High level conclusions

Fuzzers reach 71.82% code coverage.

Fuzzers reach 61.60% of cyclomatic complexity.

Fuzzers reach 58.75% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

463 / 788

Cyclomatic complexity statically reachable by fuzzers

3108 / 5045

Runtime code coverage of functions

566 / 788

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzzer-cliconf

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	566	76.0%
gold	[1:9]	52	6.98%
yellow	[10:29]	2	0.26%
greenyellow	[30:49]	1	0.13%
lawngreen	50+	123	16.5%
All colors	744	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
689	698	4 : View List ['addrandom', 'buf_getptr', 'buf_setpos', 'buf_get_priv_key']	689	713	readhostkey	call site: 00172	/src/dropbear/src/common-runopts.c:46
103	114	5 : View List ['check_user_algos', 'strcmp', 'algolist_string', 'm_free_direct', 'dropbear_log']	103	118	parse_ciphers_macs	call site: 00586	/src/dropbear/src/common-runopts.c:81
57	57	3 : View List ['multihop_passthrough_args', 'strlen', 'm_realloc']	57	75	parse_multihop_hostname	call site: 00692	/src/dropbear/src/cli-runopts.c:668
39	39	1 : View List ['split_address_port']	86	935	cli_getopts	call site: 00660	/src/dropbear/src/cli-runopts.c:463
21	21	1 : View List ['parse_recv_window']	47	892	cli_getopts	call site: 00672	/src/dropbear/src/cli-runopts.c:486
20	32	3 : View List ['strlen', 'strlcat', 'm_malloc']	106	983	cli_getopts	call site: 00654	/src/dropbear/src/cli-runopts.c:435
20	29	2 : View List ['m_free_direct', 'm_mp_free_multi']	20	29	dss_key_free	call site: 00212	/src/dropbear/src/dss.c:125
20	29	2 : View List ['m_free_direct', 'm_mp_free_multi']	20	29	rsa_key_free	call site: 00275	/src/dropbear/src/rsa.c:146
15	15	1 : View List ['list_append']	15	15	loadidentityfile	call site: 00168	/src/dropbear/src/cli-runopts.c:540
13	15	2 : View List ['m_str_to_uint', 'dropbear_exit']	13	856	cli_getopts	call site: 00677	/src/dropbear/src/cli-runopts.c:497
12	12	1 : View List ['ecc_free']	12	64	sign_key_free	call site: 00507	/src/dropbear/src/signkey.c:530
10	47	4 : View List ['__errno_location', 'buf_getwriteptr', 'buf_incrwritepos', 'wrapfd_read']	10	70	buf_readfile	call site: 00177	/src/dropbear/src/dbutil.c:501

Runtime coverage analysis

Covered functions

69

Functions that are reachable but not covered

140

Reachable functions

206

Percentage of reachable functions covered

32.04%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-cliconf.c	2
src/../fuzz/fuzz-common.c	3
src/dbutil.c	10
src/dbmalloc.c	12
src/crypto_desc.c	2
libtomcrypt/src/misc/crypt/crypt_register_cipher.c	1
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
libtomcrypt/src/misc/crypt/crypt_register_hash.c	1
libtomcrypt/src/misc/crypt/crypt_register_prng.c	1
libtommath/bn_mp_rand.c	1
src/dbrandom.c	7
libtomcrypt/src/hashes/sha2/sha256.c	4
src/../fuzz/fuzz-wrapfd.c	5
src/buffer.c	21
src/dbhelpers.c	1
src/ecc.c	4
src/cli-runopts.c	13
src/list.c	2
src/common-runopts.c	5
src/signkey.c	5
src/dss.c	3
src/bignum.c	2
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_init.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_cmp_d.c	1
libtommath/bn_mp_cmp.c	1
libtommath/bn_mp_cmp_mag.c	1
src/rsa.c	3
src/ecdsa.c	3
libtomcrypt/src/pk/ecc/ecc_free.c	1
libtomcrypt/src/math/multi.c	1
libtommath/bn_mp_set.c	1
libtommath/bn_mp_read_radix.c	1
libtommath/bn_mp_mul_d.c	1
libtommath/bn_mp_add_d.c	1
libtommath/bn_mp_sub_d.c	1
libtommath/bn_mp_sqr.c	1
libtommath/bn_s_mp_sqr_fast.c	1
libtommath/bn_s_mp_sqr.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_exch.c	1
libtommath/bn_mp_mod.c	1
libtommath/bn_mp_div.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_sub.c	1
libtommath/bn_s_mp_add.c	1
libtommath/bn_s_mp_sub.c	1
libtommath/bn_mp_rshd.c	1
libtommath/bn_mp_add.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_mul.c	1
libtommath/bn_s_mp_balance_mul.c	1
libtommath/bn_mp_init_multi.c	1
libtommath/bn_s_mp_mul_digs_fast.c	1
libtommath/bn_s_mp_mul_digs.c	1
libtommath/bn_mp_clear_multi.c	1
src/ed25519.c	2
src/common-algo.c	5
src/cli-readconf.c	1
src/compat.c	1

Fuzzer: fuzzer-kexcurve25519

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	77	33.0%
gold	[1:9]	1	0.42%
yellow	[10:29]	1	0.42%
greenyellow	[30:49]	10	4.29%
lawngreen	50+	144	61.8%
All colors	233	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
152	152	1 : View List ['buf_put_dss_pub_key']	356	421	buf_put_pub_key	call site: 00127	/src/dropbear/src/signkey.c:427
152	152	1 : View List ['buf_put_rsa_pub_key']	204	269	buf_put_pub_key	call site: 00128	/src/dropbear/src/signkey.c:432
99	99	1 : View List ['load_banner']	174	190	svr_getopts	call site: 00000	/src/dropbear/src/svr-runopts.c:385
53	71	3 : View List ['sign_key_free', 'm_free_direct', 'exit']	53	71	svr_dropbear_exit	call site: 00000	/src/dropbear/src/svr-session.c:294
52	65	2 : View List ['signkey_key_ptr', 'buf_put_ecdsa_pub_key']	52	114	buf_put_pub_key	call site: 00177	/src/dropbear/src/signkey.c:437
21	21	1 : View List ['parse_recv_window']	73	87	svr_getopts	call site: 00000	/src/dropbear/src/svr-runopts.c:401
20	29	2 : View List ['m_free_direct', 'm_mp_free_multi']	20	29	dss_key_free	call site: 00000	/src/dropbear/src/dss.c:125
20	29	2 : View List ['m_free_direct', 'm_mp_free_multi']	20	29	rsa_key_free	call site: 00000	/src/dropbear/src/rsa.c:146
20	20	1 : View List ['m_mp_free_multi']	20	20	buf_get_dss_priv_key	call site: 00000	/src/dropbear/src/dss.c:113
20	20	1 : View List ['m_mp_free_multi']	20	20	buf_get_rsa_priv_key	call site: 00000	/src/dropbear/src/rsa.c:133
15	27	5 : View List ['fuzz_getpwuid', 'getenv', 'm_malloc', 'strlen', 'getuid']	15	43	expand_homedir_path	call site: 00000	/src/dropbear/src/dbutil.c:644
13	13	1 : View List ['m_str_to_uint']	13	17	svr_getopts	call site: 00000	/src/dropbear/src/svr-runopts.c:439

Runtime coverage analysis

Covered functions

138

Functions that are reachable but not covered

23

Reachable functions

100

Percentage of reachable functions covered

77.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-kexcurve25519.c	1
src/../fuzz/fuzz-common.c	1
src/../fuzz/fuzz-wrapfd.c	3
src/dbrandom.c	1
libtomcrypt/src/hashes/sha2/sha256.c	4
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
src/dbmalloc.c	11
src/buffer.c	20
src/dbutil.c	3
src/common-kex.c	2
src/curve25519.c	10
src/bignum.c	2
libtommath/bn_mp_init.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
src/dbhelpers.c	1
src/signkey.c	2
src/dss.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_to_ubin.c	1
libtommath/bn_mp_ubin_size.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_rshd.c	1
src/rsa.c	1
src/ecdsa.c	2
src/ecc.c	2
libtomcrypt/src/pk/ecc/ecc_ansi_x963_export.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_is_valid_idx.c	1
libtomcrypt/src/misc/zeromem.c	1
src/ed25519.c	1

Fuzzer: fuzzer-pubkey

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	106	36.0%
gold	[1:9]	21	7.14%
yellow	[10:29]	3	1.02%
greenyellow	[30:49]	5	1.70%
lawngreen	50+	159	54.0%
All colors	294	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
62	62	1 : View List ['sign_key_fingerprint']	66	102	cmp_base64_key	call site: 00193	/src/dropbear/src/signkey.c:750
2	2	1 : View List ['exit']	2	2	generic_dropbear_exit	call site: 00000	/src/dropbear/src/dbutil.c:124
0	2	1 : View List ['dropbear_exit']	0	2	buf_new	call site: 00125	/src/dropbear/src/buffer.c:43
0	2	1 : View List ['dropbear_exit']	0	2	buf_setlen	call site: 00182	/src/dropbear/src/buffer.c:96
0	2	1 : View List ['dropbear_exit']	0	2	buf_incrlen	call site: 00136	/src/dropbear/src/buffer.c:105
0	2	1 : View List ['dropbear_exit']	0	2	buf_setpos	call site: 00138	/src/dropbear/src/buffer.c:113
0	2	1 : View List ['dropbear_exit']	0	2	buf_incrwritepos	call site: 00131	/src/dropbear/src/buffer.c:121
0	2	1 : View List ['dropbear_exit']	0	2	buf_incrpos	call site: 00063	/src/dropbear/src/buffer.c:132
0	2	1 : View List ['dropbear_exit']	0	2	buf_decrpos	call site: 00161	/src/dropbear/src/buffer.c:141
0	2	1 : View List ['dropbear_exit']	0	2	buf_getbyte	call site: 00159	/src/dropbear/src/buffer.c:152
0	2	1 : View List ['dropbear_exit']	0	2	buf_getwriteptr	call site: 00129	/src/dropbear/src/buffer.c:192
0	2	1 : View List ['dropbear_exit']	0	2	crypto_init	call site: 00022	/src/dropbear/src/crypto_desc.c:64

Runtime coverage analysis

Covered functions

62

Functions that are reachable but not covered

50

Reachable functions

109

Percentage of reachable functions covered

54.13%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-pubkey.c	2
src/../fuzz/fuzz-common.c	2
src/dbutil.c	4
src/dbmalloc.c	8
src/crypto_desc.c	2
libtomcrypt/src/misc/crypt/crypt_register_cipher.c	1
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
libtomcrypt/src/misc/crypt/crypt_register_hash.c	1
libtomcrypt/src/misc/crypt/crypt_register_prng.c	1
libtommath/bn_mp_rand.c	1
src/dbrandom.c	6
libtomcrypt/src/hashes/sha2/sha256.c	4
src/../fuzz/fuzz-wrapfd.c	5
src/buffer.c	17
src/dbhelpers.c	1
src/ecc.c	1
src/signkey.c	5
src/svr-authpubkey.c	2
libtomcrypt/src/misc/base64/base64_decode.c	2
libtomcrypt/src/misc/base64/base64_encode.c	2
src/svr-authpubkeyoptions.c	3
src/list.c	3
src/common-runopts.c	1

Fuzzer: fuzzer-kexdh

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	215	48.7%
gold	[1:9]	3	0.68%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	0.45%
lawngreen	50+	221	50.1%
All colors	441	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
460	1180	5 : View List ['mp_init_multi', 'mp_clear_multi', 'mp_exptmod', 'mp_invmod', 'mp_abs']	460	1180	mp_exptmod	call site: 00096	/src/dropbear/libtommath/bn_mp_exptmod.c:21
152	152	1 : View List ['buf_put_dss_pub_key']	323	421	buf_put_pub_key	call site: 00345	/src/dropbear/src/signkey.c:427
152	152	1 : View List ['buf_put_rsa_pub_key']	171	269	buf_put_pub_key	call site: 00346	/src/dropbear/src/signkey.c:432
99	99	1 : View List ['load_banner']	174	190	svr_getopts	call site: 00000	/src/dropbear/src/svr-runopts.c:385
53	71	3 : View List ['sign_key_free', 'm_free_direct', 'exit']	53	71	svr_dropbear_exit	call site: 00000	/src/dropbear/src/svr-session.c:294
21	21	1 : View List ['parse_recv_window']	73	87	svr_getopts	call site: 00000	/src/dropbear/src/svr-runopts.c:401
20	29	2 : View List ['m_free_direct', 'm_mp_free_multi']	20	29	dss_key_free	call site: 00000	/src/dropbear/src/dss.c:125
20	29	2 : View List ['m_free_direct', 'm_mp_free_multi']	20	29	rsa_key_free	call site: 00000	/src/dropbear/src/rsa.c:146
20	20	1 : View List ['m_mp_free_multi']	20	20	buf_get_dss_priv_key	call site: 00000	/src/dropbear/src/dss.c:113
20	20	1 : View List ['m_mp_free_multi']	20	20	buf_get_rsa_priv_key	call site: 00000	/src/dropbear/src/rsa.c:133
19	19	1 : View List ['buf_put_ed25519_pub_key']	19	49	buf_put_pub_key	call site: 00385	/src/dropbear/src/signkey.c:445
15	27	5 : View List ['fuzz_getpwuid', 'getenv', 'm_malloc', 'strlen', 'getuid']	15	43	expand_homedir_path	call site: 00000	/src/dropbear/src/dbutil.c:644

Runtime coverage analysis

Covered functions

153

Functions that are reachable but not covered

31

Reachable functions

134

Percentage of reachable functions covered

76.87%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-kexdh.c	1
src/../fuzz/fuzz-common.c	1
src/../fuzz/fuzz-wrapfd.c	3
src/dbrandom.c	1
libtomcrypt/src/hashes/sha2/sha256.c	4
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
src/dbmalloc.c	11
src/buffer.c	19
src/dbutil.c	2
src/bignum.c	4
libtommath/bn_mp_init.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
src/common-kex.c	3
libtommath/bn_mp_sub_d.c	1
libtommath/bn_mp_add_d.c	1
libtommath/bn_mp_cmp.c	1
libtommath/bn_mp_cmp_mag.c	1
libtommath/bn_mp_cmp_d.c	1
libtommath/bn_mp_exptmod.c	1
libtommath/bn_mp_init_multi.c	1
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_invmod.c	1
libtommath/bn_s_mp_invmod_fast.c	1
libtommath/bn_mp_mod.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_div.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_sub.c	1
libtommath/bn_s_mp_add.c	1
libtommath/bn_s_mp_sub.c	1
libtommath/bn_mp_rshd.c	1
libtommath/bn_mp_mul_d.c	1
libtommath/bn_mp_add.c	1
libtommath/bn_mp_exch.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_set.c	1
libtommath/bn_mp_div_2.c	1
libtommath/bn_mp_clear_multi.c	1
libtommath/bn_s_mp_invmod_slow.c	1
libtommath/bn_mp_abs.c	1
libtommath/bn_mp_reduce_is_2k_l.c	1
libtommath/bn_s_mp_exptmod.c	1
libtommath/bn_mp_reduce_setup.c	1
libtommath/bn_mp_2expt.c	1
libtommath/bn_mp_reduce_2k_setup_l.c	1
libtommath/bn_mp_sqr.c	1
libtommath/bn_s_mp_sqr_fast.c	1
libtommath/bn_s_mp_sqr.c	1
libtommath/bn_mp_mul.c	1
libtommath/bn_s_mp_balance_mul.c	1
libtommath/bn_s_mp_mul_digs_fast.c	1
libtommath/bn_s_mp_mul_digs.c	1
libtommath/bn_mp_dr_is_modulus.c	1
libtommath/bn_mp_reduce_is_2k.c	1
libtommath/bn_s_mp_exptmod_fast.c	1
libtommath/bn_mp_montgomery_setup.c	1
libtommath/bn_mp_dr_setup.c	1
libtommath/bn_mp_reduce_2k_setup.c	1
libtommath/bn_mp_montgomery_calc_normalization.c	1
libtommath/bn_mp_mul_2.c	1
libtommath/bn_mp_mulmod.c	1
src/signkey.c	2
src/dss.c	1
libtommath/bn_mp_to_ubin.c	1
libtommath/bn_mp_ubin_size.c	1
src/rsa.c	1
src/ecdsa.c	2
src/ecc.c	2
libtomcrypt/src/pk/ecc/ecc_ansi_x963_export.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_is_valid_idx.c	1
libtomcrypt/src/misc/zeromem.c	1
src/dbhelpers.c	1
src/ed25519.c	1

Fuzzer: fuzzer-kexecdh

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	102	28.8%
gold	[1:9]	3	0.84%
yellow	[10:29]	1	0.28%
greenyellow	[30:49]	1	0.28%
lawngreen	50+	246	69.6%
All colors	353	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
152	152	1 : View List ['buf_put_dss_pub_key']	323	421	buf_put_pub_key	call site: 00262	/src/dropbear/src/signkey.c:427
152	152	1 : View List ['buf_put_rsa_pub_key']	171	269	buf_put_pub_key	call site: 00263	/src/dropbear/src/signkey.c:432
99	99	1 : View List ['load_banner']	174	190	svr_getopts	call site: 00000	/src/dropbear/src/svr-runopts.c:385
53	71	3 : View List ['sign_key_free', 'm_free_direct', 'exit']	53	71	svr_dropbear_exit	call site: 00000	/src/dropbear/src/svr-session.c:294
21	21	1 : View List ['parse_recv_window']	73	87	svr_getopts	call site: 00000	/src/dropbear/src/svr-runopts.c:401
20	29	2 : View List ['m_free_direct', 'm_mp_free_multi']	20	29	dss_key_free	call site: 00000	/src/dropbear/src/dss.c:125
20	29	2 : View List ['m_free_direct', 'm_mp_free_multi']	20	29	rsa_key_free	call site: 00000	/src/dropbear/src/rsa.c:146
20	20	1 : View List ['m_mp_free_multi']	20	20	buf_get_dss_priv_key	call site: 00000	/src/dropbear/src/dss.c:113
20	20	1 : View List ['m_mp_free_multi']	20	20	buf_get_rsa_priv_key	call site: 00000	/src/dropbear/src/rsa.c:133
19	19	1 : View List ['buf_put_ed25519_pub_key']	19	49	buf_put_pub_key	call site: 00297	/src/dropbear/src/signkey.c:445
15	27	5 : View List ['fuzz_getpwuid', 'getenv', 'm_malloc', 'strlen', 'getuid']	15	43	expand_homedir_path	call site: 00000	/src/dropbear/src/dbutil.c:644
13	13	1 : View List ['m_str_to_uint']	13	17	svr_getopts	call site: 00000	/src/dropbear/src/svr-runopts.c:439

Runtime coverage analysis

Covered functions

189

Functions that are reachable but not covered

22

Reachable functions

124

Percentage of reachable functions covered

82.26%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-kexecdh.c	1
src/../fuzz/fuzz-common.c	1
src/../fuzz/fuzz-wrapfd.c	3
src/dbrandom.c	1
libtomcrypt/src/hashes/sha2/sha256.c	4
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
src/dbmalloc.c	11
src/buffer.c	21
src/dbutil.c	3
src/common-kex.c	2
src/ecc.c	6
src/bignum.c	2
libtommath/bn_mp_init.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_set.c	1
libtommath/bn_mp_read_radix.c	1
libtommath/bn_mp_mul_d.c	1
libtommath/bn_mp_add_d.c	1
libtommath/bn_mp_sub_d.c	1
libtommath/bn_mp_sqr.c	1
libtommath/bn_s_mp_sqr_fast.c	1
libtommath/bn_s_mp_sqr.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_exch.c	1
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_mod.c	1
libtommath/bn_mp_div.c	1
libtommath/bn_mp_cmp_mag.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_cmp.c	1
libtommath/bn_mp_sub.c	1
libtommath/bn_s_mp_add.c	1
libtommath/bn_s_mp_sub.c	1
libtommath/bn_mp_rshd.c	1
libtommath/bn_mp_add.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_mul.c	1
libtommath/bn_s_mp_balance_mul.c	1
libtommath/bn_mp_init_multi.c	1
libtommath/bn_s_mp_mul_digs_fast.c	1
libtommath/bn_s_mp_mul_digs.c	1
libtommath/bn_mp_clear_multi.c	1
libtommath/bn_mp_cmp_d.c	1
libtomcrypt/src/pk/ecc/ecc_free.c	1
libtomcrypt/src/math/multi.c	2
libtomcrypt/src/pk/ecc/ltc_ecc_points.c	2
src/signkey.c	2
src/dss.c	1
libtommath/bn_mp_to_ubin.c	1
libtommath/bn_mp_ubin_size.c	1
src/rsa.c	1
src/ecdsa.c	2
libtomcrypt/src/pk/ecc/ecc_ansi_x963_export.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_is_valid_idx.c	1
libtomcrypt/src/misc/zeromem.c	1
src/dbhelpers.c	1
src/ed25519.c	1

Fuzzer: fuzzer-verify

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	193	21.0%
gold	[1:9]	40	4.37%
yellow	[10:29]	9	0.98%
greenyellow	[30:49]	10	1.09%
lawngreen	50+	663	72.4%
All colors	915	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
238	238	1 : View List ['buf_sk_ecdsa_verify']	238	533	buf_verify	call site: 00664	/src/dropbear/src/signkey.c:694
45	1180	5 : View List ['mp_init_multi', 'mp_clear_multi', 'mp_exptmod', 'mp_invmod', 'mp_abs']	45	1180	mp_exptmod	call site: 00523	/src/dropbear/libtommath/bn_mp_exptmod.c:21
2	2	1 : View List ['exit']	2	2	generic_dropbear_exit	call site: 00000	/src/dropbear/src/dbutil.c:124
0	252	2 : View List ['mp_set', 'mp_mod']	0	1345	s_mp_exptmod_fast	call site: 00581	/src/dropbear/libtommath/bn_s_mp_exptmod_fast.c:122
0	219	1 : View List ['mp_mul']	0	640	mp_reduce	call site: 00000	/src/dropbear/libtommath/bn_mp_reduce.c:25
0	216	3 : View List ['mp_cmp', 'mp_set', 'mp_read_radix']	0	976	mp_prime_is_prime	call site: 00875	/src/dropbear/libtommath/bn_mp_prime_is_prime.c:147
0	99	5 : View List ['mp_clamp', 's_mp_sub', 'mp_cmp_mag', 'mp_grow', 'mp_rshd']	0	99	mp_montgomery_reduce	call site: 00000	/src/dropbear/libtommath/bn_mp_montgomery_reduce.c:20
0	77	1 : View List ['ltc_ecc_projective_dbl_point']	0	81	ltc_ecc_projective_add_point	call site: 00000	/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_projective_add_point.c:51
0	75	1 : View List ['mp_add_d']	0	80	mp_sub_d	call site: 00275	/src/dropbear/libtommath/bn_mp_sub_d.c:23
0	41	1 : View List ['mp_copy']	0	41	mp_div_d	call site: 00817	/src/dropbear/libtommath/bn_mp_div_d.c:21
0	41	4 : View List ['mp_clear', 'mp_clamp', 'mp_exch', 'mp_init_size']	0	41	s_mp_mul_digs	call site: 00370	/src/dropbear/libtommath/bn_s_mp_mul_digs.c:24
0	39	1 : View List ['mp_lshd']	0	44	mp_mul_2d	call site: 00188	/src/dropbear/libtommath/bn_mp_mul_2d.c:30

Runtime coverage analysis

Covered functions

238

Functions that are reachable but not covered

43

Reachable functions

241

Percentage of reachable functions covered

82.16%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-verify.c	2
src/../fuzz/fuzz-common.c	2
src/dbutil.c	4
src/dbmalloc.c	11
src/crypto_desc.c	2
libtomcrypt/src/misc/crypt/crypt_register_cipher.c	1
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
libtomcrypt/src/misc/crypt/crypt_register_hash.c	1
libtomcrypt/src/misc/crypt/crypt_register_prng.c	1
libtommath/bn_mp_rand.c	2
src/dbrandom.c	6
libtomcrypt/src/hashes/sha2/sha256.c	4
src/../fuzz/fuzz-wrapfd.c	5
src/buffer.c	20
src/dbhelpers.c	1
src/ecc.c	5
src/signkey.c	9
src/dss.c	3
src/bignum.c	4
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_init.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_cmp_d.c	1
libtommath/bn_mp_cmp.c	1
libtommath/bn_mp_cmp_mag.c	1
src/rsa.c	4
src/ecdsa.c	4
libtomcrypt/src/pk/ecc/ecc_free.c	1
libtomcrypt/src/math/multi.c	2
libtommath/bn_mp_set.c	1
libtommath/bn_mp_read_radix.c	1
libtommath/bn_mp_mul_d.c	1
libtommath/bn_mp_add_d.c	1
libtommath/bn_mp_sub_d.c	1
libtommath/bn_mp_sqr.c	1
libtommath/bn_s_mp_sqr_fast.c	1
libtommath/bn_s_mp_sqr.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_exch.c	1
libtommath/bn_mp_mod.c	1
libtommath/bn_mp_div.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_sub.c	1
libtommath/bn_s_mp_add.c	1
libtommath/bn_s_mp_sub.c	1
libtommath/bn_mp_rshd.c	1
libtommath/bn_mp_add.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_mul.c	1
libtommath/bn_s_mp_balance_mul.c	1
libtommath/bn_mp_init_multi.c	1
libtommath/bn_s_mp_mul_digs_fast.c	1
libtommath/bn_s_mp_mul_digs.c	1
libtommath/bn_mp_clear_multi.c	1
src/ed25519.c	3
libtomcrypt/src/hashes/sha1.c	4
libtomcrypt/src/headers/tomcrypt_macros.h	1
libtommath/bn_mp_invmod.c	1
libtommath/bn_s_mp_invmod_fast.c	1
libtommath/bn_mp_div_2.c	1
libtommath/bn_s_mp_invmod_slow.c	1
libtommath/bn_mp_mulmod.c	1
libtommath/bn_mp_exptmod.c	1
libtommath/bn_mp_abs.c	1
libtommath/bn_mp_reduce_is_2k_l.c	1
libtommath/bn_s_mp_exptmod.c	1
libtommath/bn_mp_reduce_setup.c	1
libtommath/bn_mp_2expt.c	1
libtommath/bn_mp_reduce_2k_setup_l.c	1
libtommath/bn_mp_dr_is_modulus.c	1
libtommath/bn_mp_reduce_is_2k.c	1
libtommath/bn_s_mp_exptmod_fast.c	1
libtommath/bn_mp_montgomery_setup.c	1
libtommath/bn_mp_dr_setup.c	1
libtommath/bn_mp_reduce_2k_setup.c	1
libtommath/bn_mp_montgomery_calc_normalization.c	1
libtommath/bn_mp_mul_2.c	1
libtommath/bn_mp_ubin_size.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_points.c	2
src/curve25519.c	24
libtomcrypt/src/hashes/sha2/sha512.c	4
src/sk-ecdsa.c	1
src/sk-ed25519.c	1
libtommath/bn_mp_prime_rabin_miller_trials.c	1
libtommath/bn_mp_prime_is_prime.c	2
libtommath/bn_mp_is_square.c	1
libtommath/bn_mp_mod_d.c	1
libtommath/bn_mp_div_d.c	1
libtommath/bn_mp_div_3.c	1
libtommath/bn_mp_init_u32.c	1
libtommath/bn_mp_set_u32.c	1
libtommath/bn_mp_get_i32.c	1
libtommath/bn_mp_get_mag_u32.c	1
libtommath/bn_mp_sqrt.c	1
libtommath/bn_s_mp_prime_is_divisible.c	1
libtommath/bn_mp_init_set.c	1
libtommath/bn_mp_prime_miller_rabin.c	1
libtommath/bn_mp_cnt_lsb.c	1
libtommath/bn_mp_sqrmod.c	1

Fuzzer: fuzzer-preauth_nomaths

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	493	46.8%
gold	[1:9]	192	18.2%
yellow	[10:29]	17	1.61%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	350	33.2%
All colors	1052	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
4422	4850	16 : View List ['buf_putmpint', 'free_kexcurve25519_param', 'buf_put_sign', 'kexecdh_comb_key', 'free_kexecdh_param', 'buf_putbyte', 'encrypt_packet', 'gen_kexecdh_param', 'buf_putstring', 'gen_kexcurve25519_param', 'kexdh_comb_key', 'buf_put_ecc_raw_pubkey_string', 'kexcurve25519_comb_key', 'buf_put_pub_key', 'free_kexdh_param', 'gen_kexdh_param']	4422	4850	send_msg_kexdh_reply	call site: 00000	/src/dropbear/src/svr-kex.c:203
1760	1760	1 : View List ['svr_ensure_hostkey']	6182	6671	send_msg_kexdh_reply	call site: 00000	/src/dropbear/src/svr-kex.c:196
550	552	2 : View List ['send_msg_keepalive', 'dropbear_exit']	550	564	checktimeouts	call site: 00826	/src/dropbear/src/common-session.c:558
330	330	1 : View List ['checkpubkey']	2723	3974	svr_auth_pubkey	call site: 00000	/src/dropbear/src/svr-authpubkey.c:162
270	272	2 : View List ['send_msg_userauth_success', 'dropbear_log']	270	299	recv_msg_userauth_request	call site: 00000	/src/dropbear/src/svr-auth.c:126
270	270	1 : View List ['send_msg_userauth_success']	270	554	svr_auth_password	call site: 00000	/src/dropbear/src/svr-authpasswd.c:108
265	276	2 : View List ['buf_free', 'send_msg_userauth_banner']	543	3362	recv_msg_userauth_request	call site: 00000	/src/dropbear/src/svr-auth.c:91
263	263	1 : View List ['send_msg_userauth_pk_ok']	314	356	svr_auth_pubkey	call site: 00000	/src/dropbear/src/svr-authpubkey.c:172
99	99	1 : View List ['load_banner']	174	190	svr_getopts	call site: 00158	/src/dropbear/src/svr-runopts.c:385
84	88	6 : View List ['getsockname', 'dropbear_exit', 'strerror', '__errno_location', 'getaddrstring', 'getpeername']	84	88	get_socket_address	call site: 00575	/src/dropbear/src/netio.c:688
53	71	3 : View List ['sign_key_free', 'm_free_direct', 'exit']	53	71	svr_dropbear_exit	call site: 00000	/src/dropbear/src/svr-session.c:294
51	51	1 : View List ['sign_key_free']	51	73	svr_auth_pubkey	call site: 00000	/src/dropbear/src/svr-authpubkey.c:255

Runtime coverage analysis

Covered functions

263

Functions that are reachable but not covered

119

Reachable functions

301

Percentage of reachable functions covered

60.47%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-preauth_nomaths.c	1
src/../fuzz/fuzz-common.c	10
src/dbutil.c	14
src/dbmalloc.c	12
src/crypto_desc.c	2
libtomcrypt/src/misc/crypt/crypt_register_cipher.c	1
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
libtomcrypt/src/misc/crypt/crypt_register_hash.c	1
libtomcrypt/src/misc/crypt/crypt_register_prng.c	1
libtommath/bn_mp_rand.c	1
src/dbrandom.c	6
libtomcrypt/src/hashes/sha2/sha256.c	4
src/../fuzz/fuzz-wrapfd.c	7
src/buffer.c	22
src/dbhelpers.c	1
src/ecc.c	4
src/svr-runopts.c	5
src/common-runopts.c	3
src/signkey.c	5
src/dss.c	3
src/bignum.c	2
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_init.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_cmp_d.c	1
libtommath/bn_mp_cmp.c	1
libtommath/bn_mp_cmp_mag.c	1
src/rsa.c	3
src/ecdsa.c	3
libtomcrypt/src/pk/ecc/ecc_free.c	1
libtomcrypt/src/math/multi.c	1
libtommath/bn_mp_set.c	1
libtommath/bn_mp_read_radix.c	1
libtommath/bn_mp_mul_d.c	1
libtommath/bn_mp_add_d.c	1
libtommath/bn_mp_sub_d.c	1
libtommath/bn_mp_sqr.c	1
libtommath/bn_s_mp_sqr_fast.c	1
libtommath/bn_s_mp_sqr.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_exch.c	1
libtommath/bn_mp_mod.c	1
libtommath/bn_mp_div.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_sub.c	1
libtommath/bn_s_mp_add.c	1
libtommath/bn_s_mp_sub.c	1
libtommath/bn_mp_rshd.c	1
libtommath/bn_mp_add.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_mul.c	1
libtommath/bn_s_mp_balance_mul.c	1
libtommath/bn_mp_init_multi.c	1
libtommath/bn_s_mp_mul_digs_fast.c	1
libtommath/bn_s_mp_mul_digs.c	1
libtommath/bn_mp_clear_multi.c	1
src/ed25519.c	2
src/svr-session.c	2
src/common-session.c	12
src/netio.c	11
src/queue.c	5
src/svr-auth.c	1
src/common-channel.c	15
src/listener.c	3
src/svr-chansession.c	2
src/packet.c	11
src/common-kex.c	3
src/common-algo.c	3
libtomcrypt/src/mac/hmac/hmac_init.c	1
libtomcrypt/src/misc/crypt/crypt_hash_is_valid.c	1
libtomcrypt/src/hashes/helper/hash_memory.c	1
libtomcrypt/src/misc/zeromem.c	1
libtomcrypt/src/mac/hmac/hmac_process.c	1
libtomcrypt/src/mac/hmac/hmac_done.c	1
src/circbuffer.c	5
src/list.c	1
src/atomicio.c	1
src/process-packet.c	2

Fuzzer: fuzzer-client_nomaths

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1528	76.6%
gold	[1:9]	119	5.96%
yellow	[10:29]	3	0.15%
greenyellow	[30:49]	2	0.10%
lawngreen	50+	342	17.1%
All colors	1994	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
4485	4595	20 : View List ['free_kexcurve25519_param', 'dropbear_exit', 'kexecdh_comb_key', 'free_kexecdh_param', 'buf_getptr', 'new_sign_key', 'buf_getstringbuf', 'send_msg_newkeys', 'buf_get_pub_key', 'checkhostkey', 'sign_key_free', 'kexdh_comb_key', 'buf_getmpint', 'kexcurve25519_comb_key', 'buf_getint', 'mp_clear', 'buf_free', 'buf_verify', 'free_kexdh_param', 'm_mp_init']	4485	4595	recv_msg_kexdh_reply	call site: 00000	/src/dropbear/src/cli-kex.c:110
1366	1648	11 : View List ['buf_putmpint', 'buf_putstring', 'free_kexcurve25519_param', 'gen_kexcurve25519_param', 'free_kexdh_param', 'buf_put_ecc_raw_pubkey_string', 'free_kexecdh_param', 'buf_putbyte', 'gen_kexdh_param', 'encrypt_packet', 'gen_kexecdh_param']	1366	1648	send_msg_kexdh_init	call site: 01189	/src/dropbear/src/cli-kex.c:51
1308	1308	1 : View List ['recv_msg_userauth_pk_ok']	1308	1308	recv_msg_userauth_specific_60	call site: 00000	/src/dropbear/src/cli-auth.c:130
814	847	3 : View List ['parse_hostname', 'fclose', 'read_config_file']	814	856	apply_config_settings	call site: 00600	/src/dropbear/src/cli-runopts.c:1062
587	587	3 : View List ['ecc_free', 'signkey_key_ptr', 'buf_get_ecdsa_priv_key']	587	649	buf_get_priv_key	call site: 00299	/src/dropbear/src/signkey.c:385
550	552	2 : View List ['send_msg_keepalive', 'dropbear_exit']	560	564	checktimeouts	call site: 00967	/src/dropbear/src/common-session.c:558
311	311	1 : View List ['recv_msg_userauth_info_request']	311	311	recv_msg_userauth_specific_60	call site: 00000	/src/dropbear/src/cli-auth.c:137
166	212	2 : View List ['buf_get_dss_priv_key', 'dss_key_free']	902	1083	buf_get_priv_key	call site: 00211	/src/dropbear/src/signkey.c:363
149	195	2 : View List ['buf_get_rsa_priv_key', 'rsa_key_free']	736	859	buf_get_priv_key	call site: 00275	/src/dropbear/src/signkey.c:374
103	114	5 : View List ['check_user_algos', 'strcmp', 'algolist_string', 'm_free_direct', 'dropbear_log']	103	118	parse_ciphers_macs	call site: 00587	/src/dropbear/src/common-runopts.c:81
61	61	1 : View List ['cli_pubkeyfail']	67	108	recv_msg_userauth_failure	call site: 00000	/src/dropbear/src/cli-auth.c:198
39	57	3 : View List ['multihop_passthrough_args', 'strlen', 'm_realloc']	39	75	parse_multihop_hostname	call site: 00693	/src/dropbear/src/cli-runopts.c:668

Runtime coverage analysis

Covered functions

199

Functions that are reachable but not covered

311

Reachable functions

464

Percentage of reachable functions covered

32.97%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-client_nomaths.c	1
src/../fuzz/fuzz-common.c	8
src/dbutil.c	17
src/dbmalloc.c	12
src/crypto_desc.c	2
libtomcrypt/src/misc/crypt/crypt_register_cipher.c	1
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
libtomcrypt/src/misc/crypt/crypt_register_hash.c	1
libtomcrypt/src/misc/crypt/crypt_register_prng.c	1
libtommath/bn_mp_rand.c	1
src/dbrandom.c	8
libtomcrypt/src/hashes/sha2/sha256.c	4
src/../fuzz/fuzz-wrapfd.c	7
src/buffer.c	26
src/dbhelpers.c	1
src/ecc.c	6
src/cli-runopts.c	13
src/list.c	3
src/common-runopts.c	5
src/signkey.c	12
src/dss.c	5
src/bignum.c	4
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_init.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_cmp_d.c	1
libtommath/bn_mp_cmp.c	1
libtommath/bn_mp_cmp_mag.c	1
src/rsa.c	6
src/ecdsa.c	5
libtomcrypt/src/pk/ecc/ecc_free.c	1
libtomcrypt/src/math/multi.c	2
libtommath/bn_mp_set.c	1
libtommath/bn_mp_read_radix.c	1
libtommath/bn_mp_mul_d.c	1
libtommath/bn_mp_add_d.c	1
libtommath/bn_mp_sub_d.c	1
libtommath/bn_mp_sqr.c	1
libtommath/bn_s_mp_sqr_fast.c	1
libtommath/bn_s_mp_sqr.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_exch.c	1
libtommath/bn_mp_mod.c	1
libtommath/bn_mp_div.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_sub.c	1
libtommath/bn_s_mp_add.c	1
libtommath/bn_s_mp_sub.c	1
libtommath/bn_mp_rshd.c	1
libtommath/bn_mp_add.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_mul.c	1
libtommath/bn_s_mp_balance_mul.c	1
libtommath/bn_mp_init_multi.c	1
libtommath/bn_s_mp_mul_digs_fast.c	1
libtommath/bn_s_mp_mul_digs.c	1
libtommath/bn_mp_clear_multi.c	1
src/ed25519.c	5
src/common-algo.c	8
src/cli-readconf.c	1
src/compat.c	2
src/cli-session.c	6
src/common-session.c	13
src/netio.c	13
src/queue.c	5
src/common-channel.c	18
src/listener.c	6
src/packet.c	11
src/common-kex.c	10
libtomcrypt/src/mac/hmac/hmac_init.c	1
libtomcrypt/src/misc/crypt/crypt_hash_is_valid.c	1
libtomcrypt/src/hashes/helper/hash_memory.c	1
libtomcrypt/src/misc/zeromem.c	1
libtomcrypt/src/mac/hmac/hmac_process.c	1
libtomcrypt/src/mac/hmac/hmac_done.c	1
src/circbuffer.c	6
src/atomicio.c	1
src/process-packet.c	2
src/cli-kex.c	1
libtommath/bn_mp_set_ul.c	1
libtommath/bn_mp_div_2.c	1
libtommath/bn_mp_exptmod.c	1
libtommath/bn_mp_invmod.c	1
libtommath/bn_s_mp_invmod_fast.c	1
libtommath/bn_s_mp_invmod_slow.c	1
libtommath/bn_mp_abs.c	1
libtommath/bn_mp_reduce_is_2k_l.c	1
libtommath/bn_s_mp_exptmod.c	1
libtommath/bn_mp_reduce_setup.c	1
libtommath/bn_mp_2expt.c	1
libtommath/bn_mp_reduce_2k_setup_l.c	1
libtommath/bn_mp_dr_is_modulus.c	1
libtommath/bn_mp_reduce_is_2k.c	1
libtommath/bn_s_mp_exptmod_fast.c	1
libtommath/bn_mp_montgomery_setup.c	1
libtommath/bn_mp_dr_setup.c	1
libtommath/bn_mp_reduce_2k_setup.c	1
libtommath/bn_mp_montgomery_calc_normalization.c	1
libtommath/bn_mp_mul_2.c	1
libtommath/bn_mp_mulmod.c	1
libtommath/bn_mp_to_ubin.c	1
libtommath/bn_mp_ubin_size.c	1
libtomcrypt/src/pk/ecc/ecc_make_key.c	1
libtomcrypt/src/misc/crypt/crypt_prng_is_valid.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_points.c	2
libtomcrypt/src/pk/ecc/ecc_ansi_x963_export.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_is_valid_idx.c	1
src/curve25519.c	21
src/cli-auth.c	3
src/cli-authpubkey.c	3
src/cli-agentfwd.c	5
libtomcrypt/src/hashes/sha1.c	4
libtomcrypt/src/headers/tomcrypt_macros.h	1
libtommath/bn_mp_addmod.c	1
libtomcrypt/src/hashes/sha2/sha512.c	4
src/cli-authinteract.c	1
src/cli-authpasswd.c	1
src/cli-chansession.c	4
src/cli-tcpfwd.c	5
src/tcp-accept.c	3

Fuzzer: fuzzer-preauth

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	477	45.3%
gold	[1:9]	157	14.9%
yellow	[10:29]	7	0.66%
greenyellow	[30:49]	1	0.09%
lawngreen	50+	410	38.9%
All colors	1052	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1760	1760	1 : View List ['svr_ensure_hostkey']	1844	6671	send_msg_kexdh_reply	call site: 00000	/src/dropbear/src/svr-kex.c:196
550	552	2 : View List ['send_msg_keepalive', 'dropbear_exit']	550	564	checktimeouts	call site: 00826	/src/dropbear/src/common-session.c:558
330	330	1 : View List ['checkpubkey']	2723	3974	svr_auth_pubkey	call site: 00000	/src/dropbear/src/svr-authpubkey.c:162
270	270	1 : View List ['send_msg_userauth_success']	270	554	svr_auth_password	call site: 00000	/src/dropbear/src/svr-authpasswd.c:108
265	276	2 : View List ['buf_free', 'send_msg_userauth_banner']	543	3362	recv_msg_userauth_request	call site: 00000	/src/dropbear/src/svr-auth.c:91
263	263	1 : View List ['send_msg_userauth_pk_ok']	314	356	svr_auth_pubkey	call site: 00000	/src/dropbear/src/svr-authpubkey.c:172
99	99	1 : View List ['load_banner']	174	190	svr_getopts	call site: 00158	/src/dropbear/src/svr-runopts.c:385
84	88	6 : View List ['getsockname', 'dropbear_exit', 'strerror', '__errno_location', 'getaddrstring', 'getpeername']	84	88	get_socket_address	call site: 00575	/src/dropbear/src/netio.c:688
53	71	3 : View List ['sign_key_free', 'm_free_direct', 'exit']	53	71	svr_dropbear_exit	call site: 00000	/src/dropbear/src/svr-session.c:294
51	51	1 : View List ['sign_key_free']	51	73	svr_auth_pubkey	call site: 00000	/src/dropbear/src/svr-authpubkey.c:255
45	1180	5 : View List ['mp_init_multi', 'mp_clear_multi', 'mp_exptmod', 'mp_invmod', 'mp_abs']	45	1180	mp_exptmod	call site: 00000	/src/dropbear/libtommath/bn_mp_exptmod.c:21
38	38	1 : View List ['hash_memory']	38	53	hmac_init	call site: 00690	/src/dropbear/libtomcrypt/src/mac/hmac/hmac_init.c:57

Runtime coverage analysis

Covered functions

366

Functions that are reachable but not covered

114

Reachable functions

301

Percentage of reachable functions covered

62.13%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-preauth.c	1
src/../fuzz/fuzz-common.c	10
src/dbutil.c	14
src/dbmalloc.c	12
src/crypto_desc.c	2
libtomcrypt/src/misc/crypt/crypt_register_cipher.c	1
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
libtomcrypt/src/misc/crypt/crypt_register_hash.c	1
libtomcrypt/src/misc/crypt/crypt_register_prng.c	1
libtommath/bn_mp_rand.c	1
src/dbrandom.c	6
libtomcrypt/src/hashes/sha2/sha256.c	4
src/../fuzz/fuzz-wrapfd.c	7
src/buffer.c	22
src/dbhelpers.c	1
src/ecc.c	4
src/svr-runopts.c	5
src/common-runopts.c	3
src/signkey.c	5
src/dss.c	3
src/bignum.c	2
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_init.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_cmp_d.c	1
libtommath/bn_mp_cmp.c	1
libtommath/bn_mp_cmp_mag.c	1
src/rsa.c	3
src/ecdsa.c	3
libtomcrypt/src/pk/ecc/ecc_free.c	1
libtomcrypt/src/math/multi.c	1
libtommath/bn_mp_set.c	1
libtommath/bn_mp_read_radix.c	1
libtommath/bn_mp_mul_d.c	1
libtommath/bn_mp_add_d.c	1
libtommath/bn_mp_sub_d.c	1
libtommath/bn_mp_sqr.c	1
libtommath/bn_s_mp_sqr_fast.c	1
libtommath/bn_s_mp_sqr.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_exch.c	1
libtommath/bn_mp_mod.c	1
libtommath/bn_mp_div.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_sub.c	1
libtommath/bn_s_mp_add.c	1
libtommath/bn_s_mp_sub.c	1
libtommath/bn_mp_rshd.c	1
libtommath/bn_mp_add.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_mul.c	1
libtommath/bn_s_mp_balance_mul.c	1
libtommath/bn_mp_init_multi.c	1
libtommath/bn_s_mp_mul_digs_fast.c	1
libtommath/bn_s_mp_mul_digs.c	1
libtommath/bn_mp_clear_multi.c	1
src/ed25519.c	2
src/svr-session.c	2
src/common-session.c	12
src/netio.c	11
src/queue.c	5
src/svr-auth.c	1
src/common-channel.c	15
src/listener.c	3
src/svr-chansession.c	2
src/packet.c	11
src/common-kex.c	3
src/common-algo.c	3
libtomcrypt/src/mac/hmac/hmac_init.c	1
libtomcrypt/src/misc/crypt/crypt_hash_is_valid.c	1
libtomcrypt/src/hashes/helper/hash_memory.c	1
libtomcrypt/src/misc/zeromem.c	1
libtomcrypt/src/mac/hmac/hmac_process.c	1
libtomcrypt/src/mac/hmac/hmac_done.c	1
src/circbuffer.c	5
src/list.c	1
src/atomicio.c	1
src/process-packet.c	2

Fuzzer: fuzzer-postauth_nomaths

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	413	39.2%
gold	[1:9]	190	18.0%
yellow	[10:29]	24	2.28%
greenyellow	[30:49]	2	0.19%
lawngreen	50+	423	40.2%
All colors	1052	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
4422	4850	16 : View List ['buf_putmpint', 'free_kexcurve25519_param', 'buf_put_sign', 'kexecdh_comb_key', 'free_kexecdh_param', 'buf_putbyte', 'encrypt_packet', 'gen_kexecdh_param', 'buf_putstring', 'gen_kexcurve25519_param', 'kexdh_comb_key', 'buf_put_ecc_raw_pubkey_string', 'kexcurve25519_comb_key', 'buf_put_pub_key', 'free_kexdh_param', 'gen_kexdh_param']	4422	4850	send_msg_kexdh_reply	call site: 00000	/src/dropbear/src/svr-kex.c:203
3224	3362	12 : View List ['svr_auth_password', 'svr_auth_pubkey', 'dropbear_exit', 'send_msg_userauth_success', 'm_free_direct', 'strncmp', 'send_msg_userauth_banner', 'checkusername', 'buf_getstring', 'buf_free', 'send_msg_userauth_failure', 'dropbear_log']	3224	3362	recv_msg_userauth_request	call site: 00000	/src/dropbear/src/svr-auth.c:85
1760	1760	1 : View List ['svr_ensure_hostkey']	6182	6671	send_msg_kexdh_reply	call site: 00000	/src/dropbear/src/svr-kex.c:196
550	552	2 : View List ['send_msg_keepalive', 'dropbear_exit']	550	564	checktimeouts	call site: 00826	/src/dropbear/src/common-session.c:558
497	732	24 : View List ['wrapfd_write', 'buf_setpos', 'chansess_login_alloc', 'dropbear_exit', 'pty_make_controlling_tty', 'buf_incrpos', 'buf_getptr', 'buf_new', 'm_malloc', 'strlen', 'stat', 'addchildpid', 'setnonblocking', 'execchild', 'buf_readfile', 'signal', 'fork', 'wrapfd_close', 'login_login', 'm_free_direct', 'expand_homedir_path', 'buf_free', 'login_free_entry', 'dup2']	497	732	ptycommand	call site: 00000	/src/dropbear/src/svr-chansession.c:813
368	368	1 : View List ['svr_agentreq']	368	901	chansessionrequest	call site: 00000	/src/dropbear/src/svr-chansession.c:399
261	261	1 : View List ['send_msg_channel_window_adjust']	261	277	writechannel	call site: 00970	/src/dropbear/src/common-channel.c:524
261	261	1 : View List ['send_msg_request_success']	261	270	recv_msg_global_request_remotetcp	call site: 00000	/src/dropbear/src/svr-tcpfwd.c:115
99	99	1 : View List ['load_banner']	174	190	svr_getopts	call site: 00158	/src/dropbear/src/svr-runopts.c:385
84	88	6 : View List ['getsockname', 'dropbear_exit', 'strerror', '__errno_location', 'getaddrstring', 'getpeername']	84	88	get_socket_address	call site: 00575	/src/dropbear/src/netio.c:688
73	73	1 : View List ['lastlog_write_entry']	73	73	login_write	call site: 00000	/src/dropbear/src/loginrec.c:327
64	64	1 : View List ['fd_read_pending']	64	1131	check_close	call site: 00989	/src/dropbear/src/common-channel.c:299

Runtime coverage analysis

Covered functions

345

Functions that are reachable but not covered

101

Reachable functions

301

Percentage of reachable functions covered

66.45%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-postauth_nomaths.c	1
src/../fuzz/fuzz-common.c	10
src/dbutil.c	14
src/dbmalloc.c	12
src/crypto_desc.c	2
libtomcrypt/src/misc/crypt/crypt_register_cipher.c	1
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
libtomcrypt/src/misc/crypt/crypt_register_hash.c	1
libtomcrypt/src/misc/crypt/crypt_register_prng.c	1
libtommath/bn_mp_rand.c	1
src/dbrandom.c	6
libtomcrypt/src/hashes/sha2/sha256.c	4
src/../fuzz/fuzz-wrapfd.c	7
src/buffer.c	22
src/dbhelpers.c	1
src/ecc.c	4
src/svr-runopts.c	5
src/common-runopts.c	3
src/signkey.c	5
src/dss.c	3
src/bignum.c	2
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_init.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_cmp_d.c	1
libtommath/bn_mp_cmp.c	1
libtommath/bn_mp_cmp_mag.c	1
src/rsa.c	3
src/ecdsa.c	3
libtomcrypt/src/pk/ecc/ecc_free.c	1
libtomcrypt/src/math/multi.c	1
libtommath/bn_mp_set.c	1
libtommath/bn_mp_read_radix.c	1
libtommath/bn_mp_mul_d.c	1
libtommath/bn_mp_add_d.c	1
libtommath/bn_mp_sub_d.c	1
libtommath/bn_mp_sqr.c	1
libtommath/bn_s_mp_sqr_fast.c	1
libtommath/bn_s_mp_sqr.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_exch.c	1
libtommath/bn_mp_mod.c	1
libtommath/bn_mp_div.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_sub.c	1
libtommath/bn_s_mp_add.c	1
libtommath/bn_s_mp_sub.c	1
libtommath/bn_mp_rshd.c	1
libtommath/bn_mp_add.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_mul.c	1
libtommath/bn_s_mp_balance_mul.c	1
libtommath/bn_mp_init_multi.c	1
libtommath/bn_s_mp_mul_digs_fast.c	1
libtommath/bn_s_mp_mul_digs.c	1
libtommath/bn_mp_clear_multi.c	1
src/ed25519.c	2
src/svr-session.c	2
src/common-session.c	12
src/netio.c	11
src/queue.c	5
src/svr-auth.c	1
src/common-channel.c	15
src/listener.c	3
src/svr-chansession.c	2
src/packet.c	11
src/common-kex.c	3
src/common-algo.c	3
libtomcrypt/src/mac/hmac/hmac_init.c	1
libtomcrypt/src/misc/crypt/crypt_hash_is_valid.c	1
libtomcrypt/src/hashes/helper/hash_memory.c	1
libtomcrypt/src/misc/zeromem.c	1
libtomcrypt/src/mac/hmac/hmac_process.c	1
libtomcrypt/src/mac/hmac/hmac_done.c	1
src/circbuffer.c	5
src/list.c	1
src/atomicio.c	1
src/process-packet.c	2

Fuzzer: fuzzer-client

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1016	50.9%
gold	[1:9]	120	6.01%
yellow	[10:29]	23	1.15%
greenyellow	[30:49]	10	0.50%
lawngreen	50+	825	41.3%
All colors	1994	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
814	847	3 : View List ['parse_hostname', 'fclose', 'read_config_file']	814	856	apply_config_settings	call site: 00600	/src/dropbear/src/cli-runopts.c:1062
562	587	3 : View List ['ecc_free', 'signkey_key_ptr', 'buf_get_ecdsa_priv_key']	562	649	buf_get_priv_key	call site: 00299	/src/dropbear/src/signkey.c:385
550	552	2 : View List ['send_msg_keepalive', 'dropbear_exit']	560	564	checktimeouts	call site: 00967	/src/dropbear/src/common-session.c:558
267	280	2 : View List ['signkey_key_ptr', 'buf_sk_ed25519_verify']	267	282	buf_verify	call site: 00000	/src/dropbear/src/signkey.c:702
238	238	1 : View List ['buf_sk_ecdsa_verify']	505	533	buf_verify	call site: 00000	/src/dropbear/src/signkey.c:694
166	212	2 : View List ['buf_get_dss_priv_key', 'dss_key_free']	877	1083	buf_get_priv_key	call site: 00211	/src/dropbear/src/signkey.c:363
149	195	2 : View List ['buf_get_rsa_priv_key', 'rsa_key_free']	711	859	buf_get_priv_key	call site: 00275	/src/dropbear/src/signkey.c:374
103	114	5 : View List ['check_user_algos', 'strcmp', 'algolist_string', 'm_free_direct', 'dropbear_log']	103	118	parse_ciphers_macs	call site: 00587	/src/dropbear/src/common-runopts.c:81
45	1180	5 : View List ['mp_init_multi', 'mp_clear_multi', 'mp_exptmod', 'mp_invmod', 'mp_abs']	45	1180	mp_exptmod	call site: 01218	/src/dropbear/libtommath/bn_mp_exptmod.c:21
39	57	3 : View List ['multihop_passthrough_args', 'strlen', 'm_realloc']	39	75	parse_multihop_hostname	call site: 00693	/src/dropbear/src/cli-runopts.c:668
39	39	1 : View List ['split_address_port']	86	935	cli_getopts	call site: 00661	/src/dropbear/src/cli-runopts.c:463
36	698	4 : View List ['addrandom', 'buf_getptr', 'buf_setpos', 'buf_get_priv_key']	36	713	readhostkey	call site: 00173	/src/dropbear/src/common-runopts.c:46

Runtime coverage analysis

Covered functions

353

Functions that are reachable but not covered

183

Reachable functions

464

Percentage of reachable functions covered

60.56%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-client.c	1
src/../fuzz/fuzz-common.c	8
src/dbutil.c	17
src/dbmalloc.c	12
src/crypto_desc.c	2
libtomcrypt/src/misc/crypt/crypt_register_cipher.c	1
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
libtomcrypt/src/misc/crypt/crypt_register_hash.c	1
libtomcrypt/src/misc/crypt/crypt_register_prng.c	1
libtommath/bn_mp_rand.c	1
src/dbrandom.c	8
libtomcrypt/src/hashes/sha2/sha256.c	4
src/../fuzz/fuzz-wrapfd.c	7
src/buffer.c	26
src/dbhelpers.c	1
src/ecc.c	6
src/cli-runopts.c	13
src/list.c	3
src/common-runopts.c	5
src/signkey.c	12
src/dss.c	5
src/bignum.c	4
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_init.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_cmp_d.c	1
libtommath/bn_mp_cmp.c	1
libtommath/bn_mp_cmp_mag.c	1
src/rsa.c	6
src/ecdsa.c	5
libtomcrypt/src/pk/ecc/ecc_free.c	1
libtomcrypt/src/math/multi.c	2
libtommath/bn_mp_set.c	1
libtommath/bn_mp_read_radix.c	1
libtommath/bn_mp_mul_d.c	1
libtommath/bn_mp_add_d.c	1
libtommath/bn_mp_sub_d.c	1
libtommath/bn_mp_sqr.c	1
libtommath/bn_s_mp_sqr_fast.c	1
libtommath/bn_s_mp_sqr.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_exch.c	1
libtommath/bn_mp_mod.c	1
libtommath/bn_mp_div.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_sub.c	1
libtommath/bn_s_mp_add.c	1
libtommath/bn_s_mp_sub.c	1
libtommath/bn_mp_rshd.c	1
libtommath/bn_mp_add.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_mul.c	1
libtommath/bn_s_mp_balance_mul.c	1
libtommath/bn_mp_init_multi.c	1
libtommath/bn_s_mp_mul_digs_fast.c	1
libtommath/bn_s_mp_mul_digs.c	1
libtommath/bn_mp_clear_multi.c	1
src/ed25519.c	5
src/common-algo.c	8
src/cli-readconf.c	1
src/compat.c	2
src/cli-session.c	6
src/common-session.c	13
src/netio.c	13
src/queue.c	5
src/common-channel.c	18
src/listener.c	6
src/packet.c	11
src/common-kex.c	10
libtomcrypt/src/mac/hmac/hmac_init.c	1
libtomcrypt/src/misc/crypt/crypt_hash_is_valid.c	1
libtomcrypt/src/hashes/helper/hash_memory.c	1
libtomcrypt/src/misc/zeromem.c	1
libtomcrypt/src/mac/hmac/hmac_process.c	1
libtomcrypt/src/mac/hmac/hmac_done.c	1
src/circbuffer.c	6
src/atomicio.c	1
src/process-packet.c	2
src/cli-kex.c	1
libtommath/bn_mp_set_ul.c	1
libtommath/bn_mp_div_2.c	1
libtommath/bn_mp_exptmod.c	1
libtommath/bn_mp_invmod.c	1
libtommath/bn_s_mp_invmod_fast.c	1
libtommath/bn_s_mp_invmod_slow.c	1
libtommath/bn_mp_abs.c	1
libtommath/bn_mp_reduce_is_2k_l.c	1
libtommath/bn_s_mp_exptmod.c	1
libtommath/bn_mp_reduce_setup.c	1
libtommath/bn_mp_2expt.c	1
libtommath/bn_mp_reduce_2k_setup_l.c	1
libtommath/bn_mp_dr_is_modulus.c	1
libtommath/bn_mp_reduce_is_2k.c	1
libtommath/bn_s_mp_exptmod_fast.c	1
libtommath/bn_mp_montgomery_setup.c	1
libtommath/bn_mp_dr_setup.c	1
libtommath/bn_mp_reduce_2k_setup.c	1
libtommath/bn_mp_montgomery_calc_normalization.c	1
libtommath/bn_mp_mul_2.c	1
libtommath/bn_mp_mulmod.c	1
libtommath/bn_mp_to_ubin.c	1
libtommath/bn_mp_ubin_size.c	1
libtomcrypt/src/pk/ecc/ecc_make_key.c	1
libtomcrypt/src/misc/crypt/crypt_prng_is_valid.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_points.c	2
libtomcrypt/src/pk/ecc/ecc_ansi_x963_export.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_is_valid_idx.c	1
src/curve25519.c	21
src/cli-auth.c	3
src/cli-authpubkey.c	3
src/cli-agentfwd.c	5
libtomcrypt/src/hashes/sha1.c	4
libtomcrypt/src/headers/tomcrypt_macros.h	1
libtommath/bn_mp_addmod.c	1
libtomcrypt/src/hashes/sha2/sha512.c	4
src/cli-authinteract.c	1
src/cli-authpasswd.c	1
src/cli-chansession.c	4
src/cli-tcpfwd.c	5
src/tcp-accept.c	3

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
chansessionrequest	/src/dropbear/src/svr-chansession.c	1	['N/A']	13	0	186	39	12	214	0	842	357
send_msg_kexdh_reply	/src/dropbear/src/svr-kex.c	2	['N/A', 'N/A']	14	0	135	17	4	314	1	2012	167
ltc_ecc_projective_add_point	/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_projective_add_point.c	5	['N/A', 'N/A', 'N/A', 'N/A', 'N/A']	3	0	1374	209	86	6	0	163	146
svr_auth_pubkey	/src/dropbear/src/svr-authpubkey.c	1	['int']	13	0	385	55	19	264	1	1719	66
ltc_ecc_mul2add	/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_mul2add.c	6	['N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A']	4	0	891	132	42	17	0	103	56
dropbear_chachapoly_crypt	/src/dropbear/src/chachapoly.c	7	['int', 'N/A', 'N/A', 'size_t', 'size_t', 'N/A', 'int']	4	0	186	25	10	13	0	62	52
montgomery_reduce	/src/dropbear/libtomcrypt/src/math/ltm_desc.c	3	['N/A', 'N/A', 'N/A']	7	0	59	15	2	20	0	123	46
mp_reduce	/src/dropbear/libtommath/bn_mp_reduce.c	3	['N/A', 'N/A', 'N/A']	9	0	149	32	14	41	0	312	46
checkhostkey	/src/dropbear/src/cli-kex.c	2	['N/A', 'int']	6	0	309	43	16	58	1	216	38

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

574 / 788

Cyclomatic complexity statically reachable by fuzzers

4012 / 5045

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

src/../fuzz/fuzzer-cliconf.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['buf_getbyte', 'm_free_direct', 'sign_key_free', 'm_strdup', 'buf_putbyte', 'cli_getopts', 'wrapfd_close', 'parse_multihop_hostname', 'buf_free', 'sha256_done']

src/../fuzz/fuzzer-kexcurve25519.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['buf_put_pub_key', 'buf_putmpint', 'mp_div_2d', 'fuzz_set_input', 'sha256_init', 'fuzz_seed', 'mp_from_ubin', 'sha256_done', 'buf_getint']

src/../fuzz/fuzzer-pubkey.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['buf_getptr', 'sha256_done', 'cmp_base64_key', 'sha256_init', 'buf_new', 'register_cipher', 'crypto_init', 'fuzz_common_setup', 'm_malloc', 'register_hash']

src/../fuzz/fuzzer-kexdh.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['mp_clear_multi', 's_mp_mul_digs_fast', 'mp_div_2', 's_mp_sqr_fast', 'mp_2expt', 'mp_exptmod', 'buf_putmpint', 'm_free_direct', 'mp_div_2d', 's_mp_exptmod_fast']

src/../fuzz/fuzzer-kexecdh.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['s_mp_mul_digs_fast', 'buf_putmpint', 'mp_div_2d', 'mp_init_multi', 'fuzz_set_input', 'buf_put_ecc_raw_pubkey_string', 'mp_read_radix', 'buf_put_pub_key', 'mp_init_size', 'ecc_is_point']

src/../fuzz/fuzzer-verify.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['buf_getptr', 'sha256_done', 'dropbear_ed25519_verify', 's_mp_mul_digs', 'mp_init_multi', 'buf_dss_verify', 's_mp_exptmod_fast', 'mp_prime_is_prime', 'mp_read_radix', 'register_cipher']

src/../fuzz/fuzzer-preauth_nomaths.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['session_loop', 'm_strdup', 'buf_free', 'wrapfd_remove', 'checktimeouts', 'sha256_done', 'fuzz_get_socket_address', 's_mp_mul_digs_fast', 'ecc_is_point']

src/../fuzz/fuzzer-client_nomaths.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['buf_has_algo', 'cli_sessionloop', 'buf_getbyte', 'cbuf_new', 'cli_auth_getmethods', 'session_loop', 'm_realloc', 'list_append', 'parse_hostname']

src/../fuzz/fuzzer-preauth.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['session_loop', 'm_strdup', 'buf_free', 'wrapfd_remove', 'checktimeouts', 'sha256_done', 'fuzz_get_socket_address', 's_mp_mul_digs_fast', 'buf_new']

src/../fuzz/fuzzer-postauth_nomaths.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['session_loop', 'm_strdup', 'buf_free', 'wrapfd_remove', 'checktimeouts', 'sha256_done', 'fuzz_get_socket_address', 's_mp_mul_digs_fast', 'ecc_is_point', 'buf_new']

src/../fuzz/fuzzer-client.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['par25519', 'session_loop', 'rsa_pad_em', 'cli_auth_getmethods', 'list_append', 'sha1_done', 'parse_hostname', 'm_strdup', 'buf_put_pub_key']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
cli_getopts	336	155	46.13%	['fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']
parse_multihop_hostname	41	18	43.90%	['fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']
signkey_key_ptr	38	16	42.10%	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
svr_getopts	256	80	31.25%	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']
mp_exptmod	41	18	43.90%	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']
mp_montgomery_reduce	45	10	22.22%	[]
mp_prime_is_prime	128	59	46.09%	['fuzzer-verify']
mp_reduce	52	26	50.0%	[]
mp_sqrt	44	23	52.27%	['fuzzer-verify']
s_mp_mul_digs	41	12	29.26%	['fuzzer-cliconf', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
s_mp_mul_high_digs	40	13	32.5%	[]
buf_ecdsa_verify	98	53	54.08%	['fuzzer-verify']
ctr_encrypt	38	14	36.84%	[]
ctr_start	44	22	50.0%	[]
checktimeouts	34	15	44.11%	['fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
set_sock_priority	40	8	20.0%	['fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
write_packet	33	18	54.54%	['fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
svr_auth_password	65	31	47.69%	[]
svr_auth_pubkey	107	53	49.53%	[]
svr_chansess_checksignal	35	6	17.14%	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']
cli_sessionloop	91	33	36.26%	['fuzzer-client_nomaths', 'fuzzer-client']
spawn_command	68	11	16.17%	[]
connect_remote	40	18	45.0%	[]
connect_streamlocal	34	16	47.05%	[]
dropbear_listen	117	13	11.11%	['fuzzer-client_nomaths', 'fuzzer-client']
pty_setowner	46	14	30.43%	[]
svr_agentcleanup	34	8	23.52%	[]
ptycommand	78	14	17.94%	[]
get_termmodes	67	14	20.89%	[]

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/dropbear/src/svr-auth.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']
/src/dropbear/libtommath/bn_s_mp_montgomery_reduce_fast.c	[]	[]
/src/dropbear/src/netio.c	['fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/src/cli-authinteract.c	['fuzzer-client_nomaths', 'fuzzer-client']	[]
/src/dropbear/src/chachapoly.c	[]	[]
/src/dropbear/libtommath/bn_mp_init_u32.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/src/common-kex.c	['fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/stream/chacha/chacha_crypt.c	[]	[]
/src/dropbear/src/dss.c	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/src/dbrandom.c	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-pubkey', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-pubkey', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/src/dbmalloc.c	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-pubkey', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-pubkey', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_2expt.c	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_exptmod.c	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client']
/src/dropbear/src/queue.c	['fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/src/../fuzz/fuzzer-cliconf.c	['fuzzer-cliconf']	[]
/src/dropbear/libtomcrypt/src/modes/ctr/ctr_decrypt.c	[]	[]
/src/dropbear/src/signkey.c	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-pubkey', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-pubkey', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/misc/crypt/crypt_register_cipher.c	['fuzzer-cliconf', 'fuzzer-pubkey', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-cliconf', 'fuzzer-pubkey', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_div.c	['fuzzer-cliconf', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/src/svr-authpubkey.c	['fuzzer-pubkey']	['fuzzer-pubkey']
/src/dropbear/libtommath/bn_mp_addmod.c	['fuzzer-client_nomaths', 'fuzzer-client']	[]
/src/dropbear/src/cli-agentfwd.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client_nomaths']
/src/dropbear/src/svr-kex.c	[]	[]
/src/dropbear/libtomcrypt/src/modes/ctr/ctr_start.c	[]	[]
/src/dropbear/libtomcrypt/src/misc/crypt/crypt_cipher_is_valid.c	[]	[]
/src/dropbear/src/cli-kex.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/src/cli-runopts.c	['fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_clear_multi.c	['fuzzer-cliconf', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_s_mp_sub.c	['fuzzer-cliconf', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_s_mp_invmod_slow.c	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_init_set.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/src/../fuzz/fuzzer-kexecdh.c	['fuzzer-kexecdh']	[]
/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_projective_dbl_point.c	[]	[]
/src/dropbear/libtommath/bn_mp_exch.c	['fuzzer-cliconf', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_init_copy.c	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_prime_rabin_miller_trials.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/src/../fuzz/fuzzer-preauth.c	['fuzzer-preauth']	[]
/src/dropbear/libtommath/bn_mp_set.c	['fuzzer-cliconf', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/src/dbhelpers.c	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-pubkey', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_reduce_is_2k.c	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/hashes/sha1.c	['fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/ciphers/aes/aes.c	[]	[]
/src/dropbear/libtommath/bn_s_mp_prime_is_divisible.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/src/cli-chansession.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_cmp.c	['fuzzer-cliconf', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_sub_d.c	['fuzzer-cliconf', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/src/../fuzz/fuzzer-pubkey.c	['fuzzer-pubkey']	[]
/src/dropbear/libtommath/bn_mp_gcd.c	[]	[]
/src/dropbear/libtommath/bn_mp_neg.c	[]	[]
/src/dropbear/libtomcrypt/src/mac/hmac/hmac_process.c	['fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']
/src/dropbear/src/gendss.c	[]	[]
/src/dropbear/libtomcrypt/src/mac/hmac/hmac_init.c	['fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']
/src/dropbear/src/cli-session.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_init_multi.c	['fuzzer-cliconf', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/src/svr-session.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']
/src/dropbear/libtommath/bn_mp_get_l.c	[]	[]
/src/dropbear/libtommath/bn_mp_dr_setup.c	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	[]
/src/dropbear/src/cli-auth.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_get_mag_ul.c	[]	[]
/src/dropbear/libtomcrypt/src/hashes/helper/hash_memory.c	['fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	[]
/src/dropbear/libtomcrypt/src/stream/chacha/chacha_ivctr64.c	[]	[]
/src/dropbear/src/svr-agentfwd.c	[]	[]
/src/dropbear/src/rsa.c	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_get_mag_u32.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/libtommath/bn_mp_montgomery_setup.c	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/misc/crypt/crypt_find_cipher.c	[]	[]
/src/dropbear/libtommath/bn_mp_mul.c	['fuzzer-cliconf', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_montgomery_reduce.c	[]	[]
/src/dropbear/src/../fuzz/fuzz-sshpacketmutator.c	[]	[]
/src/dropbear/src/sk-ecdsa.c	['fuzzer-verify']	[]
/src/dropbear/libtommath/bn_mp_to_radix.c	[]	[]
/src/dropbear/libtommath/bn_mp_to_ubin.c	['fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-client']
/src/dropbear/src/../fuzz/fuzzer-verify.c	['fuzzer-verify']	[]
/src/dropbear/libtomcrypt/src/modes/ctr/ctr_encrypt.c	[]	[]
/src/dropbear/libtommath/bn_mp_dr_is_modulus.c	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client']
/src/dropbear/src/gened25519.c	[]	[]
/src/dropbear/libtomcrypt/src/hashes/sha2/sha384.c	[]	[]
/src/dropbear/libtommath/bn_mp_prime_miller_rabin.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/src/ed25519.c	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/src/process-packet.c	['fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_lshd.c	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_div_d.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/src/genrsa.c	[]	[]
/src/dropbear/libtommath/bn_mp_dr_reduce.c	[]	[]
/src/dropbear/libtommath/bn_mp_mod_d.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/libtommath/bn_s_mp_sqr_fast.c	['fuzzer-cliconf', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_s_mp_mul_high_digs.c	[]	[]
/src/dropbear/libtommath/bn_s_mp_mul_high_digs_fast.c	[]	[]
/src/dropbear/src/crypto_desc.c	['fuzzer-cliconf', 'fuzzer-pubkey', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-cliconf', 'fuzzer-pubkey', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_projective_add_point.c	[]	[]
/src/dropbear/libtommath/bn_mp_init_size.c	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_mul_2.c	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client']
/src/dropbear/src/cli-channel.c	[]	[]
/src/dropbear/libtommath/bn_mp_ubin_size.c	['fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-client']
/src/dropbear/src/packet.c	['fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/src/../fuzz/fuzz-wrapfd.c	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-pubkey', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	[]
/src/dropbear/libtommath/bn_s_mp_reverse.c	[]	[]
/src/dropbear/src/curve25519.c	['fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/stream/chacha/chacha_keystream.c	[]	[]
/src/dropbear/src/cli-readconf.c	['fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-cliconf']
/src/dropbear/libtommath/bn_mp_copy.c	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_reduce_2k_setup_l.c	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_set_ul.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client']
/src/dropbear/libtommath/bn_mp_reduce_2k_l.c	[]	[]
/src/dropbear/libtommath/bn_mp_div_2d.c	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_is_valid_idx.c	['fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-client']
/src/dropbear/libtommath/bn_s_mp_mul_digs_fast.c	['fuzzer-cliconf', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/src/sk-ed25519.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/libtomcrypt/src/pk/ecc/ecc_free.c	['fuzzer-cliconf', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/src/buffer.c	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-pubkey', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-pubkey', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/src/sshpty.c	[]	[]
/src/dropbear/libtommath/bn_mp_clamp.c	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_get_i32.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/libtommath/bn_mp_zero.c	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/pk/ecc/ecc_ansi_x963_export.c	['fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/math/multi.c	['fuzzer-cliconf', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/mac/poly1305/poly1305.c	[]	[]
/src/dropbear/libtommath/bn_mp_sqrt.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/libtommath/bn_mp_clear.c	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/src/../fuzz/fuzzer-kexcurve25519.c	['fuzzer-kexcurve25519']	[]
/src/dropbear/libtomcrypt/src/misc/crypt/crypt_register_prng.c	['fuzzer-cliconf', 'fuzzer-pubkey', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-cliconf', 'fuzzer-pubkey', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/math/ltm_desc.c	[]	[]
/src/dropbear/src/../fuzz/fuzzer-postauth_nomaths.c	['fuzzer-postauth_nomaths']	[]
/src/dropbear/libtommath/bn_mp_mul_d.c	['fuzzer-cliconf', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/pk/ecc/ecc_make_key.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client']
/src/dropbear/src/atomicio.c	['fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	[]
/src/dropbear/libtommath/bn_mp_from_ubin.c	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/stream/chacha/chacha_setup.c	[]	[]
/src/dropbear/libtommath/bn_s_mp_sqr.c	['fuzzer-cliconf', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-verify']
/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_mulmod_timing.c	[]	[]
/src/dropbear/libtommath/bn_mp_cmp_mag.c	['fuzzer-cliconf', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_submod.c	[]	[]
/src/dropbear/src/circbuffer.c	['fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-client_nomaths', 'fuzzer-postauth_nomaths']
/src/dropbear/src/ecdsa.c	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_div_2.c	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_mod_2d.c	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_cnt_lsb.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/libtommath/bn_s_mp_balance_mul.c	['fuzzer-cliconf', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	[]
/src/dropbear/libtommath/bn_mp_mod.c	['fuzzer-cliconf', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_s_mp_invmod_fast.c	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-client']
/src/dropbear/src/../fuzz/fuzz-common.c	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-pubkey', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	[]
/src/dropbear/src/common-channel.c	['fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/src/tcp-accept.c	['fuzzer-client_nomaths', 'fuzzer-client']	[]
/src/dropbear/libtommath/bn_mp_add_d.c	['fuzzer-cliconf', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_mulmod.c	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client']
/src/dropbear/src/common-algo.c	['fuzzer-cliconf', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_s_mp_exptmod_fast.c	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client']
/src/dropbear/src/list.c	['fuzzer-cliconf', 'fuzzer-pubkey', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-cliconf', 'fuzzer-pubkey', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/src/cli-authpasswd.c	['fuzzer-client_nomaths', 'fuzzer-client']	[]
/src/dropbear/src/cli-tcpfwd.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client_nomaths']
/src/dropbear/src/loginrec.c	[]	[]
/src/dropbear/libtommath/bn_mp_lcm.c	[]	[]
/src/dropbear/libtommath/bn_mp_grow.c	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/src/../fuzz/fuzzer-preauth_nomaths.c	['fuzzer-preauth_nomaths']	[]
/src/dropbear/src/svr-runopts.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']
/src/dropbear/libtomcrypt/src/misc/crypt/crypt_find_hash.c	[]	[]
/src/dropbear/libtommath/bn_mp_div_3.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/libtommath/bn_mp_add.c	['fuzzer-cliconf', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_reduce.c	[]	[]
/src/dropbear/src/svr-service.c	[]	[]
/src/dropbear/libtomcrypt/src/headers/tomcrypt_macros.h	['fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_reduce_setup.c	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_montgomery_calc_normalization.c	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_points.c	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_sub.c	['fuzzer-cliconf', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/src/../fuzz/fuzzer-kexdh.c	['fuzzer-kexdh']	[]
/src/dropbear/src/common-session.c	['fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_read_radix.c	['fuzzer-cliconf', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_map.c	[]	[]
/src/dropbear/src/svr-authpubkeyoptions.c	['fuzzer-pubkey']	['fuzzer-pubkey']
/src/dropbear/libtomcrypt/src/misc/base64/base64_decode.c	['fuzzer-pubkey']	['fuzzer-pubkey']
/src/dropbear/libtommath/bn_mp_set_u32.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/src/cli-authpubkey.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client_nomaths']
/src/dropbear/libtomcrypt/src/misc/crypt/crypt_argchk.c	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-pubkey', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	[]
/src/dropbear/libtommath/bn_mp_sqr.c	['fuzzer-cliconf', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/src/ecc.c	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-pubkey', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-pubkey', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/src/../fuzz/fuzzer-client_nomaths.c	['fuzzer-client_nomaths']	[]
/src/dropbear/libtommath/bn_mp_reduce_2k_setup.c	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	[]
/src/dropbear/libtommath/bn_mp_init.c	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_s_mp_add.c	['fuzzer-cliconf', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/src/svr-authpasswd.c	[]	[]
/src/dropbear/src/gensignkey.c	[]	[]
/src/dropbear/libtomcrypt/src/mac/hmac/hmac_done.c	['fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']
/src/dropbear/libtommath/bn_mp_rand.c	['fuzzer-cliconf', 'fuzzer-pubkey', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-cliconf', 'fuzzer-pubkey', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/src/compat.c	['fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/src/listener.c	['fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/src/bignum.c	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/src/../fuzz/fuzzer-client.c	['fuzzer-client']	[]
/src/dropbear/libtommath/bn_mp_invmod.c	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_reduce_is_2k_l.c	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/misc/crypt/crypt_prng_is_valid.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client']
/src/dropbear/src/svr-chansession.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']
/src/dropbear/libtomcrypt/src/misc/zeromem.c	['fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/misc/crypt/crypt_hash_is_valid.c	['fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']
/src/dropbear/libtommath/bn_mp_abs.c	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	[]
/src/dropbear/src/dbutil.c	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-pubkey', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-pubkey', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_rshd.c	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_mul2add.c	[]	[]
/src/dropbear/libtomcrypt/src/misc/crypt/crypt_register_hash.c	['fuzzer-cliconf', 'fuzzer-pubkey', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-cliconf', 'fuzzer-pubkey', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/misc/base64/base64_encode.c	['fuzzer-pubkey']	[]
/src/dropbear/libtommath/bn_mp_mul_2d.c	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_s_mp_exptmod.c	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-client']
/src/dropbear/src/ltc_prng.c	[]	[]
/src/dropbear/libtommath/bn_mp_prime_is_prime.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/libtommath/bn_s_mp_mul_digs.c	['fuzzer-cliconf', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-client']
/src/dropbear/src/common-runopts.c	['fuzzer-cliconf', 'fuzzer-pubkey', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-cliconf', 'fuzzer-pubkey', 'fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/src/svr-tcpfwd.c	[]	[]
/src/dropbear/libtommath/bn_mp_sqrmod.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/libtommath/bn_mp_reduce_2k.c	[]	[]
/src/dropbear/libtommath/bn_mp_cmp_d.c	['fuzzer-cliconf', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_count_bits.c	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/hashes/sha2/sha256.c	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-pubkey', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-pubkey', 'fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/hashes/sha2/sha512.c	['fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_is_square.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/libtommath/bn_mp_prime_next_prime.c	[]	[]

Directories in report

Directory
/src/dropbear/libtomcrypt/src/hashes/sha2/
/src/dropbear/libtomcrypt/src/misc/
/src/dropbear/libtomcrypt/src/headers/
/src/dropbear/libtomcrypt/src/pk/ecc/
/src/dropbear/libtomcrypt/src/mac/poly1305/
/src/dropbear/libtomcrypt/src/ciphers/aes/
/src/dropbear/libtomcrypt/src/misc/base64/
/src/dropbear/libtommath/
/src/dropbear/libtomcrypt/src/modes/ctr/
/src/dropbear/libtomcrypt/src/hashes/
/src/dropbear/libtomcrypt/src/math/
/src/dropbear/libtomcrypt/src/hashes/helper/
/src/dropbear/src/../fuzz/
/src/dropbear/libtomcrypt/src/misc/crypt/
/src/dropbear/libtomcrypt/src/stream/chacha/
/src/dropbear/src/
/src/dropbear/libtomcrypt/src/mac/hmac/