netinet/sctp_asconf.c	37
usrsctplib/netinet/sctp_crc32.c	7
usrsctplib/netinet/sctp_input.c	40
usrsctplib/user_recv_thread.c	7
/usr/include/x86_64-linux-gnu/bits/socket.h	1

Fuzzer: fuzzer_fragment

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5035	82.4%
gold	[1:9]	108	1.76%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	0.03%
lawngreen	50+	959	15.7%
All colors	6104	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
84074	128500	40 : View List ['sctp_handle_cookie_echo', 'sctp_timer_start', 'sctp_handle_error', 'sctp_handle_heartbeat_ack', 'pthread_mutex_lock', 'sctp_handle_forward_tsn', 'sctp_m_getptr', 'sctp_handle_packet_dropped', 'sctp_abort_an_association', 'sctp_send_abort', 'sctp_handle_ecn_cwr', 'sctp_generate_cause', 'sctp_get_mbuf_for_msg', 'sctp_misc_ints', 'sctp_handle_ecn_echo', 'pthread_mutex_trylock', 'sctp_handle_shutdown_ack', 'sctp_chunk_output', 'sctp_handle_init_ack', 'sctp_abort_association', 'sctp_handle_init', 'sctp_queue_op_err', 'sctp_handle_auth', '__bswap_16.256', 'sctp_free_assoc', 'sctp_handle_shutdown', 'sctp_handle_abort', 'm_freem', 'm_copym', 'sctp_ulp_notify', 'sctp_express_handle_sack', 'sctp_handle_asconf', 'sctp_handle_shutdown_complete', '__bswap_32', 'sctp_handle_sack', 'sctp_send_asconf_ack', 'sctp_handle_stream_reset', 'sctp_handle_asconf_ack', 'sctp_handle_cookie_ack', 'sctp_send_heartbeat_ack']	84086	128512	sctp_process_control	call site: 03435	/src/usrsctp/usrsctplib/netinet/sctp_input.c:5364
5201	16060	7 : View List ['sctp_timer_start', 'sctp_stop_timers_for_shutdown', 'sctp_abort_an_association', 'sctp_add_substate', 'sctp_generate_cause', 'sctp_send_shutdown', 'sctp_is_there_unsent_data']	5219	36135	sctp_lower_sosend	call site: 05596	/src/usrsctp/usrsctplib/netinet/sctp_output.c:14699
4925	4925	1 : View List ['sctp_handle_ootb']	4925	5026	sctp_process_control	call site: 02178	/src/usrsctp/usrsctplib/netinet/sctp_input.c:4853
4919	5066	3 : View List ['sctp_generate_cause', 'sctp_abort_association', 'm_freem']	4919	5066	sctp_process_init_ack	call site: 02507	/src/usrsctp/usrsctplib/netinet/sctp_input.c:487
4919	5020	2 : View List ['sctp_generate_cause', 'sctp_abort_association']	4919	5020	sctp_handle_init_ack	call site: 02457	/src/usrsctp/usrsctplib/netinet/sctp_input.c:1371
1380	2848	8 : View List ['sctp_free_bufspace', 'sctp_free_ifa', 'pthread_mutex_trylock', 'sctp_userspace_rtfree', 'sctp_auth_key_release', 'sctp_ulp_notify', 'm_freem', 'terminate_non_graceful.255']	1384	4268	sctp_process_init	call site: 02483	/src/usrsctp/usrsctplib/netinet/sctp_input.c:279
714	714	1 : View List ['sctp_send_ecn_echo']	732	10592	sctp_common_input_processing	call site: 03960	/src/usrsctp/usrsctplib/netinet/sctp_input.c:6137
682	750	5 : View List ['free', 'sctp_userspace_rtfree', 'sctp_auth_key_release', 'sctp_free_ifa', 'm_freem']	682	750	sctp_is_there_unsent_data	call site: 01074	/src/usrsctp/usrsctplib/netinet/sctp_input.c:211
603	603	2 : View List ['sctp_send_shutdown_complete2', 'sctp_send_abort']	621	5643	sctp_common_input_processing	call site: 02111	/src/usrsctp/usrsctplib/netinet/sctp_input.c:5863
310	5261	4 : View List ['sctp_send_shutdown', 'sctp_set_state', 'sctp_chunk_output', 'sctp_stop_timers_for_shutdown']	550	30586	sctp_handle_cookie_ack	call site: 02211	/src/usrsctp/usrsctplib/netinet/sctp_input.c:3187
310	5261	4 : View List ['sctp_chunk_output', 'sctp_set_state', 'sctp_send_shutdown', 'sctp_stop_timers_for_shutdown']	350	56513	sctp_inpcb_free	call site: 00578	/src/usrsctp/usrsctplib/netinet/sctp_pcb.c:3932
294	294	1 : View List ['sctp_notify_authentication']	296	296	sctp_ulp_notify	call site: 00356	/src/usrsctp/usrsctplib/netinet/sctputil.c:4302

Runtime coverage analysis

Covered functions

247

Functions that are reachable but not covered

379

Reachable functions

612

Percentage of reachable functions covered

38.07%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzer/fuzzer_fragment.c	4
usrsctplib/user_socket.c	48
usrsctplib/netinet/sctp_usrreq.c	22
usrsctplib/user_environment.c	2
usrsctplib/netinet/sctp_sysctl.c	1
usrsctplib/netinet/sctp_pcb.c	61
usrsctplib/netinet/sctputil.c	83
usrsctplib/netinet/sctp_callout.c	7
usrsctplib/netinet/sctp_bsd_addr.c	8
usrsctplib/netinet/sctp_userspace.c	4
usrsctplib/user_environment.h	1
usrsctplib/netinet/sctp_output.c	81
usrsctplib/netinet/sctp_auth.c	53
usrsctplib/netinet/sctp_indata.c	35
usrsctplib/user_mbuf.c	33
usrsctplib/netinet/sctp_os_userspace.h	2
usrsctplib/netinet/sctp_timer.c	16
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
usrsctplib/netinet6/sctp6_usrreq.c	5
usrsctplib/netinet/sctp_sha1.c	4
usrsctplib/netinet/sctp_asconf.c	37
usrsctplib/netinet/sctp_crc32.c	7
usrsctplib/netinet/sctp_input.c	40
usrsctplib/user_recv_thread.c	7
/usr/include/x86_64-linux-gnu/bits/socket.h	1

Fuzzer: fuzzer_connect

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4031	65.9%
gold	[1:9]	179	2.92%
yellow	[10:29]	77	1.25%
greenyellow	[30:49]	30	0.49%
lawngreen	50+	1796	29.3%
All colors	6113	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
5295	128500	40 : View List ['sctp_handle_cookie_echo', 'sctp_timer_start', 'sctp_handle_error', 'sctp_handle_heartbeat_ack', 'pthread_mutex_lock', 'sctp_handle_forward_tsn', 'sctp_m_getptr', 'sctp_handle_packet_dropped', 'sctp_abort_an_association', 'sctp_send_abort', 'sctp_handle_ecn_cwr', 'sctp_generate_cause', 'sctp_get_mbuf_for_msg', 'sctp_misc_ints', 'sctp_handle_ecn_echo', 'pthread_mutex_trylock', 'sctp_handle_shutdown_ack', 'sctp_chunk_output', 'sctp_handle_init_ack', 'sctp_abort_association', 'sctp_handle_init', 'sctp_queue_op_err', 'sctp_handle_auth', '__bswap_16.256', 'sctp_free_assoc', 'sctp_handle_shutdown', 'sctp_handle_abort', 'm_freem', 'm_copym', 'sctp_ulp_notify', 'sctp_express_handle_sack', 'sctp_handle_asconf', 'sctp_handle_shutdown_complete', '__bswap_32', 'sctp_handle_sack', 'sctp_send_asconf_ack', 'sctp_handle_stream_reset', 'sctp_handle_asconf_ack', 'sctp_handle_cookie_ack', 'sctp_send_heartbeat_ack']	5307	128512	sctp_process_control	call site: 03434	/src/usrsctp/usrsctplib/netinet/sctp_input.c:5364
5287	5702	5 : View List ['sctp_handle_init', 'sctp_generate_cause', 'pthread_mutex_unlock', 'sctp_send_abort', 'terminate_non_graceful.255']	5287	5702	sctp_process_control	call site: 02250	/src/usrsctp/usrsctplib/netinet/sctp_input.c:4980
1368	1552	12 : View List ['m_copydata', 'free', 'sctp_userspace_rtfree.704', 'sctp_m_getptr', 'terminate_non_graceful.688', 'sctp_free_ifa', 'sctp_get_mbuf_for_msg', '__bswap_16.691', 'pthread_mutex_trylock', 'malloc', '__bswap_32.699', 'sctp_auth_key_release']	1368	1552	sctp_send_packet_dropped	call site: 02082	/src/usrsctp/usrsctplib/netinet/sctp_output.c:12358
875	14908	10 : View List ['sctp_handle_forward_tsn', 'sctp_reset_clear_pending', 'sctp_find_stream_reset', 'sctp_reset_out_streams', '__bswap_32', 'sctp_log_map', 'sctp_clean_up_stream_reset', '__bswap_16.256', 'sctp_ulp_notify', 'sctp_reset_in_stream']	875	19822	sctp_handle_stream_reset_response	call site: 03724	/src/usrsctp/usrsctplib/netinet/sctp_input.c:3850
684	5938	9 : View List ['sctp_timer_start', 'free', 'sctp_userspace_rtfree.704', 'sctp_free_ifa', 'terminate_non_graceful.688', 'pthread_mutex_trylock', 'sctp_auth_key_release', 'sctp_timer_stop', 'm_freem']	684	5938	sctp_send_sack	call site: 00174	/src/usrsctp/usrsctplib/netinet/sctp_output.c:11278
684	703	6 : View List ['free', 'sctp_userspace_rtfree.704', 'sctp_free_ifa', 'terminate_non_graceful.688', 'pthread_mutex_trylock', 'sctp_auth_key_release']	684	703	send_forward_tsn	call site: 01416	/src/usrsctp/usrsctplib/netinet/sctp_output.c:10986
684	703	6 : View List ['free', 'sctp_userspace_rtfree.704', 'sctp_free_ifa', 'terminate_non_graceful.688', 'pthread_mutex_trylock', 'sctp_auth_key_release']	684	703	sctp_send_cwr	call site: 03450	/src/usrsctp/usrsctplib/netinet/sctp_output.c:12525
684	703	6 : View List ['free', 'sctp_userspace_rtfree.704', 'sctp_free_ifa', 'terminate_non_graceful.688', 'pthread_mutex_trylock', 'sctp_auth_key_release']	684	703	sctp_send_deferred_reset_response	call site: 04104	/src/usrsctp/usrsctplib/netinet/sctp_output.c:12749
684	703	5 : View List ['sctp_userspace_rtfree.704', 'sctp_free_ifa', 'terminate_non_graceful.688', 'pthread_mutex_trylock', 'sctp_auth_key_release']	684	703	sctp_send_str_reset_req	call site: 03791	/src/usrsctp/usrsctplib/netinet/sctp_output.c:13006
682	750	5 : View List ['free', 'sctp_userspace_rtfree', 'sctp_auth_key_release', 'sctp_free_ifa', 'm_freem']	682	750	sctp_is_there_unsent_data	call site: 01073	/src/usrsctp/usrsctplib/netinet/sctp_input.c:211
294	294	1 : View List ['sctp_notify_authentication']	296	296	sctp_ulp_notify	call site: 00355	/src/usrsctp/usrsctplib/netinet/sctputil.c:4302
253	6016	4 : View List ['sctp_free_assoc', 'gettimeofday', 'sctp_process_cmsgs_for_init', 'sctp_aloc_assoc_connected']	2036	59817	sctp_lower_sosend	call site: 05485	/src/usrsctp/usrsctplib/netinet/sctp_output.c:13808

Runtime coverage analysis

Covered functions

370

Functions that are reachable but not covered

258

Reachable functions

613

Percentage of reachable functions covered

57.91%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzer/fuzzer_connect.c	5
usrsctplib/user_socket.c	49
usrsctplib/netinet/sctp_usrreq.c	22
usrsctplib/user_environment.c	2
usrsctplib/netinet/sctp_sysctl.c	1
usrsctplib/netinet/sctp_pcb.c	61
usrsctplib/netinet/sctputil.c	83
usrsctplib/netinet/sctp_callout.c	7
usrsctplib/netinet/sctp_bsd_addr.c	8
usrsctplib/netinet/sctp_userspace.c	4
usrsctplib/user_environment.h	1
usrsctplib/netinet/sctp_output.c	81
usrsctplib/netinet/sctp_auth.c	53
usrsctplib/netinet/sctp_indata.c	35
usrsctplib/user_mbuf.c	33
usrsctplib/netinet/sctp_os_userspace.h	2
usrsctplib/netinet/sctp_timer.c	16
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
usrsctplib/netinet6/sctp6_usrreq.c	5
usrsctplib/netinet/sctp_sha1.c	4
usrsctplib/netinet/sctp_asconf.c	37
usrsctplib/netinet/sctp_crc32.c	7
usrsctplib/netinet/sctp_input.c	40
usrsctplib/user_recv_thread.c	7
/usr/include/x86_64-linux-gnu/bits/socket.h	1

Fuzzer: fuzzer/fuzzer_listen.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3389	65.1%
gold	[1:9]	189	3.63%
yellow	[10:29]	36	0.69%
greenyellow	[30:49]	19	0.36%
lawngreen	50+	1567	30.1%
All colors	5200	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1368	1552	12 : View List ['m_copydata', 'free', 'sctp_userspace_rtfree.704', 'sctp_m_getptr', 'terminate_non_graceful.688', 'sctp_free_ifa', 'sctp_get_mbuf_for_msg', '__bswap_16.691', 'pthread_mutex_trylock', 'malloc', '__bswap_32.699', 'sctp_auth_key_release']	1368	1552	sctp_send_packet_dropped	call site: 02083	/src/usrsctp/usrsctplib/netinet/sctp_output.c:12358
1366	2848	8 : View List ['sctp_free_bufspace', 'sctp_free_ifa', 'pthread_mutex_trylock', 'sctp_userspace_rtfree', 'sctp_auth_key_release', 'sctp_ulp_notify', 'm_freem', 'terminate_non_graceful.255']	1370	4268	sctp_process_init	call site: 02483	/src/usrsctp/usrsctplib/netinet/sctp_input.c:279
875	14908	10 : View List ['sctp_handle_forward_tsn', 'sctp_reset_clear_pending', 'sctp_find_stream_reset', 'sctp_reset_out_streams', '__bswap_32', 'sctp_log_map', 'sctp_clean_up_stream_reset', '__bswap_16.256', 'sctp_ulp_notify', 'sctp_reset_in_stream']	875	19822	sctp_handle_stream_reset_response	call site: 03725	/src/usrsctp/usrsctplib/netinet/sctp_input.c:3850
714	714	1 : View List ['sctp_send_ecn_echo']	732	10592	sctp_common_input_processing	call site: 03960	/src/usrsctp/usrsctplib/netinet/sctp_input.c:6137
684	5938	9 : View List ['sctp_timer_start', 'free', 'sctp_userspace_rtfree.704', 'sctp_free_ifa', 'terminate_non_graceful.688', 'pthread_mutex_trylock', 'sctp_auth_key_release', 'sctp_timer_stop', 'm_freem']	684	5938	sctp_send_sack	call site: 00174	/src/usrsctp/usrsctplib/netinet/sctp_output.c:11278
684	703	6 : View List ['free', 'sctp_userspace_rtfree.704', 'sctp_free_ifa', 'terminate_non_graceful.688', 'pthread_mutex_trylock', 'sctp_auth_key_release']	684	703	send_forward_tsn	call site: 01417	/src/usrsctp/usrsctplib/netinet/sctp_output.c:10986
684	703	6 : View List ['free', 'sctp_userspace_rtfree.704', 'sctp_free_ifa', 'terminate_non_graceful.688', 'pthread_mutex_trylock', 'sctp_auth_key_release']	684	703	sctp_send_cwr	call site: 03451	/src/usrsctp/usrsctplib/netinet/sctp_output.c:12525
684	703	6 : View List ['free', 'sctp_userspace_rtfree.704', 'sctp_free_ifa', 'terminate_non_graceful.688', 'pthread_mutex_trylock', 'sctp_auth_key_release']	684	703	sctp_send_deferred_reset_response	call site: 04105	/src/usrsctp/usrsctplib/netinet/sctp_output.c:12749
684	703	5 : View List ['sctp_userspace_rtfree.704', 'sctp_free_ifa', 'terminate_non_graceful.688', 'pthread_mutex_trylock', 'sctp_auth_key_release']	684	703	sctp_send_str_reset_req	call site: 03792	/src/usrsctp/usrsctplib/netinet/sctp_output.c:13006
682	750	5 : View List ['free', 'sctp_userspace_rtfree', 'sctp_auth_key_release', 'sctp_free_ifa', 'm_freem']	682	750	sctp_is_there_unsent_data	call site: 01074	/src/usrsctp/usrsctplib/netinet/sctp_input.c:211
294	294	1 : View List ['sctp_notify_authentication']	296	296	sctp_ulp_notify	call site: 00356	/src/usrsctp/usrsctplib/netinet/sctputil.c:4302
253	6016	4 : View List ['sctp_free_assoc', 'gettimeofday', 'sctp_process_cmsgs_for_init', 'sctp_aloc_assoc_connected']	2036	59817	sctp_lower_sosend	call site: 00000	/src/usrsctp/usrsctplib/netinet/sctp_output.c:13808

Runtime coverage analysis

Covered functions

392

Functions that are reachable but not covered

220

Reachable functions

577

Percentage of reachable functions covered

61.87%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzer/fuzzer_listen.c	4
usrsctplib/user_socket.c	42
usrsctplib/netinet/sctp_usrreq.c	15
usrsctplib/user_environment.c	2
usrsctplib/netinet/sctp_sysctl.c	1
usrsctplib/netinet/sctp_pcb.c	61
usrsctplib/netinet/sctputil.c	78
usrsctplib/netinet/sctp_callout.c	7
usrsctplib/netinet/sctp_bsd_addr.c	8
usrsctplib/netinet/sctp_userspace.c	4
usrsctplib/user_environment.h	1
usrsctplib/netinet/sctp_output.c	69
usrsctplib/netinet/sctp_auth.c	53
usrsctplib/netinet/sctp_indata.c	35
usrsctplib/user_mbuf.c	30
usrsctplib/netinet/sctp_os_userspace.h	2
usrsctplib/netinet/sctp_timer.c	16
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
usrsctplib/netinet6/sctp6_usrreq.c	4
usrsctplib/netinet/sctp_sha1.c	4
usrsctplib/netinet/sctp_asconf.c	37
usrsctplib/netinet/sctp_crc32.c	7
usrsctplib/netinet/sctp_input.c	40
usrsctplib/user_recv_thread.c	7
/usr/include/x86_64-linux-gnu/bits/socket.h	1

Fuzzer: fuzzer/fuzzer_connect.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4293	69.1%
gold	[1:9]	157	2.52%
yellow	[10:29]	36	0.57%
greenyellow	[30:49]	19	0.30%
lawngreen	50+	1705	27.4%
All colors	6210	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1368	1552	12 : View List ['m_copydata', 'free', 'sctp_userspace_rtfree.704', 'sctp_m_getptr', 'terminate_non_graceful.688', 'sctp_free_ifa', 'sctp_get_mbuf_for_msg', '__bswap_16.691', 'pthread_mutex_trylock', 'malloc', '__bswap_32.699', 'sctp_auth_key_release']	1368	1552	sctp_send_packet_dropped	call site: 02089	/src/usrsctp/usrsctplib/netinet/sctp_output.c:12358
1366	2848	8 : View List ['sctp_free_bufspace', 'sctp_free_ifa', 'pthread_mutex_trylock', 'sctp_userspace_rtfree', 'sctp_auth_key_release', 'sctp_ulp_notify', 'm_freem', 'terminate_non_graceful.255']	1370	4268	sctp_process_init	call site: 02489	/src/usrsctp/usrsctplib/netinet/sctp_input.c:279
875	14908	10 : View List ['sctp_handle_forward_tsn', 'sctp_reset_clear_pending', 'sctp_find_stream_reset', 'sctp_reset_out_streams', '__bswap_32', 'sctp_log_map', 'sctp_clean_up_stream_reset', '__bswap_16.256', 'sctp_ulp_notify', 'sctp_reset_in_stream']	875	19822	sctp_handle_stream_reset_response	call site: 03731	/src/usrsctp/usrsctplib/netinet/sctp_input.c:3850
714	714	1 : View List ['sctp_send_ecn_echo']	732	10592	sctp_common_input_processing	call site: 03966	/src/usrsctp/usrsctplib/netinet/sctp_input.c:6137
684	5938	9 : View List ['sctp_timer_start', 'free', 'sctp_userspace_rtfree.704', 'sctp_free_ifa', 'terminate_non_graceful.688', 'pthread_mutex_trylock', 'sctp_auth_key_release', 'sctp_timer_stop', 'm_freem']	684	5938	sctp_send_sack	call site: 00180	/src/usrsctp/usrsctplib/netinet/sctp_output.c:11278
684	703	6 : View List ['free', 'sctp_userspace_rtfree.704', 'sctp_free_ifa', 'terminate_non_graceful.688', 'pthread_mutex_trylock', 'sctp_auth_key_release']	684	703	send_forward_tsn	call site: 01423	/src/usrsctp/usrsctplib/netinet/sctp_output.c:10986
684	703	6 : View List ['free', 'sctp_userspace_rtfree.704', 'sctp_free_ifa', 'terminate_non_graceful.688', 'pthread_mutex_trylock', 'sctp_auth_key_release']	684	703	sctp_send_cwr	call site: 03457	/src/usrsctp/usrsctplib/netinet/sctp_output.c:12525
684	703	6 : View List ['free', 'sctp_userspace_rtfree.704', 'sctp_free_ifa', 'terminate_non_graceful.688', 'pthread_mutex_trylock', 'sctp_auth_key_release']	684	703	sctp_send_deferred_reset_response	call site: 04111	/src/usrsctp/usrsctplib/netinet/sctp_output.c:12749
684	703	5 : View List ['sctp_userspace_rtfree.704', 'sctp_free_ifa', 'terminate_non_graceful.688', 'pthread_mutex_trylock', 'sctp_auth_key_release']	684	703	sctp_send_str_reset_req	call site: 03798	/src/usrsctp/usrsctplib/netinet/sctp_output.c:13006
682	750	5 : View List ['free', 'sctp_userspace_rtfree', 'sctp_auth_key_release', 'sctp_free_ifa', 'm_freem']	682	750	sctp_is_there_unsent_data	call site: 01080	/src/usrsctp/usrsctplib/netinet/sctp_input.c:211
294	294	1 : View List ['sctp_notify_authentication']	296	296	sctp_ulp_notify	call site: 00362	/src/usrsctp/usrsctplib/netinet/sctputil.c:4302
253	6016	4 : View List ['sctp_free_assoc', 'gettimeofday', 'sctp_process_cmsgs_for_init', 'sctp_aloc_assoc_connected']	2036	59817	sctp_lower_sosend	call site: 05578	/src/usrsctp/usrsctplib/netinet/sctp_output.c:13808

Runtime coverage analysis

Covered functions

392

Functions that are reachable but not covered

261

Reachable functions

632

Percentage of reachable functions covered

58.7%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzer/fuzzer_connect.c	5
programs/programs_helper.c	11
usrsctplib/user_socket.c	51
usrsctplib/netinet/sctp_usrreq.c	22
usrsctplib/user_environment.c	2
usrsctplib/netinet/sctp_sysctl.c	1
usrsctplib/netinet/sctp_pcb.c	61
usrsctplib/netinet/sctputil.c	83
usrsctplib/netinet/sctp_callout.c	7
usrsctplib/netinet/sctp_bsd_addr.c	8
usrsctplib/netinet/sctp_userspace.c	4
usrsctplib/user_environment.h	1
usrsctplib/netinet/sctp_output.c	81
usrsctplib/netinet/sctp_auth.c	53
usrsctplib/netinet/sctp_indata.c	35
usrsctplib/user_mbuf.c	33
usrsctplib/netinet/sctp_os_userspace.h	2
usrsctplib/netinet/sctp_timer.c	16
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
usrsctplib/netinet6/sctp6_usrreq.c	5
usrsctplib/netinet/sctp_sha1.c	4
usrsctplib/netinet/sctp_asconf.c	37
usrsctplib/netinet/sctp_crc32.c	7
usrsctplib/netinet/sctp_input.c	40
usrsctplib/user_recv_thread.c	7
/usr/include/x86_64-linux-gnu/bits/socket.h	1

Fuzzer: fuzzer/fuzzer_connect.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4192	68.6%
gold	[1:9]	157	2.57%
yellow	[10:29]	36	0.58%
greenyellow	[30:49]	19	0.31%
lawngreen	50+	1702	27.8%
All colors	6106	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1368	1552	12 : View List ['m_copydata', 'free', 'sctp_userspace_rtfree.704', 'sctp_m_getptr', 'terminate_non_graceful.688', 'sctp_free_ifa', 'sctp_get_mbuf_for_msg', '__bswap_16.691', 'pthread_mutex_trylock', 'malloc', '__bswap_32.699', 'sctp_auth_key_release']	1368	1552	sctp_send_packet_dropped	call site: 02082	/src/usrsctp/usrsctplib/netinet/sctp_output.c:12358
1366	2848	8 : View List ['sctp_free_bufspace', 'sctp_free_ifa', 'pthread_mutex_trylock', 'sctp_userspace_rtfree', 'sctp_auth_key_release', 'sctp_ulp_notify', 'm_freem', 'terminate_non_graceful.255']	1370	4268	sctp_process_init	call site: 02482	/src/usrsctp/usrsctplib/netinet/sctp_input.c:279
875	14908	10 : View List ['sctp_handle_forward_tsn', 'sctp_reset_clear_pending', 'sctp_find_stream_reset', 'sctp_reset_out_streams', '__bswap_32', 'sctp_log_map', 'sctp_clean_up_stream_reset', '__bswap_16.256', 'sctp_ulp_notify', 'sctp_reset_in_stream']	875	19822	sctp_handle_stream_reset_response	call site: 03724	/src/usrsctp/usrsctplib/netinet/sctp_input.c:3850
714	714	1 : View List ['sctp_send_ecn_echo']	732	10592	sctp_common_input_processing	call site: 03959	/src/usrsctp/usrsctplib/netinet/sctp_input.c:6137
684	5938	9 : View List ['sctp_timer_start', 'free', 'sctp_userspace_rtfree.704', 'sctp_free_ifa', 'terminate_non_graceful.688', 'pthread_mutex_trylock', 'sctp_auth_key_release', 'sctp_timer_stop', 'm_freem']	684	5938	sctp_send_sack	call site: 00174	/src/usrsctp/usrsctplib/netinet/sctp_output.c:11278
684	703	6 : View List ['free', 'sctp_userspace_rtfree.704', 'sctp_free_ifa', 'terminate_non_graceful.688', 'pthread_mutex_trylock', 'sctp_auth_key_release']	684	703	send_forward_tsn	call site: 01416	/src/usrsctp/usrsctplib/netinet/sctp_output.c:10986
684	703	6 : View List ['free', 'sctp_userspace_rtfree.704', 'sctp_free_ifa', 'terminate_non_graceful.688', 'pthread_mutex_trylock', 'sctp_auth_key_release']	684	703	sctp_send_cwr	call site: 03450	/src/usrsctp/usrsctplib/netinet/sctp_output.c:12525
684	703	6 : View List ['free', 'sctp_userspace_rtfree.704', 'sctp_free_ifa', 'terminate_non_graceful.688', 'pthread_mutex_trylock', 'sctp_auth_key_release']	684	703	sctp_send_deferred_reset_response	call site: 04104	/src/usrsctp/usrsctplib/netinet/sctp_output.c:12749
684	703	5 : View List ['sctp_userspace_rtfree.704', 'sctp_free_ifa', 'terminate_non_graceful.688', 'pthread_mutex_trylock', 'sctp_auth_key_release']	684	703	sctp_send_str_reset_req	call site: 03791	/src/usrsctp/usrsctplib/netinet/sctp_output.c:13006
682	750	5 : View List ['free', 'sctp_userspace_rtfree', 'sctp_auth_key_release', 'sctp_free_ifa', 'm_freem']	682	750	sctp_is_there_unsent_data	call site: 01073	/src/usrsctp/usrsctplib/netinet/sctp_input.c:211
294	294	1 : View List ['sctp_notify_authentication']	296	296	sctp_ulp_notify	call site: 00355	/src/usrsctp/usrsctplib/netinet/sctputil.c:4302
253	6016	4 : View List ['sctp_free_assoc', 'gettimeofday', 'sctp_process_cmsgs_for_init', 'sctp_aloc_assoc_connected']	2036	59817	sctp_lower_sosend	call site: 05482	/src/usrsctp/usrsctplib/netinet/sctp_output.c:13808

Runtime coverage analysis

Covered functions

392

Functions that are reachable but not covered

241

Reachable functions

611

Percentage of reachable functions covered

60.56%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzer/fuzzer_connect.c	4
usrsctplib/user_socket.c	49
usrsctplib/netinet/sctp_usrreq.c	22
usrsctplib/user_environment.c	2
usrsctplib/netinet/sctp_sysctl.c	1
usrsctplib/netinet/sctp_pcb.c	61
usrsctplib/netinet/sctputil.c	83
usrsctplib/netinet/sctp_callout.c	7
usrsctplib/netinet/sctp_bsd_addr.c	8
usrsctplib/netinet/sctp_userspace.c	4
usrsctplib/user_environment.h	1
usrsctplib/netinet/sctp_output.c	81
usrsctplib/netinet/sctp_auth.c	53
usrsctplib/netinet/sctp_indata.c	35
usrsctplib/user_mbuf.c	33
usrsctplib/netinet/sctp_os_userspace.h	2
usrsctplib/netinet/sctp_timer.c	16
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
usrsctplib/netinet6/sctp6_usrreq.c	5
usrsctplib/netinet/sctp_sha1.c	4
usrsctplib/netinet/sctp_asconf.c	37
usrsctplib/netinet/sctp_crc32.c	7
usrsctplib/netinet/sctp_input.c	40
usrsctplib/user_recv_thread.c	7
/usr/include/x86_64-linux-gnu/bits/socket.h	1

Fuzzer: fuzzer/fuzzer_listen.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3402	65.2%
gold	[1:9]	187	3.58%
yellow	[10:29]	36	0.69%
greenyellow	[30:49]	19	0.36%
lawngreen	50+	1568	30.0%
All colors	5212	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1368	1552	12 : View List ['m_copydata', 'free', 'sctp_userspace_rtfree.704', 'sctp_m_getptr', 'terminate_non_graceful.688', 'sctp_free_ifa', 'sctp_get_mbuf_for_msg', '__bswap_16.691', 'pthread_mutex_trylock', 'malloc', '__bswap_32.699', 'sctp_auth_key_release']	1368	1552	sctp_send_packet_dropped	call site: 02083	/src/usrsctp/usrsctplib/netinet/sctp_output.c:12358
1366	2848	8 : View List ['sctp_free_bufspace', 'sctp_free_ifa', 'pthread_mutex_trylock', 'sctp_userspace_rtfree', 'sctp_auth_key_release', 'sctp_ulp_notify', 'm_freem', 'terminate_non_graceful.255']	1370	4268	sctp_process_init	call site: 02483	/src/usrsctp/usrsctplib/netinet/sctp_input.c:279
875	14908	10 : View List ['sctp_handle_forward_tsn', 'sctp_reset_clear_pending', 'sctp_find_stream_reset', 'sctp_reset_out_streams', '__bswap_32', 'sctp_log_map', 'sctp_clean_up_stream_reset', '__bswap_16.256', 'sctp_ulp_notify', 'sctp_reset_in_stream']	875	19822	sctp_handle_stream_reset_response	call site: 03725	/src/usrsctp/usrsctplib/netinet/sctp_input.c:3850
714	714	1 : View List ['sctp_send_ecn_echo']	732	10592	sctp_common_input_processing	call site: 03960	/src/usrsctp/usrsctplib/netinet/sctp_input.c:6137
684	5938	9 : View List ['sctp_timer_start', 'free', 'sctp_userspace_rtfree.704', 'sctp_free_ifa', 'terminate_non_graceful.688', 'pthread_mutex_trylock', 'sctp_auth_key_release', 'sctp_timer_stop', 'm_freem']	684	5938	sctp_send_sack	call site: 00174	/src/usrsctp/usrsctplib/netinet/sctp_output.c:11278
684	703	6 : View List ['free', 'sctp_userspace_rtfree.704', 'sctp_free_ifa', 'terminate_non_graceful.688', 'pthread_mutex_trylock', 'sctp_auth_key_release']	684	703	send_forward_tsn	call site: 01417	/src/usrsctp/usrsctplib/netinet/sctp_output.c:10986
684	703	6 : View List ['free', 'sctp_userspace_rtfree.704', 'sctp_free_ifa', 'terminate_non_graceful.688', 'pthread_mutex_trylock', 'sctp_auth_key_release']	684	703	sctp_send_cwr	call site: 03451	/src/usrsctp/usrsctplib/netinet/sctp_output.c:12525
684	703	6 : View List ['free', 'sctp_userspace_rtfree.704', 'sctp_free_ifa', 'terminate_non_graceful.688', 'pthread_mutex_trylock', 'sctp_auth_key_release']	684	703	sctp_send_deferred_reset_response	call site: 04105	/src/usrsctp/usrsctplib/netinet/sctp_output.c:12749
684	703	5 : View List ['sctp_userspace_rtfree.704', 'sctp_free_ifa', 'terminate_non_graceful.688', 'pthread_mutex_trylock', 'sctp_auth_key_release']	684	703	sctp_send_str_reset_req	call site: 03792	/src/usrsctp/usrsctplib/netinet/sctp_output.c:13006
682	750	5 : View List ['free', 'sctp_userspace_rtfree', 'sctp_auth_key_release', 'sctp_free_ifa', 'm_freem']	682	750	sctp_is_there_unsent_data	call site: 01074	/src/usrsctp/usrsctplib/netinet/sctp_input.c:211
294	294	1 : View List ['sctp_notify_authentication']	296	296	sctp_ulp_notify	call site: 00356	/src/usrsctp/usrsctplib/netinet/sctputil.c:4302
253	6016	4 : View List ['sctp_free_assoc', 'gettimeofday', 'sctp_process_cmsgs_for_init', 'sctp_aloc_assoc_connected']	2036	59817	sctp_lower_sosend	call site: 00000	/src/usrsctp/usrsctplib/netinet/sctp_output.c:13808

Runtime coverage analysis

Covered functions

392

Functions that are reachable but not covered

228

Reachable functions

586

Percentage of reachable functions covered

61.09%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzer/fuzzer_listen.c	5
usrsctplib/user_socket.c	44
usrsctplib/netinet/sctp_usrreq.c	15
usrsctplib/user_environment.c	2
usrsctplib/netinet/sctp_sysctl.c	1
usrsctplib/netinet/sctp_pcb.c	61
usrsctplib/netinet/sctputil.c	78
usrsctplib/netinet/sctp_callout.c	7
usrsctplib/netinet/sctp_bsd_addr.c	8
usrsctplib/netinet/sctp_userspace.c	4
usrsctplib/user_environment.h	1
usrsctplib/netinet/sctp_output.c	69
usrsctplib/netinet/sctp_auth.c	53
usrsctplib/netinet/sctp_indata.c	35
usrsctplib/user_mbuf.c	30
usrsctplib/netinet/sctp_os_userspace.h	2
usrsctplib/netinet/sctp_timer.c	16
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
usrsctplib/netinet6/sctp6_usrreq.c	4
usrsctplib/netinet/sctp_sha1.c	4
usrsctplib/netinet/sctp_asconf.c	37
usrsctplib/netinet/sctp_crc32.c	7
usrsctplib/netinet/sctp_input.c	40
usrsctplib/user_recv_thread.c	7
/usr/include/x86_64-linux-gnu/bits/socket.h	1
programs/programs_helper.c	1

Fuzzer: fuzzer/fuzzer_fragment.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4164	68.2%
gold	[1:9]	163	2.67%
yellow	[10:29]	36	0.58%
greenyellow	[30:49]	19	0.31%
lawngreen	50+	1721	28.1%
All colors	6103	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1368	1552	12 : View List ['m_copydata', 'free', 'sctp_userspace_rtfree.704', 'sctp_m_getptr', 'terminate_non_graceful.688', 'sctp_free_ifa', 'sctp_get_mbuf_for_msg', '__bswap_16.691', 'pthread_mutex_trylock', 'malloc', '__bswap_32.699', 'sctp_auth_key_release']	1368	1552	sctp_send_packet_dropped	call site: 02083	/src/usrsctp/usrsctplib/netinet/sctp_output.c:12358
1366	2848	8 : View List ['sctp_free_bufspace', 'sctp_free_ifa', 'pthread_mutex_trylock', 'sctp_userspace_rtfree', 'sctp_auth_key_release', 'sctp_ulp_notify', 'm_freem', 'terminate_non_graceful.255']	1370	4268	sctp_process_init	call site: 02483	/src/usrsctp/usrsctplib/netinet/sctp_input.c:279
875	14908	10 : View List ['sctp_handle_forward_tsn', 'sctp_reset_clear_pending', 'sctp_find_stream_reset', 'sctp_reset_out_streams', '__bswap_32', 'sctp_log_map', 'sctp_clean_up_stream_reset', '__bswap_16.256', 'sctp_ulp_notify', 'sctp_reset_in_stream']	875	19822	sctp_handle_stream_reset_response	call site: 03725	/src/usrsctp/usrsctplib/netinet/sctp_input.c:3850
714	714	1 : View List ['sctp_send_ecn_echo']	732	10592	sctp_common_input_processing	call site: 03960	/src/usrsctp/usrsctplib/netinet/sctp_input.c:6137
684	5938	9 : View List ['sctp_timer_start', 'free', 'sctp_userspace_rtfree.704', 'sctp_free_ifa', 'terminate_non_graceful.688', 'pthread_mutex_trylock', 'sctp_auth_key_release', 'sctp_timer_stop', 'm_freem']	684	5938	sctp_send_sack	call site: 00174	/src/usrsctp/usrsctplib/netinet/sctp_output.c:11278
684	703	6 : View List ['free', 'sctp_userspace_rtfree.704', 'sctp_free_ifa', 'terminate_non_graceful.688', 'pthread_mutex_trylock', 'sctp_auth_key_release']	684	703	send_forward_tsn	call site: 01417	/src/usrsctp/usrsctplib/netinet/sctp_output.c:10986
684	703	6 : View List ['free', 'sctp_userspace_rtfree.704', 'sctp_free_ifa', 'terminate_non_graceful.688', 'pthread_mutex_trylock', 'sctp_auth_key_release']	684	703	sctp_send_cwr	call site: 03451	/src/usrsctp/usrsctplib/netinet/sctp_output.c:12525
684	703	6 : View List ['free', 'sctp_userspace_rtfree.704', 'sctp_free_ifa', 'terminate_non_graceful.688', 'pthread_mutex_trylock', 'sctp_auth_key_release']	684	703	sctp_send_deferred_reset_response	call site: 04105	/src/usrsctp/usrsctplib/netinet/sctp_output.c:12749
684	703	5 : View List ['sctp_userspace_rtfree.704', 'sctp_free_ifa', 'terminate_non_graceful.688', 'pthread_mutex_trylock', 'sctp_auth_key_release']	684	703	sctp_send_str_reset_req	call site: 03792	/src/usrsctp/usrsctplib/netinet/sctp_output.c:13006
682	750	5 : View List ['free', 'sctp_userspace_rtfree', 'sctp_auth_key_release', 'sctp_free_ifa', 'm_freem']	682	750	sctp_is_there_unsent_data	call site: 01074	/src/usrsctp/usrsctplib/netinet/sctp_input.c:211
294	294	1 : View List ['sctp_notify_authentication']	296	296	sctp_ulp_notify	call site: 00356	/src/usrsctp/usrsctplib/netinet/sctputil.c:4302
253	6016	4 : View List ['sctp_free_assoc', 'gettimeofday', 'sctp_process_cmsgs_for_init', 'sctp_aloc_assoc_connected']	2036	59817	sctp_lower_sosend	call site: 05482	/src/usrsctp/usrsctplib/netinet/sctp_output.c:13808

Runtime coverage analysis

Covered functions

392

Functions that are reachable but not covered

241

Reachable functions

611

Percentage of reachable functions covered

60.56%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzer/fuzzer_fragment.c	4
usrsctplib/user_socket.c	48
usrsctplib/netinet/sctp_usrreq.c	22
usrsctplib/user_environment.c	2
usrsctplib/netinet/sctp_sysctl.c	1
usrsctplib/netinet/sctp_pcb.c	61
usrsctplib/netinet/sctputil.c	83
usrsctplib/netinet/sctp_callout.c	7
usrsctplib/netinet/sctp_bsd_addr.c	8
usrsctplib/netinet/sctp_userspace.c	4
usrsctplib/user_environment.h	1
usrsctplib/netinet/sctp_output.c	81
usrsctplib/netinet/sctp_auth.c	53
usrsctplib/netinet/sctp_indata.c	35
usrsctplib/user_mbuf.c	33
usrsctplib/netinet/sctp_os_userspace.h	2
usrsctplib/netinet/sctp_timer.c	16
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2
usrsctplib/netinet6/sctp6_usrreq.c	5
usrsctplib/netinet/sctp_sha1.c	4
usrsctplib/netinet/sctp_asconf.c	37
usrsctplib/netinet/sctp_crc32.c	7
usrsctplib/netinet/sctp_input.c	40
usrsctplib/user_recv_thread.c	7
/usr/include/x86_64-linux-gnu/bits/socket.h	1

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
userspace_shutdown	/src/usrsctp/usrsctplib/user_socket.c	2	['N/A', 'int']	18	0	14	3	2	256	0	5027	145
sctp_drain_mbufs	/src/usrsctp/usrsctplib/netinet/sctp_pcb.c	1	['N/A']	22	0	1738	326	112	253	1	4994	112
sctp_cwnd_update_rtcc_after_sack	/src/usrsctp/usrsctplib/netinet/sctp_cc_functions.c	5	['N/A', 'N/A', 'int', 'int', 'int']	4	0	17	3	2	7	0	109	107
sctp6_in6getaddr	/src/usrsctp/usrsctplib/netinet6/sctp6_usrreq.c	2	['N/A', 'N/A']	6	0	57	11	5	39	0	436	60
sctp_htcp_cwnd_update_after_sack	/src/usrsctp/usrsctplib/netinet/sctp_cc_functions.c	5	['N/A', 'N/A', 'int', 'int', 'int']	7	0	136	31	13	14	0	84	58
m_pulldown	/src/usrsctp/usrsctplib/user_mbuf.c	4	['N/A', 'int', 'int', 'N/A']	8	0	550	108	43	23	0	182	53
usrsctp_peeloff	/src/usrsctp/usrsctplib/user_socket.c	2	['N/A', 'int']	21	0	291	58	21	291	0	5319	50
sctp6_getpeeraddr	/src/usrsctp/usrsctplib/netinet6/sctp6_usrreq.c	2	['N/A', 'N/A']	3	0	57	11	5	7	0	57	47
sctp_sendm	/src/usrsctp/usrsctplib/netinet/sctp_usrreq.c	6	['N/A', 'int', 'N/A', 'N/A', 'N/A', 'N/A']	26	0	138	30	12	316	0	6511	43

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

629 / 900

Cyclomatic complexity statically reachable by fuzzers

17326 / 18690

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

fuzzer/fuzzer_listen.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['sctp_lowlevel_chunk_output', 'usrsctp_setsockopt', 'sctp_process_control', 'sctp_alloc_chunklist', 'sctp_inpcb_bind_locked', 'm_copydata', 'sctp_common_input_processing', 'sctp_generate_cause', 'sctp_setopt', 'sctp_handle_init']

fuzzer/fuzzer_fragment.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['usrsctp_sendv', 'sctp_process_control', 'sctp_setopt', 'sctp_inpcb_free', 'sctp_initialize_auth_params', 'sctp_common_input_processing', 'sctp_notify_adaptation_layer', 'sctp_aloc_assoc_connected']

fuzzer/fuzzer_connect.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['usrsctp_sendv', 'sctp_setopt', 'sctp_send_cookie_ack', 'sctp_aloc_assoc_connected', 'soconnect', 'sctp_handle_sack', 'sctpconn_attach', 'send_forward_tsn']

fuzzer/fuzzer_listen.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['sctp_setopt', 'sctp_send_cookie_ack', 'sctp_aloc_assoc_connected', 'sctp_handle_sack', 'sctpconn_attach', 'send_forward_tsn', 'init_fuzzer', 'sctp_iterator_thread']

fuzzer/fuzzer_connect.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['usrsctp_sendv', 'sctp_setopt', 'sctp_send_cookie_ack', 'sctp_aloc_assoc_connected', 'soconnect', 'sctp_handle_sack', 'sctpconn_attach', 'usrsctp_recvv', 'send_forward_tsn']

fuzzer/fuzzer_connect.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['usrsctp_sendv', 'sctp_setopt', 'sctp_send_cookie_ack', 'sctp_aloc_assoc_connected', 'soconnect', 'sctp_handle_sack', 'sctpconn_attach', 'send_forward_tsn']

fuzzer/fuzzer_listen.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['sctp_setopt', 'sctp_send_cookie_ack', 'sctp_aloc_assoc_connected', 'sctp_handle_sack', 'sctpconn_attach', 'send_forward_tsn', 'init_fuzzer', 'sctp_iterator_thread']

fuzzer/fuzzer_fragment.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['usrsctp_sendv', 'sctp_setopt', 'sctp_send_cookie_ack', 'sctp_aloc_assoc_connected', 'soconnect', 'sctp_handle_sack', 'sctpconn_attach', 'send_forward_tsn']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
sctp_insert_sharedkey	34	7	20.58%	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
sctp_handle_cookie_echo	370	144	38.91%	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
sctp_add_addresses_to_i_ia	150	25	16.66%	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
sctp_lowlevel_chunk_output	541	216	39.92%	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
sctp_send_resp_msg	242	114	47.10%	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
sctp_add_addr_to_vrf	225	104	46.22%	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
sctp_findassociation_ep_addr	291	80	27.49%	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
sctp_pcb_findep	59	31	52.54%	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
sctp_inpcb_bind_locked	264	88	33.33%	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
sctp_tcb_special_locate	211	24	11.37%	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
sctp_endpoint_probe	179	74	41.34%	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
sctp_findassoc_by_vtag	70	35	50.0%	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
sctp_setopt	2815	258	9.165%	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
sctp_listen	153	35	22.87%	['fuzzer_listen', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_listen.c']
sctp_timer_start	296	153	51.68%	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
recv_thread_init	204	80	39.21%	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
socreate	48	22	45.83%	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
usrsctp_setsockopt	71	27	38.02%	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
sctp_is_there_unsent_data	50	25	50.0%	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
sctp_chunk_output	169	80	47.33%	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
sctp_lower_sosend	996	311	31.22%	['fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
sctp_move_to_outqueue	354	194	54.80%	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
sctp_set_prsctp_policy	35	6	17.14%	['fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
sctp_findasoc_ep_asocid_locked	31	11	35.48%	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
sctp_inpcb_free	259	127	49.03%	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
sctp_does_stcb_own_this_addr	166	52	31.32%	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
sctp_iterator_inp_being_freed	31	8	25.80%	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
sctp_aloc_assoc_locked	172	65	37.79%	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
sctpconn_connect	103	54	52.42%	['fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
sctp_invoke_recv_callback	88	7	7.954%	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
sctp_sorecvmsg	734	342	46.59%	['fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
sofree	37	18	48.64%	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
usrsctp_sendv	102	34	33.33%	['fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
user_connect	48	13	27.08%	['fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
sctp_handle_asconf_ack	116	19	16.37%	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
sctp_asconf_send_nat_state_update	166	45	27.10%	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
sctp_handle_auth	83	18	21.68%	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
sctp_express_handle_sack	387	47	12.14%	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
sctp_handle_sack	591	60	10.15%	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
sctp_add_chk_to_control	58	28	48.27%	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
sctp_kick_prsctp_reorder_queue	108	16	14.81%	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
sctp_handle_shutdown_ack	43	16	37.20%	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
sctp_handle_stream_reset_response	131	16	12.21%	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
process_chunk_drop	189	96	50.79%	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
send_forward_tsn	163	78	47.85%	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
sctp_send_packet_dropped	119	17	14.28%	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
sctp_is_ifa_addr_preferred	53	5	9.433%	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
sctp_is_ifa_addr_acceptable	39	7	17.94%	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
sctp_choose_boundspecific_stcb	120	61	50.83%	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
sctp_find_alternate_net	176	62	35.22%	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']
sctp_timeout_handler	329	99	30.09%	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_connect.c', '/src/usrsctp/fuzzer/fuzzer_listen.c', '/src/usrsctp/fuzzer/fuzzer_fragment.c']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/usrsctp/fuzzer/fuzzer_connect.c	['fuzzer_connect', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_connect.c']	['fuzzer_connect', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_connect.c']
/src/usrsctp/usrsctplib/netinet/sctp_cc_functions.c	[]	[]
/src/usrsctp/usrsctplib/netinet/sctp_usrreq.c	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_fragment.c']	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_fragment.c']
/src/usrsctp/usrsctplib/netinet/sctp_ss_functions.c	[]	[]
/src/usrsctp/usrsctplib/user_environment.h	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_fragment.c']	[]
/src/usrsctp/usrsctplib/netinet/sctp_asconf.c	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_fragment.c']	['fuzzer_connect', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_fragment.c']
/src/usrsctp/usrsctplib/netinet6/sctp6_usrreq.c	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_fragment.c']	[]
/src/usrsctp/usrsctplib/user_environment.c	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_fragment.c']	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_fragment.c']
/src/usrsctp/fuzzer/fuzzer_fragment.c	['fuzzer_fragment', 'fuzzer/fuzzer_fragment.c']	['fuzzer_fragment', 'fuzzer/fuzzer_fragment.c']
/src/usrsctp/usrsctplib/netinet/sctp_sha1.c	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_fragment.c']	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_fragment.c']
/usr/include/x86_64-linux-gnu/bits/socket.h	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_fragment.c']	[]
/src/usrsctp/usrsctplib/netinet/sctp_userspace.c	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_fragment.c']	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_fragment.c']
/src/usrsctp/fuzzer/fuzzer_listen.c	['fuzzer_listen', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_listen.c']	['fuzzer_listen', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_listen.c']
/src/usrsctp/usrsctplib/netinet/sctp_timer.c	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_fragment.c']	['fuzzer_connect', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_fragment.c']
/src/usrsctp/usrsctplib/netinet/sctp_sysctl.c	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_fragment.c']	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_fragment.c']
/src/usrsctp/usrsctplib/netinet/sctp_callout.c	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_fragment.c']	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_fragment.c']
/src/usrsctp/usrsctplib/user_recv_thread.c	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_fragment.c']	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_fragment.c']
/src/usrsctp/usrsctplib/netinet/sctp_bsd_addr.c	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_fragment.c']	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_fragment.c']
/src/usrsctp/usrsctplib/netinet/sctp_auth.c	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_fragment.c']	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_fragment.c']
/src/usrsctp/usrsctplib/user_mbuf.c	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_fragment.c']	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_fragment.c']
/src/usrsctp/usrsctplib/netinet/sctp_input.c	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_fragment.c']	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_fragment.c']
/src/usrsctp/programs/programs_helper.c	['fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_listen.c']	[]
/src/usrsctp/usrsctplib/netinet/sctp_peeloff.c	[]	[]
/src/usrsctp/usrsctplib/netinet/sctp_os_userspace.h	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_fragment.c']	['fuzzer_fragment', 'fuzzer_connect', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_fragment.c']
/src/usrsctp/usrsctplib/netinet/sctp_indata.c	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_fragment.c']	['fuzzer_fragment', 'fuzzer_connect', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_fragment.c']
/src/usrsctp/usrsctplib/netinet/sctp_pcb.c	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_fragment.c']	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_fragment.c']
/src/usrsctp/usrsctplib/user_socket.c	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_fragment.c']	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_fragment.c']
/src/usrsctp/usrsctplib/netinet/sctp_output.c	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_fragment.c']	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_fragment.c']
/src/usrsctp/usrsctplib/netinet/sctputil.c	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_fragment.c']	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_fragment.c']
/usr/include/x86_64-linux-gnu/bits/byteswap.h	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_fragment.c']	[]
/src/usrsctp/usrsctplib/netinet/sctp_crc32.c	['fuzzer_listen', 'fuzzer_fragment', 'fuzzer_connect', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_connect.c', 'fuzzer/fuzzer_listen.c', 'fuzzer/fuzzer_fragment.c']	[]

Directories in report

Directory
/src/usrsctp/programs/
/src/usrsctp/usrsctplib/netinet6/
/src/usrsctp/fuzzer/
/src/usrsctp/usrsctplib/netinet/
/src/usrsctp/usrsctplib/
/usr/include/x86_64-linux-gnu/bits/