High level conclusions

Fuzzers reach 64.16% code coverage.

Fuzzer fuzz_pkcs15_tool is blocked:

The runtime code coverage of fuzz_pkcs15_tool covers 23.15% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_asn1_sig_value is blocked:

The runtime code coverage of fuzz_asn1_sig_value covers 29.19% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzers reach 19.73% of cyclomatic complexity.

Fuzzers reach 19.14% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

600 / 3134

Cyclomatic complexity statically reachable by fuzzers

5592 / 28331

Runtime code coverage of functions

2011 / 3134

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzz_asn1_print

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1	0.90%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	109	99.0%
All colors	110	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	None	0	0	sc_asn1_read_tag	call site: 00004	/src/opensc/src/libopensc/asn1.c:71
0	0	None	0	0	sc_asn1_read_tag	call site: 00004	/src/opensc/src/libopensc/asn1.c:86
0	0	None	0	0	print_tags_recursive	call site: 00013	/src/opensc/src/libopensc/asn1.c:416
0	0	None	0	0	print_hex	call site: 00027	/src/opensc/src/libopensc/asn1.c:181
0	0	None	0	0	decode_bit_string	call site: 00033	/src/opensc/src/libopensc/asn1.c:605
0	0	None	0	0	decode_bit_string	call site: 00033	/src/opensc/src/libopensc/asn1.c:623
0	0	None	0	0	sc_hex_dump	call site: 00020	/src/opensc/src/libopensc/log.c:367
0	0	None	0	0	sc_hex_dump	call site: 00020	/src/opensc/src/libopensc/log.c:371
0	0	None	0	0	sc_dump_hex	call site: 00062	/src/opensc/src/libopensc/log.c:408
0	0	None	0	0	sc_init_oid	call site: 00043	/src/opensc/src/libopensc/sc.c:258

Runtime coverage analysis

Covered functions

24

Functions that are reachable but not covered

13

Reachable functions

37

Percentage of reachable functions covered

64.86%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/fuzz_asn1_print.c	1
libopensc/asn1.c	19
libopensc/log.c	3
libopensc/sc.c	1

Fuzzer: fuzz_scconf_parse_string

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3	3.70%
gold	[1:9]	3	3.70%
yellow	[10:29]	2	2.46%
greenyellow	[30:49]	1	1.23%
lawngreen	50+	72	88.8%
All colors	81	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2	2	1 : View List ['fgetc']	2	2	buf_nextch	call site: 00009	/src/opensc/src/scconf/sclex.c:81
0	0	None	4	4	scconf_new	call site: 00002	/src/opensc/src/scconf/scconf.c:40
0	0	None	2	12	scconf_block_add_internal	call site: 00040	/src/opensc/src/scconf/parse.c:178
0	0	None	2	2	scconf_parse_token	call site: 00018	/src/opensc/src/scconf/parse.c:268
0	0	None	2	2	scconf_list_add	call site: 00033	/src/opensc/src/scconf/scconf.c:322
0	0	None	0	15	scconf_parse_string	call site: 00006	/src/opensc/src/scconf/parse.c:423
0	0	None	0	10	scconf_block_add_internal	call site: 00041	/src/opensc/src/scconf/parse.c:183
0	0	None	0	0	scconf_item_add_internal	call site: 00021	/src/opensc/src/scconf/parse.c:109
0	0	None	0	0	scconf_new	call site: 00004	/src/opensc/src/scconf/scconf.c:45
0	0	None	0	0	scconf_free	call site: 00076	/src/opensc/src/scconf/scconf.c:59
0	0	None	0	0	buf_init	call site: 00007	/src/opensc/src/scconf/sclex.c:48
0	0	None	0	0	buf_addch	call site: 00013	/src/opensc/src/scconf/sclex.c:61

Runtime coverage analysis

Covered functions

27

Functions that are reachable but not covered

8

Reachable functions

35

Percentage of reachable functions covered

77.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/fuzz_scconf_parse_string.c	1
scconf/scconf.c	6
scconf/parse.c	11
scconf/sclex.c	8
common/compat_strlcpy.c	1

Fuzzer: fuzz_asn1_sig_value

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	410	76.2%
gold	[1:9]	48	8.92%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	3	0.55%
lawngreen	50+	77	14.3%
All colors	538	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
230	230	3 : View List ['scconf_find_blocks', 'ctapi_load_module', 'free']	230	230	ctapi_init	call site: 00000	/src/opensc/src/libopensc/reader-ctapi.c:526
182	182	1 : View List ['sc_release_context']	182	185	sc_context_create	call site: 00221	/src/opensc/src/libopensc/ctx.c:999
131	131	4 : View List ['strcmp', 'free', 'scconf_find_blocks', 'load_parameters']	131	192	process_config_file	call site: 00096	/src/opensc/src/libopensc/ctx.c:734
34	38	3 : View List ['scconf_list_destroy', 'set_drivers', 'scconf_list_add']	34	262	sc_context_create	call site: 00224	/src/opensc/src/libopensc/ctx.c:1006
2	2	1 : View List ['fclose']	220	638	sc_context_create	call site: 00088	/src/opensc/src/libopensc/ctx.c:969
2	2	1 : View List ['atoi']	135	476	process_config_file	call site: 00089	/src/opensc/src/libopensc/ctx.c:706
0	708	3 : View List ['sc_asn1_skip_tag', 'asn1_decode_entry', 'asn1_decode']	0	1489	asn1_decode	call site: 00297	/src/opensc/src/libopensc/asn1.c:1767
0	279	1 : View List ['asn1_encode_entry']	0	857	asn1_encode_entry	call site: 00436	/src/opensc/src/libopensc/asn1.c:1838
0	133	3 : View List ['sc_do_log_color', 'sc_do_log', 'sc_strerror']	0	133	asn1_write_element	call site: 00521	/src/opensc/src/libopensc/asn1.c:1107
0	61	1 : View List ['sc_do_log']	0	61	sc_asn1_skip_tag	call site: 00299	/src/opensc/src/libopensc/asn1.c:538
0	61	1 : View List ['sc_do_log']	0	61	sc_asn1_skip_tag	call site: 00299	/src/opensc/src/libopensc/asn1.c:542
0	61	1 : View List ['sc_do_log']	0	61	sc_asn1_skip_tag	call site: 00299	/src/opensc/src/libopensc/asn1.c:546

Runtime coverage analysis

Covered functions

88

Functions that are reachable but not covered

114

Reachable functions

161

Percentage of reachable functions covered

29.19%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/fuzz_asn1_sig_value.c	1
libopensc/ctx.c	21
libopensc/log.c	8
common/simclist.c	12
libopensc/card.c	2
common/libscdl.c	4
libopensc/sc.c	9
scconf/scconf.c	11
scconf/parse.c	11
scconf/sclex.c	8
common/compat_strlcpy.c	1
libopensc/reader-ctapi.c	1
libopensc/asn1.c	31
libopensc/errors.c	1
libopensc/pkcs15-algo.c	3

Fuzzer: fuzz_pkcs15_tool

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2261	90.4%
gold	[1:9]	1	0.04%
yellow	[10:29]	4	0.16%
greenyellow	[30:49]	53	2.12%
lawngreen	50+	181	7.24%
All colors	2500	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
19740	19776	22 : View List ['list_pins', 'read_public_key', 'sc_pkcs15_bind', 'read_ssh_key', 'list_apps', 'change_pin', 'test_session_pin', 'dump', 'list_info', 'read_certificate', 'update', 'list_private_keys', 'list_public_keys', 'unblock_pin', 'list_skeys', 'read_data_object', 'sc_hex_to_bin', 'sc_strerror', 'test_update', 'list_certificates', 'verify_pin', 'list_data_objects']	19740	20940	_main	call site: 00325	/src/opensc/src/tests/fuzzing/../../../src/tools/pkcs15-tool.c:2382
1245	2338	6 : View List ['piv_process_ccc', 'piv_obj_cache_free_entry', 'piv_find_discovery', 'sc_transmit_apdu', 'sc_format_apdu', 'piv_find_aid']	1245	3142	piv_match_card_continued	call site: 00000	/src/opensc/src/libopensc/card-piv.c:5514
895	956	4 : View List ['sc_pkcs15_pincache_clear', 'sc_do_log', 'sc_dlclose', 'sc_pkcs15_card_free']	895	956	sc_pkcs15_unbind	call site: 02479	/src/opensc/src/libopensc/pkcs15.c:1379
697	758	3 : View List ['cac_new_private_data', 'cac_populate_cac1', 'sc_do_log']	716	777	cac_find_and_initialize	call site: 00000	/src/opensc/src/libopensc/card-cac1.c:462
628	1159	2 : View List ['iso7816_select_aid', 'piv_find_discovery']	628	1353	piv_card_reader_lock_obtained	call site: 00000	/src/opensc/src/libopensc/card-piv.c:6205
522	522	1 : View List ['sc_set_le_and_transmit']	887	1164	sc_transmit	call site: 02338	/src/opensc/src/libopensc/apdu.c:524
522	522	1 : View List ['sc_sm_single_transmit']	522	655	sc_single_transmit	call site: 02341	/src/opensc/src/libopensc/apdu.c:372
365	365	1 : View List ['sc_get_response']	365	570	sc_transmit	call site: 02338	/src/opensc/src/libopensc/apdu.c:534
352	413	3 : View List ['sc_do_log', '_dtrust_match_profile', '_dtrust_match_cardos']	352	413	dtrust_match_card	call site: 00000	/src/opensc/src/libopensc/card-dtrust.c:170
350	350	1 : View List ['sc_detect_escape_cmds']	597	1983	sc_connect_card	call site: 00352	/src/opensc/src/libopensc/card.c:265
243	251	3 : View List ['sc_get_max_recv_size', 'sc_get_max_send_size', 'sc_card_sm_check']	243	728	sc_connect_card	call site: 00536	/src/opensc/src/libopensc/card.c:366
230	230	3 : View List ['scconf_find_blocks', 'ctapi_load_module', 'free']	230	230	ctapi_init	call site: 00000	/src/opensc/src/libopensc/reader-ctapi.c:526

Runtime coverage analysis

Covered functions

213

Functions that are reachable but not covered

322

Reachable functions

419

Percentage of reachable functions covered

23.15%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/fuzz_pkcs15_tool.c	3
tests/fuzzing/fuzzer_tool.c	4
tests/fuzzing/../../../src/tools/pkcs15-tool.c	39
tests/fuzzing/../../tools/util.c	4
libopensc/ctx.c	23
libopensc/log.c	10
common/simclist.c	14
libopensc/card.c	24
common/libscdl.c	4
libopensc/sc.c	25
scconf/scconf.c	11
scconf/parse.c	11
scconf/sclex.c	8
common/compat_strlcpy.c	1
libopensc/reader-ctapi.c	1
libopensc/errors.c	1
tests/fuzzing/fuzzer_reader.c	3
libopensc/reader-tr03119.c	2
libopensc/asn1.c	33
libopensc/pkcs15-algo.c	4
libopensc/dir.c	3
libopensc/ef-atr.c	1
libopensc/pkcs15.c	53
libopensc/pkcs15-prkey.c	1
libopensc/aux-data.c	2
libopensc/pkcs15-pubkey.c	17
libopensc/pkcs15-cert.c	4
libopensc/pkcs15-skey.c	1
libopensc/pkcs15-data.c	3
libopensc/pkcs15-pin.c	10
libopensc/pkcs15-syn.c	3
libopensc/pkcs15-emulator-filter.c	3
libopensc/pkcs15-cache.c	3
tools/../pkcs11/pkcs11-display.c	2
libopensc/compression.c	4
ui/notify.c	1
libopensc/sec.c	1
libopensc/base64.c	2
common/compat_strlcat.c	1
libopensc/apdu.c	7
libopensc/sm.c	4

Fuzzer: fuzz_piv_tool

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	571	57.7%
gold	[1:9]	57	5.76%
yellow	[10:29]	17	1.72%
greenyellow	[30:49]	3	0.30%
lawngreen	50+	340	34.4%
All colors	988	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
522	522	1 : View List ['sc_sm_single_transmit']	522	655	sc_single_transmit	call site: 00675	/src/opensc/src/libopensc/apdu.c:372
381	406	6 : View List ['i2d_X509', 'sc_select_file', 'sc_format_path', 'sc_hex_to_bin', 'malloc', 'sc_write_binary']	383	408	load_cert	call site: 00938	/src/opensc/src/tests/fuzzing/../../../src/tools/piv-tool.c:216
350	350	1 : View List ['sc_detect_escape_cmds']	354	1983	sc_connect_card	call site: 00352	/src/opensc/src/libopensc/card.c:265
284	309	4 : View List ['sc_write_binary', 'sc_format_path', 'sc_select_file', 'sc_asn1_find_tag']	286	311	load_object	call site: 00867	/src/opensc/src/tests/fuzzing/../../../src/tools/piv-tool.c:142
230	230	3 : View List ['scconf_find_blocks', 'ctapi_load_module', 'free']	230	230	ctapi_init	call site: 00000	/src/opensc/src/libopensc/reader-ctapi.c:526
149	224	6 : View List ['sc_card_sm_load', 'scconf_get_str', 'scconf_find_blocks', 'free', '_strlcpy', 'strcasecmp']	149	1105	sc_card_sm_check	call site: 00543	/src/opensc/src/libopensc/card.c:1651
131	131	4 : View List ['strcmp', 'free', 'scconf_find_blocks', 'load_parameters']	131	192	process_config_file	call site: 00135	/src/opensc/src/libopensc/ctx.c:734
128	347	5 : View List ['sc_asn1_read_tag', 'sc_asn1_put_tag', 'malloc', 'sc_asn1_find_tag', 'piv_cache_internal_data']	128	785	piv_process_history	call site: 00000	/src/opensc/src/libopensc/card-piv.c:5147
34	38	3 : View List ['scconf_list_destroy', 'set_drivers', 'scconf_list_add']	34	262	sc_context_create	call site: 00263	/src/opensc/src/libopensc/ctx.c:1006
18	18	7 : View List ['i2d_PUBKEY_bio', 'EC_KEY_print_fp', 'EVP_PKEY_assign', 'EC_KEY_free', 'EC_KEY_set_group', 'EC_KEY_set_public_key', 'EC_KEY_new']	30	425	gen_key	call site: 00830	/src/opensc/src/tests/fuzzing/../../../src/tools/piv-tool.c:521
7	7	1 : View List ['_strlcpy']	7	7	sc_get_cache_dir	call site: 00000	/src/opensc/src/libopensc/ctx.c:1136
6	6	2 : View List ['RSA_free', 'BN_free']	8	87	gen_key	call site: 00810	/src/opensc/src/tests/fuzzing/../../../src/tools/piv-tool.c:404

Runtime coverage analysis

Covered functions

223

Functions that are reachable but not covered

140

Reachable functions

260

Percentage of reachable functions covered

46.15%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/fuzz_piv_tool.c	5
tests/fuzzing/fuzzer_tool.c	7
tests/fuzzing/../../../src/tools/piv-tool.c	7
tests/fuzzing/../../tools/util.c	2
libopensc/ctx.c	22
libopensc/log.c	11
common/simclist.c	14
libopensc/card.c	21
common/libscdl.c	4
libopensc/sc.c	13
scconf/scconf.c	11
scconf/parse.c	11
scconf/sclex.c	8
common/compat_strlcpy.c	1
libopensc/reader-ctapi.c	1
libopensc/errors.c	1
tests/fuzzing/fuzzer_reader.c	3
libopensc/reader-tr03119.c	2
libopensc/asn1.c	18
libopensc/pkcs15-algo.c	2
libopensc/dir.c	1
libopensc/ef-atr.c	1
libopensc/apdu.c	8
libopensc/sm.c	4

Fuzzer: fuzz_card

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	421	60.0%
gold	[1:9]	1	0.14%
yellow	[10:29]	4	0.57%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	275	39.2%
All colors	701	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1149	1153	5 : View List ['piv_put_data', 'piv_write_certificate', 'piv_obj_cache_free_entry', 'malloc', 'free']	1149	2084	piv_write_binary	call site: 00000	/src/opensc/src/libopensc/card-piv.c:3522
1084	1084	2 : View List ['msc_delete_object', 'msc_read_object']	1084	1681	msc_get_challenge	call site: 00000	/src/opensc/src/libopensc/muscle.c:485
350	350	1 : View List ['sc_detect_escape_cmds']	354	1983	sc_connect_card	call site: 00306	/src/opensc/src/libopensc/card.c:265
262	323	2 : View List ['sc_do_log', '_dtrust_match_profile']	262	323	dtrust_match_card	call site: 00000	/src/opensc/src/libopensc/card-dtrust.c:173
230	230	3 : View List ['scconf_find_blocks', 'ctapi_load_module', 'free']	230	230	ctapi_init	call site: 00000	/src/opensc/src/libopensc/reader-ctapi.c:526
149	224	6 : View List ['sc_card_sm_load', 'scconf_get_str', 'scconf_find_blocks', 'free', '_strlcpy', 'strcasecmp']	149	1105	sc_card_sm_check	call site: 00497	/src/opensc/src/libopensc/card.c:1651
131	131	4 : View List ['strcmp', 'free', 'scconf_find_blocks', 'load_parameters']	131	192	process_config_file	call site: 00097	/src/opensc/src/libopensc/ctx.c:734
128	347	5 : View List ['sc_asn1_read_tag', 'sc_asn1_put_tag', 'malloc', 'sc_asn1_find_tag', 'piv_cache_internal_data']	128	785	piv_process_history	call site: 00000	/src/opensc/src/libopensc/card-piv.c:5147
120	120	1 : View List ['process_fci_v3_4']	120	272	starcos_select_fid	call site: 00000	/src/opensc/src/libopensc/card-starcos.c:891
108	108	1 : View List ['des3_decrypt_cbc']	108	108	decrypt_response	call site: 00000	/src/opensc/src/libopensc/card-epass2003.c:1476
67	67	2 : View List ['parse_sec_attr', 'parse_sec_attr_44']	67	67	setcos_select_file	call site: 00000	/src/opensc/src/libopensc/card-setcos.c:930
34	38	3 : View List ['scconf_list_destroy', 'set_drivers', 'scconf_list_add']	34	262	sc_context_create	call site: 00225	/src/opensc/src/libopensc/ctx.c:1006

Runtime coverage analysis

Covered functions

591

Functions that are reachable but not covered

93

Reachable functions

187

Percentage of reachable functions covered

50.27%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/fuzz_card.c	1
libopensc/ctx.c	22
libopensc/log.c	10
common/simclist.c	14
libopensc/card.c	22
common/libscdl.c	4
libopensc/sc.c	11
scconf/scconf.c	11
scconf/parse.c	11
scconf/sclex.c	8
common/compat_strlcpy.c	1
libopensc/reader-ctapi.c	1
tests/fuzzing/fuzzer_reader.c	4
libopensc/errors.c	1
libopensc/reader-tr03119.c	2
libopensc/asn1.c	17
libopensc/pkcs15-algo.c	2
libopensc/dir.c	1
libopensc/ef-atr.c	1
libopensc/sec.c	2

Fuzzer: fuzz_pkcs15_decode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	464	37.9%
gold	[1:9]	43	3.51%
yellow	[10:29]	30	2.45%
greenyellow	[30:49]	23	1.87%
lawngreen	50+	664	54.2%
All colors	1224	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
4524	4524	4 : View List ['external_key_auth', 'get_external_key_retries', 'update_secret_key', 'get_external_key_maxtries']	4524	5089	epass2003_pin_cmd	call site: 00000	/src/opensc/src/libopensc/card-epass2003.c:3204
2944	3738	12 : View List ['sc_pkcs15_remove_object', 'parse_odf.10247', 'sc_pkcs15_card_clear', 'dump_ef', 'sc_pin_cmd', 'sc_pkcs15emu_object_add', 'sc_pkcs15_format_id', 'sc_print_path', 'sc_pkcs15_free_object', 'sc_format_path', 'sc_pkcs15_parse_df', '_strlcpy']	2944	4564	sc_pkcs15emu_pteid_init	call site: 00000	/src/opensc/src/libopensc/pkcs15-pteid.c:178
1193	1193	1 : View List ['sc_pkcs15emu_esteid2025_init']	1193	1193	sc_pkcs15emu_esteid2025_init_ex	call site: 00000	/src/opensc/src/libopensc/pkcs15-esteid2025.c:210
1017	2586	25 : View List ['bebytes2ushort', 'sc_pkcs15emu_add_ec_pubkey', 'sc_pkcs15emu_add_rsa_pubkey', 'sc_compare_oid', 'sc_asn1_decode_object_id', 'sc_pkcs15emu_add_rsa_prkey', 'sc_pkcs15_format_id', 'sc_select_file', 'sc_pkcs15emu_add_eddsa_pubkey', 'sc_card_ctl', 'sc_format_path', 'sc_card_find_eddsa_alg', 'malloc', 'free', 'sc_get_data', 'sc_card_find_ec_alg', 'sc_pkcs15emu_add_xeddsa_pubkey', 'sc_pkcs15emu_add_ec_prkey', 'sc_pkcs15emu_add_eddsa_prkey', '_strlcpy', 'sc_card_find_xeddsa_alg', 'sc_pkcs15emu_add_x509_cert', 'sc_pkcs15emu_openpgp_add_data', 'sc_pkcs15emu_add_xeddsa_prkey', 'read_file.9436']	1017	3646	sc_pkcs15emu_openpgp_init	call site: 00000	/src/opensc/src/libopensc/pkcs15-openpgp.c:285
956	2748	3 : View List ['sc_pkcs15_get_objects', 'sc_pkcs15_verify_pin', 'sc_oberthur_read_file']	956	3052	sc_oberthur_read_file	call site: 00000	/src/opensc/src/libopensc/pkcs15-oberthur.c:312
945	945	1 : View List ['sc_pkcs15emu_dtrust_init']	945	945	sc_pkcs15emu_dtrust_init_ex	call site: 00000	/src/opensc/src/libopensc/pkcs15-dtrust.c:101
847	1041	6 : View List ['sc_pkcs15_encode_pubkey_eddsa', 'sc_pkcs15_encode_pubkey_gostr3410', 'sc_strerror', 'sc_do_log', 'sc_pkcs15_encode_pubkey_ec', 'sc_do_log_color']	847	1041	sc_pkcs15_encode_pubkey	call site: 00000	/src/opensc/src/libopensc/pkcs15-pubkey.c:767
664	664	1 : View List ['sc_hsm_soc_change']	664	664	sc_hsm_pin_cmd	call site: 00000	/src/opensc/src/libopensc/card-sc-hsm.c:639
617	617	2 : View List ['malloc', 'entersafe_mac_apdu']	617	1272	entersafe_transmit_apdu	call site: 00000	/src/opensc/src/libopensc/card-entersafe.c:402
538	538	1 : View List ['iasecc_mi_match']	538	2409	iasecc_init_amos_or_sagem	call site: 00000	/src/opensc/src/libopensc/card-iasecc.c:568
534	534	1 : View List ['sc_hsm_soc_biomatch']	534	1778	sc_hsm_pin_cmd	call site: 00000	/src/opensc/src/libopensc/card-sc-hsm.c:678
350	350	1 : View List ['sc_detect_escape_cmds']	354	1983	sc_connect_card	call site: 00306	/src/opensc/src/libopensc/card.c:265

Runtime coverage analysis

Covered functions

1006

Functions that are reachable but not covered

91

Reachable functions

256

Percentage of reachable functions covered

64.45%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/fuzz_pkcs15_decode.c	2
libopensc/ctx.c	24
libopensc/log.c	8
common/simclist.c	14
libopensc/card.c	22
common/libscdl.c	4
libopensc/sc.c	22
scconf/scconf.c	11
scconf/parse.c	11
scconf/sclex.c	8
common/compat_strlcpy.c	1
libopensc/reader-ctapi.c	1
tests/fuzzing/fuzzer_reader.c	3
libopensc/errors.c	1
libopensc/reader-tr03119.c	2
libopensc/asn1.c	18
libopensc/pkcs15-algo.c	3
libopensc/dir.c	3
libopensc/ef-atr.c	1
libopensc/pkcs15.c	27
libopensc/pkcs15-prkey.c	1
libopensc/aux-data.c	1
libopensc/pkcs15-pubkey.c	8
libopensc/pkcs15-cert.c	1
libopensc/pkcs15-skey.c	1
libopensc/pkcs15-data.c	1
libopensc/pkcs15-pin.c	1
libopensc/pkcs15-syn.c	3
libopensc/pkcs15-emulator-filter.c	3
libopensc/pkcs15-cache.c	3

Fuzzer: fuzz_pkcs15_reader

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	718	40.2%
gold	[1:9]	30	1.68%
yellow	[10:29]	66	3.70%
greenyellow	[30:49]	17	0.95%
lawngreen	50+	951	53.3%
All colors	1782	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
4524	4524	4 : View List ['external_key_auth', 'get_external_key_retries', 'update_secret_key', 'get_external_key_maxtries']	4524	5089	epass2003_pin_cmd	call site: 00000	/src/opensc/src/libopensc/card-epass2003.c:3204
1193	1193	1 : View List ['sc_pkcs15emu_esteid2025_init']	1193	1193	sc_pkcs15emu_esteid2025_init_ex	call site: 00000	/src/opensc/src/libopensc/pkcs15-esteid2025.c:210
981	2780	26 : View List ['bebytes2ushort', 'sc_pkcs15emu_add_ec_pubkey', 'sc_pkcs15emu_add_rsa_pubkey', 'sc_compare_oid', 'sc_asn1_decode_object_id', 'sc_pkcs15emu_add_rsa_prkey', 'sc_pkcs15_format_id', 'sc_pkcs15emu_add_pin_obj', 'sc_select_file', 'sc_pkcs15emu_add_eddsa_pubkey', 'sc_card_ctl', 'sc_format_path', 'sc_card_find_eddsa_alg', 'malloc', 'free', 'sc_get_data', 'sc_card_find_ec_alg', 'sc_pkcs15emu_add_xeddsa_pubkey', 'sc_pkcs15emu_add_ec_prkey', 'sc_pkcs15emu_add_eddsa_prkey', '_strlcpy', 'sc_card_find_xeddsa_alg', 'sc_pkcs15emu_add_x509_cert', 'sc_pkcs15emu_openpgp_add_data', 'sc_pkcs15emu_add_xeddsa_prkey', 'read_file.9436']	981	3962	sc_pkcs15emu_openpgp_init	call site: 00000	/src/opensc/src/libopensc/pkcs15-openpgp.c:234
945	945	1 : View List ['sc_pkcs15emu_dtrust_init']	945	945	sc_pkcs15emu_dtrust_init_ex	call site: 00000	/src/opensc/src/libopensc/pkcs15-dtrust.c:101
849	861	2 : View List ['sc_pkcs15_print_id', 'sc_pkcs15_find_skey_by_id']	849	1879	sc_pkcs15_verify_pin_with_session_pin	call site: 01348	/src/opensc/src/libopensc/pkcs15-pin.c:368
847	1041	6 : View List ['sc_pkcs15_encode_pubkey_eddsa', 'sc_pkcs15_encode_pubkey_gostr3410', 'sc_strerror', 'sc_do_log', 'sc_pkcs15_encode_pubkey_ec', 'sc_do_log_color']	847	1041	sc_pkcs15_encode_pubkey	call site: 00000	/src/opensc/src/libopensc/pkcs15-pubkey.c:767
664	664	1 : View List ['sc_hsm_soc_change']	664	664	sc_hsm_pin_cmd	call site: 00000	/src/opensc/src/libopensc/card-sc-hsm.c:639
617	617	2 : View List ['malloc', 'entersafe_mac_apdu']	617	1272	entersafe_transmit_apdu	call site: 00000	/src/opensc/src/libopensc/card-entersafe.c:402
557	557	1 : View List ['authentic_chv_verify_pinpad']	557	884	authentic_chv_verify	call site: 00000	/src/opensc/src/libopensc/card-authentic.c:1032
536	597	2 : View List ['sc_do_log', 'myeid_set_security_env_ec']	536	1155	myeid_set_security_env	call site: 00000	/src/opensc/src/libopensc/card-myeid.c:956
534	534	1 : View List ['sc_hsm_soc_biomatch']	534	1778	sc_hsm_pin_cmd	call site: 00000	/src/opensc/src/libopensc/card-sc-hsm.c:678
350	350	1 : View List ['sc_detect_escape_cmds']	354	1983	sc_connect_card	call site: 00305	/src/opensc/src/libopensc/card.c:265

Runtime coverage analysis

Covered functions

1102

Functions that are reachable but not covered

139

Reachable functions

356

Percentage of reachable functions covered

60.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/fuzz_pkcs15_reader.c	1
libopensc/ctx.c	24
libopensc/log.c	11
common/simclist.c	14
libopensc/card.c	28
common/libscdl.c	4
libopensc/sc.c	26
scconf/scconf.c	11
scconf/parse.c	11
scconf/sclex.c	8
common/compat_strlcpy.c	1
libopensc/reader-ctapi.c	1
tests/fuzzing/fuzzer_reader.c	4
libopensc/errors.c	1
libopensc/reader-tr03119.c	2
libopensc/asn1.c	18
libopensc/pkcs15-algo.c	3
libopensc/dir.c	3
libopensc/ef-atr.c	1
libopensc/pkcs15.c	43
libopensc/pkcs15-prkey.c	1
libopensc/aux-data.c	1
libopensc/pkcs15-pubkey.c	3
libopensc/pkcs15-cert.c	1
libopensc/pkcs15-skey.c	1
libopensc/pkcs15-data.c	1
libopensc/pkcs15-pin.c	10
libopensc/pkcs15-syn.c	3
libopensc/pkcs15-emulator-filter.c	3
libopensc/pkcs15-cache.c	3
libopensc/pkcs15-sec.c	10
libopensc/padding.c	12
libopensc/sec.c	6
libopensc/compression.c	4
ui/notify.c	1
libopensc/../../src/common/constant-time.h	8
libopensc/../../src/libopensc/sc-ossl-compat.h	2

Fuzzer: fuzz_pkcs11

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	100.%
All colors	1	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
10181	14350	9 : View List ['sc_pkcs15init_finalize_profile', 'pkcs15_create_private_key', 'pkcs15_create_secret_key', 'sc_pkcs15init_unbind', 'sc_do_log', 'pkcs15_create_data', 'pkcs15_create_public_key', 'sc_pkcs15init_set_p15card', 'pkcs15_create_certificate']	10181	14656	pkcs15_create_object	call site: 00000	/src/opensc/src/pkcs11/framework-pkcs15.c:3148
6769	9377	18 : View List ['sc_pkcs15init_finalize_profile', 'attr_find2', 'sc_pkcs15_find_pubkey_by_id', 'set_gost3410_params', 'sc_pkcs15init_unbind', 'sc_pkcs15_erase_prkey', 'sc_do_log', 'get_X509_usage_privk', '__pkcs15_create_prkey_object', 'pkcs15_add_object', 'sc_pkcs15init_set_p15card', 'attr_find_and_allocate_ptr', 'sc_pkcs15init_generate_key', 'get_X509_usage_pubk', 'attr_find', 'sc_pkcs15_fix_ec_parameters', '__pkcs15_create_pubkey_object', 'sc_pkcs15_dup_pubkey']	6769	10031	pkcs15_gen_keypair	call site: 00000	/src/opensc/src/pkcs11/framework-pkcs15.c:3398
4524	4524	4 : View List ['external_key_auth', 'get_external_key_retries', 'update_secret_key', 'get_external_key_maxtries']	4524	5089	epass2003_pin_cmd	call site: 00000	/src/opensc/src/libopensc/card-epass2003.c:3204
4276	5440	7 : View List ['sc_pkcs15init_finalize_profile', 'sc_pkcs15init_unbind', 'pkcs15_init_slot', 'sc_do_log', 'free', 'sc_pkcs15init_store_pin', 'sc_pkcs15_find_pin_by_auth_id']	4276	5883	pkcs15_init_pin	call site: 00000	/src/opensc/src/pkcs11/framework-pkcs15.c:2284
2944	3738	12 : View List ['sc_pkcs15_remove_object', 'parse_odf.10247', 'sc_pkcs15_card_clear', 'dump_ef', 'sc_pin_cmd', 'sc_pkcs15emu_object_add', 'sc_pkcs15_format_id', 'sc_print_path', 'sc_pkcs15_free_object', 'sc_format_path', 'sc_pkcs15_parse_df', '_strlcpy']	2944	4564	sc_pkcs15emu_pteid_init	call site: 00000	/src/opensc/src/libopensc/pkcs15-pteid.c:178
1680	1775	2 : View List ['sc_pkcs15init_unbind', 'sc_unlock']	1680	1775	pkcs15_create_object	call site: 00000	/src/opensc/src/pkcs11/framework-pkcs15.c:3185
1200	1200	1 : View List ['sc_pkcs15emu_esteid2018_init']	1200	1200	sc_pkcs15emu_esteid2018_init_ex	call site: 00000	/src/opensc/src/libopensc/pkcs15-esteid2018.c:204
1193	1193	1 : View List ['sc_pkcs15emu_esteid2025_init']	1193	1193	sc_pkcs15emu_esteid2025_init_ex	call site: 00000	/src/opensc/src/libopensc/pkcs15-esteid2025.c:210
981	2586	25 : View List ['bebytes2ushort', 'sc_pkcs15emu_add_ec_pubkey', 'sc_pkcs15emu_add_rsa_pubkey', 'sc_compare_oid', 'sc_asn1_decode_object_id', 'sc_pkcs15emu_add_rsa_prkey', 'sc_pkcs15_format_id', 'sc_select_file', 'sc_pkcs15emu_add_eddsa_pubkey', 'sc_card_ctl', 'sc_format_path', 'sc_card_find_eddsa_alg', 'malloc', 'free', 'sc_get_data', 'sc_card_find_ec_alg', 'sc_pkcs15emu_add_xeddsa_pubkey', 'sc_pkcs15emu_add_ec_prkey', 'sc_pkcs15emu_add_eddsa_prkey', '_strlcpy', 'sc_card_find_xeddsa_alg', 'sc_pkcs15emu_add_x509_cert', 'sc_pkcs15emu_openpgp_add_data', 'sc_pkcs15emu_add_xeddsa_prkey', 'read_file.9436']	981	3646	sc_pkcs15emu_openpgp_init	call site: 00000	/src/opensc/src/libopensc/pkcs15-openpgp.c:285
945	945	1 : View List ['sc_pkcs15emu_dtrust_init']	945	945	sc_pkcs15emu_dtrust_init_ex	call site: 00000	/src/opensc/src/libopensc/pkcs15-dtrust.c:101
921	921	1 : View List ['sc_pkcs15_unblock_pin']	921	1159	pkcs15_change_pin	call site: 00000	/src/opensc/src/pkcs11/framework-pkcs15.c:2077
849	861	2 : View List ['sc_pkcs15_print_id', 'sc_pkcs15_find_skey_by_id']	849	1879	sc_pkcs15_verify_pin_with_session_pin	call site: 00000	/src/opensc/src/libopensc/pkcs15-pin.c:368

Runtime coverage analysis

Covered functions

1367

Functions that are reachable but not covered

0

Reachable functions

1

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/fuzz_pkcs11.c	1

Fuzzer: fuzz_pkcs15init

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	854	28.8%
gold	[1:9]	141	4.76%
yellow	[10:29]	151	5.09%
greenyellow	[30:49]	56	1.89%
lawngreen	50+	1759	59.4%
All colors	2961	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
4524	4524	4 : View List ['external_key_auth', 'get_external_key_retries', 'update_secret_key', 'get_external_key_maxtries']	4524	5089	epass2003_pin_cmd	call site: 00000	/src/opensc/src/libopensc/card-epass2003.c:3204
1901	2223	10 : View List ['sc_pkcs15_card_clear', 'detect_idkey', 'detect_netkey', 'detect_signtrust', 'detect_unicard', 'detect_datev', 'sc_card_ctl', 'sc_do_log', 'sc_bin_to_hex', 'set_string']	1901	2223	sc_pkcs15emu_tcos_init_ex	call site: 00000	/src/opensc/src/libopensc/pkcs15-tcos.c:530
1678	1678	1 : View List ['sc_pkcs15init_store_puk']	1678	1876	sc_pkcs15init_store_pin	call site: 02165	/src/opensc/src/pkcs15init/pkcs15-lib.c:1096
1605	2586	25 : View List ['bebytes2ushort', 'sc_pkcs15emu_add_ec_pubkey', 'sc_pkcs15emu_add_rsa_pubkey', 'sc_compare_oid', 'sc_asn1_decode_object_id', 'sc_pkcs15emu_add_rsa_prkey', 'sc_pkcs15_format_id', 'sc_select_file', 'sc_pkcs15emu_add_eddsa_pubkey', 'sc_card_ctl', 'sc_format_path', 'sc_card_find_eddsa_alg', 'malloc', 'free', 'sc_get_data', 'sc_card_find_ec_alg', 'sc_pkcs15emu_add_xeddsa_pubkey', 'sc_pkcs15emu_add_ec_prkey', 'sc_pkcs15emu_add_eddsa_prkey', '_strlcpy', 'sc_card_find_xeddsa_alg', 'sc_pkcs15emu_add_x509_cert', 'sc_pkcs15emu_openpgp_add_data', 'sc_pkcs15emu_add_xeddsa_prkey', 'read_file.9436']	1605	3646	sc_pkcs15emu_openpgp_init	call site: 00000	/src/opensc/src/libopensc/pkcs15-openpgp.c:285
1402	1402	1 : View List ['sc_pkcs15emu_coolkey_init']	1402	1535	sc_pkcs15emu_coolkey_init_ex	call site: 00000	/src/opensc/src/libopensc/pkcs15-coolkey.c:740
1374	1374	1 : View List ['sc_pkcs15emu_piv_init']	1374	1374	sc_pkcs15emu_piv_init_ex	call site: 00000	/src/opensc/src/libopensc/pkcs15-piv.c:1284
1305	1305	1 : View List ['sc_pkcs15emu_idprime_init']	1305	1305	sc_pkcs15emu_idprime_init_ex	call site: 00000	/src/opensc/src/libopensc/pkcs15-idprime.c:364
1302	1302	1 : View List ['sc_pkcs15emu_cac_init']	1302	1302	sc_pkcs15emu_cac_init_ex	call site: 00000	/src/opensc/src/libopensc/pkcs15-cac.c:378
1200	1200	1 : View List ['sc_pkcs15emu_esteid2018_init']	1200	1200	sc_pkcs15emu_esteid2018_init_ex	call site: 00000	/src/opensc/src/libopensc/pkcs15-esteid2018.c:204
1193	1193	1 : View List ['sc_pkcs15emu_esteid2025_init']	1193	1193	sc_pkcs15emu_esteid2025_init_ex	call site: 00000	/src/opensc/src/libopensc/pkcs15-esteid2025.c:210
1105	5521	10 : View List ['init_key_object', 'sc_pkcs15init_rmdir', 'sc_pkcs15init_create_file', 'sc_file_free', 'sc_card_ctl', 'sc_pkcs15init_get_pin_reference', 'free', 'sc_pkcs15init_verify_secret', 'cardos_put_key', 'cardos_extract_pubkey']	1105	5521	cardos_generate_key	call site: 00000	/src/opensc/src/pkcs15init/pkcs15-cardos.c:358
995	995	1 : View List ['sc_pkcs15emu_pteid_init']	995	1128	sc_pkcs15emu_pteid_init_ex	call site: 00000	/src/opensc/src/libopensc/pkcs15-pteid.c:349

Runtime coverage analysis

Covered functions

1365

Functions that are reachable but not covered

102

Reachable functions

461

Percentage of reachable functions covered

77.87%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/fuzz_pkcs15init.c	11
libopensc/ctx.c	24
libopensc/log.c	8
common/simclist.c	14
libopensc/card.c	28
common/libscdl.c	4
libopensc/sc.c	34
scconf/scconf.c	11
scconf/parse.c	12
scconf/sclex.c	9
common/compat_strlcpy.c	1
libopensc/reader-ctapi.c	1
tests/fuzzing/fuzzer_reader.c	3
libopensc/errors.c	1
libopensc/reader-tr03119.c	2
libopensc/asn1.c	33
libopensc/pkcs15-algo.c	4
libopensc/dir.c	8
libopensc/ef-atr.c	1
tests/fuzzing/../../../src/pkcs15init/pkcs15-lib.c	59
tests/fuzzing/../../../src/pkcs15init/profile.c	30
libopensc/pkcs15.c	59
libopensc/pkcs15-prkey.c	2
libopensc/aux-data.c	4
libopensc/pkcs15-pubkey.c	12
libopensc/pkcs15-cert.c	4
libopensc/pkcs15-skey.c	1
libopensc/pkcs15-data.c	1
libopensc/pkcs15-pin.c	8
libopensc/pkcs15-cache.c	3
libopensc/compression.c	4
libopensc/sec.c	1
ui/notify.c	1
libopensc/pkcs15-syn.c	3
libopensc/pkcs15-emulator-filter.c	3

Fuzzer: fuzz_pkcs15_encode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	680	41.0%
gold	[1:9]	64	3.86%
yellow	[10:29]	85	5.13%
greenyellow	[30:49]	20	1.20%
lawngreen	50+	806	48.7%
All colors	1655	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
4524	4524	4 : View List ['external_key_auth', 'get_external_key_retries', 'update_secret_key', 'get_external_key_maxtries']	4524	5089	epass2003_pin_cmd	call site: 00000	/src/opensc/src/libopensc/card-epass2003.c:3204
1193	1193	1 : View List ['sc_pkcs15emu_esteid2025_init']	1193	1193	sc_pkcs15emu_esteid2025_init_ex	call site: 00000	/src/opensc/src/libopensc/pkcs15-esteid2025.c:210
1017	2586	25 : View List ['bebytes2ushort', 'sc_pkcs15emu_add_ec_pubkey', 'sc_pkcs15emu_add_rsa_pubkey', 'sc_compare_oid', 'sc_asn1_decode_object_id', 'sc_pkcs15emu_add_rsa_prkey', 'sc_pkcs15_format_id', 'sc_select_file', 'sc_pkcs15emu_add_eddsa_pubkey', 'sc_card_ctl', 'sc_format_path', 'sc_card_find_eddsa_alg', 'malloc', 'free', 'sc_get_data', 'sc_card_find_ec_alg', 'sc_pkcs15emu_add_xeddsa_pubkey', 'sc_pkcs15emu_add_ec_prkey', 'sc_pkcs15emu_add_eddsa_prkey', '_strlcpy', 'sc_card_find_xeddsa_alg', 'sc_pkcs15emu_add_x509_cert', 'sc_pkcs15emu_openpgp_add_data', 'sc_pkcs15emu_add_xeddsa_prkey', 'read_file.9436']	1017	3646	sc_pkcs15emu_openpgp_init	call site: 00000	/src/opensc/src/libopensc/pkcs15-openpgp.c:285
956	2748	3 : View List ['sc_pkcs15_get_objects', 'sc_pkcs15_verify_pin', 'sc_oberthur_read_file']	956	3052	sc_oberthur_read_file	call site: 00000	/src/opensc/src/libopensc/pkcs15-oberthur.c:312
945	945	1 : View List ['sc_pkcs15emu_dtrust_init']	945	945	sc_pkcs15emu_dtrust_init_ex	call site: 00000	/src/opensc/src/libopensc/pkcs15-dtrust.c:101
847	1041	6 : View List ['sc_pkcs15_encode_pubkey_eddsa', 'sc_pkcs15_encode_pubkey_gostr3410', 'sc_strerror', 'sc_do_log', 'sc_pkcs15_encode_pubkey_ec', 'sc_do_log_color']	847	1041	sc_pkcs15_encode_pubkey	call site: 00000	/src/opensc/src/libopensc/pkcs15-pubkey.c:767
664	664	1 : View List ['sc_hsm_soc_change']	664	664	sc_hsm_pin_cmd	call site: 00000	/src/opensc/src/libopensc/card-sc-hsm.c:639
617	617	2 : View List ['malloc', 'entersafe_mac_apdu']	617	1272	entersafe_transmit_apdu	call site: 00000	/src/opensc/src/libopensc/card-entersafe.c:402
538	538	1 : View List ['iasecc_mi_match']	538	2409	iasecc_init_amos_or_sagem	call site: 00000	/src/opensc/src/libopensc/card-iasecc.c:568
534	534	1 : View List ['sc_hsm_soc_biomatch']	534	1778	sc_hsm_pin_cmd	call site: 00000	/src/opensc/src/libopensc/card-sc-hsm.c:678
350	350	1 : View List ['sc_detect_escape_cmds']	354	1983	sc_connect_card	call site: 00305	/src/opensc/src/libopensc/card.c:265
321	321	1 : View List ['sc_pkcs15_decode_pubkey_ec']	321	321	sc_pkcs15_decode_pubkey	call site: 01331	/src/opensc/src/libopensc/pkcs15-pubkey.c:894

Runtime coverage analysis

Covered functions

1007

Functions that are reachable but not covered

122

Reachable functions

318

Percentage of reachable functions covered

61.64%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/fuzz_pkcs15_encode.c	1
libopensc/ctx.c	24
libopensc/log.c	9
common/simclist.c	14
libopensc/card.c	22
common/libscdl.c	4
libopensc/sc.c	23
scconf/scconf.c	11
scconf/parse.c	11
scconf/sclex.c	8
common/compat_strlcpy.c	1
libopensc/reader-ctapi.c	1
tests/fuzzing/fuzzer_reader.c	3
libopensc/errors.c	1
libopensc/reader-tr03119.c	2
libopensc/asn1.c	30
libopensc/pkcs15-algo.c	4
libopensc/dir.c	3
libopensc/ef-atr.c	1
libopensc/pkcs15.c	43
libopensc/pkcs15-prkey.c	3
libopensc/aux-data.c	1
libopensc/pkcs15-pubkey.c	11
libopensc/pkcs15-cert.c	2
libopensc/pkcs15-skey.c	2
libopensc/pkcs15-data.c	2
libopensc/pkcs15-pin.c	2
libopensc/pkcs15-syn.c	3
libopensc/pkcs15-emulator-filter.c	3
libopensc/pkcs15-cache.c	3
libopensc/compression.c	4

Fuzzer: fuzz_pkcs15_crypt

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	711	38.2%
gold	[1:9]	68	3.65%
yellow	[10:29]	60	3.22%
greenyellow	[30:49]	49	2.63%
lawngreen	50+	972	52.2%
All colors	1860	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
4524	4524	4 : View List ['external_key_auth', 'get_external_key_retries', 'update_secret_key', 'get_external_key_maxtries']	4524	5089	epass2003_pin_cmd	call site: 00000	/src/opensc/src/libopensc/card-epass2003.c:3204
1193	1193	1 : View List ['sc_pkcs15emu_esteid2025_init']	1193	1193	sc_pkcs15emu_esteid2025_init_ex	call site: 00000	/src/opensc/src/libopensc/pkcs15-esteid2025.c:210
945	945	1 : View List ['sc_pkcs15emu_dtrust_init']	945	945	sc_pkcs15emu_dtrust_init_ex	call site: 00000	/src/opensc/src/libopensc/pkcs15-dtrust.c:101
849	861	2 : View List ['sc_pkcs15_print_id', 'sc_pkcs15_find_skey_by_id']	849	1879	sc_pkcs15_verify_pin_with_session_pin	call site: 01303	/src/opensc/src/libopensc/pkcs15-pin.c:368
847	1041	6 : View List ['sc_pkcs15_encode_pubkey_eddsa', 'sc_pkcs15_encode_pubkey_gostr3410', 'sc_strerror', 'sc_do_log', 'sc_pkcs15_encode_pubkey_ec', 'sc_do_log_color']	847	1041	sc_pkcs15_encode_pubkey	call site: 00000	/src/opensc/src/libopensc/pkcs15-pubkey.c:767
664	664	1 : View List ['sc_hsm_soc_change']	664	664	sc_hsm_pin_cmd	call site: 00000	/src/opensc/src/libopensc/card-sc-hsm.c:639
617	617	2 : View List ['malloc', 'entersafe_mac_apdu']	617	1272	entersafe_transmit_apdu	call site: 00000	/src/opensc/src/libopensc/card-entersafe.c:402
588	588	1 : View List ['piv_check_protected_objects']	588	843	piv_pin_cmd	call site: 00000	/src/opensc/src/libopensc/card-piv.c:6127
536	597	2 : View List ['sc_do_log', 'myeid_set_security_env_ec']	536	1155	myeid_set_security_env	call site: 00000	/src/opensc/src/libopensc/card-myeid.c:956
534	534	1 : View List ['sc_hsm_soc_biomatch']	534	1778	sc_hsm_pin_cmd	call site: 00000	/src/opensc/src/libopensc/card-sc-hsm.c:678
532	532	1 : View List ['pgp_set_MSE']	532	665	pgp_decipher	call site: 00000	/src/opensc/src/libopensc/card-openpgp.c:2526
530	530	1 : View List ['cardos_restore_security_env']	530	1516	cardos_set_security_env	call site: 00000	/src/opensc/src/libopensc/card-cardos.c:948

Runtime coverage analysis

Covered functions

1094

Functions that are reachable but not covered

143

Reachable functions

393

Percentage of reachable functions covered

63.61%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzzing/fuzz_pkcs15_crypt.c	4
tests/fuzzing/fuzzer_tool.c	7
tests/fuzzing/../../../src/tools/pkcs15-crypt.c	8
tests/fuzzing/../../tools/util.c	2
libopensc/ctx.c	23
libopensc/log.c	9
common/simclist.c	14
libopensc/card.c	28
common/libscdl.c	4
libopensc/sc.c	27
scconf/scconf.c	11
scconf/parse.c	11
scconf/sclex.c	8
common/compat_strlcpy.c	1
libopensc/reader-ctapi.c	1
libopensc/errors.c	1
tests/fuzzing/fuzzer_reader.c	3
libopensc/reader-tr03119.c	2
libopensc/asn1.c	31
libopensc/pkcs15-algo.c	4
libopensc/dir.c	3
libopensc/ef-atr.c	1
libopensc/pkcs15.c	49
libopensc/pkcs15-prkey.c	1
libopensc/aux-data.c	1
libopensc/pkcs15-pubkey.c	3
libopensc/pkcs15-cert.c	1
libopensc/pkcs15-skey.c	1
libopensc/pkcs15-data.c	1
libopensc/pkcs15-pin.c	8
libopensc/pkcs15-syn.c	3
libopensc/pkcs15-emulator-filter.c	3
libopensc/pkcs15-cache.c	3
libopensc/compression.c	4
ui/notify.c	1
libopensc/sec.c	4
libopensc/pkcs15-sec.c	6
libopensc/padding.c	12
libopensc/../../src/common/constant-time.h	8
libopensc/../../src/libopensc/sc-ossl-compat.h	2

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
iasecc_card_ctl	/src/opensc/src/libopensc/card-iasecc.c	3	['N/A', 'size_t', 'N/A']	21	0	162	15	16	155	0	1570	685
pkcs15_create_object	/src/opensc/src/pkcs11/framework-pkcs15.c	4	['N/A', 'N/A', 'size_t', 'N/A']	21	0	348	45	15	413	0	3427	513
pgp_card_ctl	/src/opensc/src/libopensc/card-openpgp.c	3	['N/A', 'size_t', 'N/A']	19	0	294	42	7	145	0	1357	466
cosm_emu_update_any_df	/src/opensc/src/pkcs15init/pkcs15-oberthur.c	4	['N/A', 'N/A', 'int', 'N/A']	27	0	115	14	2	258	0	2162	450
dnie_sm_get_wrapped_apdu	/src/opensc/src/libopensc/card-dnie.c	3	['N/A', 'N/A', 'N/A']	18	0	201	32	10	131	0	994	409
piv_init	/src/opensc/src/libopensc/card-piv.c	1	['N/A']	20	0	465	65	20	137	0	1227	351
gids_card_ctl	/src/opensc/src/libopensc/card-gids.c	3	['N/A', 'size_t', 'N/A']	20	0	158	20	21	203	0	1617	311

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

844 / 3134

Cyclomatic complexity statically reachable by fuzzers

8681 / 28331

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

tests/fuzzing/fuzz_asn1_print.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['print_tags_recursive']

tests/fuzzing/fuzz_scconf_parse_string.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['scconf_lex_engine', 'scconf_parse_token']

tests/fuzzing/fuzz_asn1_sig_value.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['asn1_decode_entry', 'asn1_encode', 'scconf_lex_parse', 'sc_do_log', 'process_config_file', 'load_card_drivers', 'sc_context_create', 'asn1_encode_entry', 'scconf_block_destroy', 'asn1_decode']

tests/fuzzing/fuzz_pkcs15_tool.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['sc_print_path', 'sc_connect_card', 'sc_unlock', 'sc_lock', 'sc_transmit_apdu', 'scconf_lex_parse', 'sc_select_file', 'scconf_get_str']

tests/fuzzing/fuzz_piv_tool.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['asn1_decode_entry', 'scconf_lex_parse', 'sc_card_sm_check', 'sc_asn1_find_tag', 'scconf_get_str', 'load_card_drivers', 'gen_key', 'sc_connect_card', 'sc_single_transmit', 'sc_context_create']

tests/fuzzing/fuzz_card.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['scconf_lex_parse', 'sc_card_sm_check', 'sc_asn1_decode_object_id', 'sc_dump_oid', 'sc_do_log', 'scconf_get_str', 'load_card_drivers', 'sc_connect_card', 'sc_context_create', 'process_config_file']

tests/fuzzing/fuzz_pkcs15_decode.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['scconf_lex_parse', 'sc_card_sm_check', 'sc_pkcs15_bind_synthetic', 'sc_do_log', 'load_card_drivers', 'scconf_get_bool', 'sc_connect_card', 'sc_context_create', 'process_config_file', 'scconf_get_str']

tests/fuzzing/fuzz_pkcs15_reader.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['scconf_lex_parse', 'sc_card_sm_check', 'sc_do_log_openssl', 'sc_pkcs15_bind_synthetic', 'sc_pkcs1_encode', 'sc_do_log', 'load_card_drivers', 'sc_pkcs15_unwrap', 'sc_pkcs15_wrap', 'scconf_get_bool']

tests/fuzzing/fuzz_pkcs11.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

tests/fuzzing/fuzz_pkcs15init.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['sc_card_sm_check', '_pkcd15init_set_aux_md_data', 'sc_pkcs15_bind_synthetic', 'sc_do_log', 'load_card_drivers', 'sc_profile_find_file_by_path', 'sc_pkcs15_free_certificate', 'sc_pkcs15init_store_pin', 'scconf_get_bool', 'sc_connect_card']

tests/fuzzing/fuzz_pkcs15_encode.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['scconf_lex_parse', 'sc_card_sm_check', 'sc_pkcs15_bind_synthetic', 'sc_do_log', 'sc_pkcs15_decode_pubkey_rsa', 'sc_pkcs15_encode_dodf_entry', 'load_card_drivers', 'sc_pkcs15_prkey_attrs_from_cert', 'scconf_get_bool', 'sc_connect_card']

tests/fuzzing/fuzz_pkcs15_crypt.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['scconf_lex_parse', 'sc_card_sm_check', 'sc_do_log_openssl', 'sc_pkcs15_bind_synthetic', 'sc_pkcs1_encode', 'asn1_encode_entry', 'load_card_drivers', 'scconf_get_bool', 'sc_connect_card', 'sc_pkcs1_strip_02_padding_constant_time']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
load_card_atrs	54	7	12.96%	['fuzz_asn1_sig_value', 'fuzz_pkcs15_tool', 'fuzz_piv_tool', 'fuzz_card', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']
process_config_file	44	22	50.0%	['fuzz_asn1_sig_value', 'fuzz_pkcs15_tool', 'fuzz_piv_tool', 'fuzz_card', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']
sc_color_fprintf_va	52	9	17.30%	['fuzz_asn1_sig_value', 'fuzz_pkcs15_tool', 'fuzz_piv_tool', 'fuzz_card', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']
piv_read_obj_from_file	56	30	53.57%	[]
sc_card_sm_check	50	9	18.0%	['fuzz_pkcs15_tool', 'fuzz_piv_tool', 'fuzz_card', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']
pgp_get_pubkey_pem	94	14	14.89%	[]
gnuk_write_certificate	34	11	32.35%	[]
piv_write_binary	53	7	13.20%	[]
cwa_create_secure_channel	289	27	9.342%	[]
sc_apdu2bytes	69	19	27.53%	[]
authentic_parse_credential_data	59	32	54.23%	[]
dnie_pin_cmd	40	21	52.5%	[]
_dtrust_match_profile	47	13	27.65%	[]
entersafe_pin_cmd	36	12	33.33%	[]
epass2003_pin_cmd	49	13	26.53%	[]
gids_read_binary	35	9	25.71%	[]
gids_card_ctl	34	13	38.23%	[]
gids_get_pin_status	41	13	31.70%	[]
iasecc_card_ctl	36	12	33.33%	[]
iasecc_pin_get_policy	81	40	49.38%	[]
sc_hsm_pin_cmd	127	58	45.66%	[]
iasecc_sm_initialize	44	15	34.09%	[]
iasecc_sm_se_mutual_authentication	34	16	47.05%	[]
sc_pkcs15emu_dnie_init	103	48	46.60%	[]
sc_pkcs15emu_esteid2018_init	137	45	32.84%	[]
sc_pkcs15emu_gids_init	104	11	10.57%	[]
itacns_check_and_add_keyset	79	39	49.36%	[]
itacns_add_cert	54	23	42.59%	[]
sc_pkcs15emu_sc_hsm_init	207	52	25.12%	[]
sc_pkcs15_bind_synthetic	74	25	33.78%	['fuzz_pkcs15_tool', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']
sc_pin_cmd	57	15	26.31%	['fuzz_pkcs15_tool', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_crypt']
myeid_set_security_env	61	29	47.54%	[]
auth_pin_reset_oberthur_style	82	13	15.85%	[]
sc_pkcs15_unwrap	61	32	52.45%	['fuzz_pkcs15_reader']
sc_pkcs15_wrap	80	41	51.24%	['fuzz_pkcs15_reader']
rutoken_card_ctl	51	18	35.29%	[]
sc_pkcs15_get_application_by_type	34	14	41.17%	[]
_get_auth_object_by_name	51	13	25.49%	[]
register_xeddsa_mechanisms	39	18	46.15%	[]
pkcs15_init_pin	67	32	47.76%	[]
pkcs15_create_object	73	40	54.79%	[]
pkcs15_gen_keypair	191	42	21.98%	[]
pkcs15_cert_get_attribute	89	27	30.33%	[]
pkcs15_cert_cmp_attribute	51	16	31.37%	[]
pkcs15_prkey_get_attribute	185	70	37.83%	[]
pkcs15_prkey_sign	148	81	54.72%	[]
pkcs15_prkey_can_do	39	14	35.89%	[]
pkcs15_prkey_init_params	58	23	39.65%	[]
pkcs15_pubkey_get_attribute	191	87	45.54%	[]
pkcs15_dobj_get_attribute	77	20	25.97%	[]
sc_pkcs11_register_mechanism	41	19	46.34%	[]
sc_pkcs11_verify_init	42	22	52.38%	[]
push_login_state	33	6	18.18%	[]
load_pkcs11_parameters	56	26	46.42%	[]
sc_pkcs11_verify_data	329	149	45.28%	[]
sc_pkcs11_init_lock	33	7	21.21%	[]
C_UnwrapKey	52	23	44.23%	[]
C_DeriveKey	59	23	38.98%	[]
card_detect	137	15	10.94%	[]
card_detect_all	35	7	20.0%	[]
sc_pkcs15init_bind	93	50	53.76%	[]
sc_pkcs15init_store_certificate	79	16	20.25%	[]
authentic_manage_sdo_encode	65	30	46.15%	[]
cardos_construct_fcp	91	44	48.35%	[]
iasecc_get_free_reference	85	23	27.05%	[]
isoApplet_ctl_generate_key	144	76	52.77%	[]
muscle_pin_cmd	71	27	38.02%	[]
myeid_loadkey	45	22	48.88%	[]
pgp_calculate_and_store_fingerprint	131	71	54.19%	[]
sc_update_record	34	10	29.41%	['fuzz_pkcs15init']
iasecc_sdo_allocate_and_parse	40	19	47.5%	[]
authentic_pkcs15_fix_file_access_rule	33	18	54.54%	[]
authentic_pkcs15_generate_key	44	17	38.63%	[]
cardos_generate_key	69	21	30.43%	[]
entersafe_create_dir	82	25	30.48%	[]
entersafe_sanity_check	37	16	43.24%	[]
epass2003_pkcs15_init_card	37	18	48.64%	[]
epass2003_pkcs15_sanity_check	44	17	38.63%	[]
iasecc_pkcs15_erase_card	60	11	18.33%	[]
isoApplet_generate_key_ec	135	61	45.18%	[]
sc_pkcs15init_generate_secret_key	42	11	26.19%	['fuzz_pkcs15init']
sc_pkcs15init_get_transport_key	42	20	47.61%	['fuzz_pkcs15init']
cosm_emu_update_tokeninfo	32	9	28.12%	[]
openpgp_store_key	50	15	30.0%	[]
rtecp_create_pin	73	19	26.02%	[]
sc_hsm_emu_update_any_df	43	16	37.20%	[]
setcos_init_card	35	18	51.42%	[]
setcos_create_pin	32	9	28.12%	[]
starcos_write_pukey	65	20	30.76%	[]
starcos_generate_key	45	19	42.22%	[]
sc_pkcs15_prkey_attrs_from_cert	59	24	40.67%	['fuzz_pkcs15_encode']
pgp_decipher	97	47	48.45%	[]

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/opensc/src/pkcs15init/pkcs15-cflex.c	[]	[]
/src/opensc/src/libopensc/card-cac.c	[]	[]
/src/opensc/src/libopensc/ctx.c	['fuzz_asn1_sig_value', 'fuzz_pkcs15_tool', 'fuzz_piv_tool', 'fuzz_card', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']	['fuzz_asn1_sig_value', 'fuzz_pkcs15_tool', 'fuzz_piv_tool', 'fuzz_card', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']
/src/opensc/src/libopensc/card-gids.c	[]	[]
/src/opensc/src/tests/fuzzing/../../../src/tools/pkcs15-crypt.c	['fuzz_pkcs15_crypt']	[]
/src/opensc/src/pkcs11/framework-pkcs15init.c	[]	[]
/src/opensc/src/common/libscdl.c	['fuzz_asn1_sig_value', 'fuzz_pkcs15_tool', 'fuzz_piv_tool', 'fuzz_card', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']	[]
/src/opensc/src/libopensc/card-nqApplet.c	[]	[]
/src/opensc/src/libopensc/card-mcrd.c	[]	[]
/src/opensc/src/pkcs15init/pkcs15-asepcos.c	[]	[]
/src/opensc/src/libopensc/card.c	['fuzz_asn1_sig_value', 'fuzz_pkcs15_tool', 'fuzz_piv_tool', 'fuzz_card', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']	['fuzz_asn1_sig_value', 'fuzz_pkcs15_tool', 'fuzz_piv_tool', 'fuzz_card', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']
/src/opensc/src/pkcs15init/pkcs15-authentic.c	[]	[]
/src/opensc/src/pkcs11/../../src/libopensc/sc-ossl-compat.h	[]	[]
/src/opensc/src/pkcs15init/pkcs15-rutoken.c	[]	[]
/src/opensc/src/pkcs15init/pkcs15-lib.c	[]	[]
/src/opensc/src/libopensc/apdu.c	['fuzz_pkcs15_tool', 'fuzz_piv_tool']	['fuzz_pkcs15_tool', 'fuzz_piv_tool']
/src/opensc/src/pkcs15init/pkcs15-entersafe.c	[]	[]
/src/opensc/src/scconf/scconf.c	['fuzz_scconf_parse_string', 'fuzz_asn1_sig_value', 'fuzz_pkcs15_tool', 'fuzz_piv_tool', 'fuzz_card', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']	['fuzz_scconf_parse_string', 'fuzz_asn1_sig_value', 'fuzz_pkcs15_tool', 'fuzz_piv_tool', 'fuzz_card', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']
/src/opensc/src/libopensc/cwa14890.c	[]	[]
/src/opensc/src/libopensc/pkcs15-sc-hsm.c	[]	[]
/src/opensc/src/common/compat_strlcat.c	['fuzz_pkcs15_tool']	[]
/src/opensc/src/libopensc/log.c	['fuzz_asn1_print', 'fuzz_asn1_sig_value', 'fuzz_pkcs15_tool', 'fuzz_piv_tool', 'fuzz_card', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']	['fuzz_asn1_print', 'fuzz_asn1_sig_value', 'fuzz_pkcs15_tool', 'fuzz_piv_tool', 'fuzz_card', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']
/src/opensc/src/tests/fuzzing/../../../src/pkcs15init/pkcs15-lib.c	['fuzz_pkcs15init']	[]
/src/opensc/src/libopensc/pkcs15-cert.c	['fuzz_pkcs15_tool', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']	['fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']
/src/opensc/src/libopensc/pkcs15-esteid2025.c	[]	[]
/src/opensc/src/libopensc/card-coolkey.c	[]	[]
/src/opensc/src/pkcs15init/pkcs15-myeid.c	[]	[]
/src/opensc/src/pkcs11/mechanism.c	[]	[]
/src/opensc/src/libopensc/cwa-dnie.c	[]	[]
/src/opensc/src/libopensc/card-cardos-common.c	[]	[]
/src/opensc/src/libopensc/pkcs15-actalis.c	[]	[]
/src/opensc/src/pkcs15init/pkcs15-epass2003.c	[]	[]
/src/opensc/src/tests/fuzzing/fuzz_piv_tool.c	['fuzz_piv_tool']	['fuzz_piv_tool']
/src/opensc/src/libopensc/pkcs15-starcert.c	[]	[]
/src/opensc/src/pkcs15init/pkcs15-oberthur-awp.c	[]	[]
/src/opensc/src/tests/fuzzing/fuzzer_tool.c	['fuzz_pkcs15_tool', 'fuzz_piv_tool', 'fuzz_pkcs15_crypt']	['fuzz_pkcs15_tool', 'fuzz_piv_tool', 'fuzz_pkcs15_crypt']
/src/opensc/src/libopensc/card-iasecc.c	[]	[]
/src/opensc/src/tests/fuzzing/fuzz_asn1_sig_value.c	['fuzz_asn1_sig_value']	['fuzz_asn1_sig_value']
/src/opensc/src/libopensc/pkcs15-atrust-acos.c	[]	[]
/src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c	['fuzz_pkcs15_reader']	['fuzz_pkcs15_reader']
/src/opensc/src/libopensc/pkcs15-algo.c	['fuzz_asn1_sig_value', 'fuzz_pkcs15_tool', 'fuzz_piv_tool', 'fuzz_card', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']	['fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']
/src/opensc/src/libopensc/pkcs15-syn.c	['fuzz_pkcs15_tool', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']	['fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']
/src/opensc/src/libopensc/dir.c	['fuzz_pkcs15_tool', 'fuzz_piv_tool', 'fuzz_card', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']	['fuzz_pkcs15_tool', 'fuzz_piv_tool', 'fuzz_card', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']
/src/opensc/src/pkcs11/pkcs11-display.c	[]	[]
/src/opensc/src/libopensc/errors.c	['fuzz_asn1_sig_value', 'fuzz_pkcs15_tool', 'fuzz_piv_tool', 'fuzz_card', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']	['fuzz_asn1_sig_value', 'fuzz_pkcs15_tool', 'fuzz_piv_tool', 'fuzz_card', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']
/src/opensc/src/libopensc/reader-tr03119.c	['fuzz_pkcs15_tool', 'fuzz_piv_tool', 'fuzz_card', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']	[]
/src/opensc/src/pkcs15init/pkcs15-setcos.c	[]	[]
/src/opensc/src/pkcs15init/pkcs15-isoApplet.c	[]	[]
/src/opensc/src/libopensc/iasecc-sdo.c	[]	[]
/src/opensc/src/tests/fuzzing/../../tools/util.c	['fuzz_pkcs15_tool', 'fuzz_piv_tool', 'fuzz_pkcs15_crypt']	[]
/src/opensc/src/libopensc/card-esteid2025.c	[]	[]
/src/opensc/src/libopensc/ef-atr.c	['fuzz_pkcs15_tool', 'fuzz_piv_tool', 'fuzz_card', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']	['fuzz_pkcs15_tool', 'fuzz_piv_tool', 'fuzz_card', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']
/usr/include/x86_64-linux-gnu/bits/uintn-identity.h	[]	[]
/src/opensc/src/tests/fuzzing/fuzz_pkcs15_encode.c	['fuzz_pkcs15_encode']	['fuzz_pkcs15_encode']
/src/opensc/src/libopensc/card-tcos.c	[]	[]
/src/opensc/src/libopensc/card-rtecp.c	[]	[]
/src/opensc/src/libopensc/card-rutoken.c	[]	[]
/src/opensc/src/libopensc/pkcs15-cache.c	['fuzz_pkcs15_tool', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']	['fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']
/src/opensc/src/libopensc/card-sc-hsm.c	[]	[]
/src/opensc/src/libopensc/pkcs15-skey.c	['fuzz_pkcs15_tool', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']	['fuzz_pkcs15_decode', 'fuzz_pkcs15init']
/src/opensc/src/tests/fuzzing/fuzz_scconf_parse_string.c	['fuzz_scconf_parse_string']	['fuzz_scconf_parse_string']
/src/opensc/src/libopensc/card-default.c	[]	[]
/src/opensc/src/pkcs15init/pkcs15-rtecp.c	[]	[]
/src/opensc/src/libopensc/card-masktech.c	[]	[]
/src/opensc/src/libopensc/gp.c	[]	[]
/src/opensc/src/libopensc/pkcs15-starcos-esign.c	[]	[]
/src/opensc/src/pkcs11/pkcs11-object.c	[]	[]
/src/opensc/src/libopensc/pkcs15-gemsafeV1.c	[]	[]
/src/opensc/src/libopensc/card-starcos.c	[]	[]
/src/opensc/src/libopensc/pkcs15-cardos.c	[]	[]
/src/opensc/src/tests/fuzzing/fuzz_pkcs15_tool.c	['fuzz_pkcs15_tool']	['fuzz_pkcs15_tool']
/src/opensc/src/ui/notify.c	['fuzz_pkcs15_tool', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_crypt']	['fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_crypt']
/src/opensc/src/pkcs15init/pkcs15-iasecc.c	[]	[]
/src/opensc/src/libopensc/card-flex.c	[]	[]
/src/opensc/src/libopensc/card-cardos.c	[]	[]
/src/opensc/src/libopensc/card-jpki.c	[]	[]
/src/opensc/src/libopensc/pkcs15-coolkey.c	[]	[]
/src/opensc/src/pkcs11/framework-pkcs15.c	[]	[]
/src/opensc/src/tests/fuzzing/../../../src/pkcs15init/profile.c	['fuzz_pkcs15init']	[]
/src/opensc/src/libopensc/card-asepcos.c	[]	[]
/src/opensc/src/libopensc/./../tools/fread_to_eof.c	[]	[]
/src/opensc/src/common/simclist.c	['fuzz_asn1_sig_value', 'fuzz_pkcs15_tool', 'fuzz_piv_tool', 'fuzz_card', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']	['fuzz_asn1_sig_value', 'fuzz_pkcs15_tool', 'fuzz_piv_tool', 'fuzz_card', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']
/src/opensc/src/libopensc/pkcs15-itacns.c	[]	[]
/src/opensc/src/libopensc/aux-data.c	['fuzz_pkcs15_tool', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']	['fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']
/src/opensc/src/libopensc/pkcs15-eoi.c	[]	[]
/src/opensc/src/tests/fuzzing/fuzz_pkcs15init.c	['fuzz_pkcs15init']	['fuzz_pkcs15init']
/src/opensc/src/pkcs11/slot.c	[]	[]
/src/opensc/src/pkcs15init/profile.c	[]	[]
/src/opensc/src/libopensc/card-itacns.c	[]	[]
/src/opensc/src/libopensc/card-cac1.c	[]	[]
/src/opensc/src/pkcs11/misc.c	[]	[]
/src/opensc/src/libopensc/pkcs15-emulator-filter.c	['fuzz_pkcs15_tool', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']	[]
/src/opensc/src/libopensc/pkcs15-pteid.c	[]	[]
/src/opensc/src/pkcs15init/pkcs15-muscle.c	[]	[]
/src/opensc/src/libopensc/card-npa.c	[]	[]
/src/opensc/src/libopensc/../../src/libopensc/sc-ossl-compat.h	['fuzz_pkcs15_reader', 'fuzz_pkcs15_crypt']	[]
/src/opensc/src/libopensc/muscle-filesystem.c	[]	[]
/src/opensc/src/libopensc/pkcs15-esteid2018.c	[]	[]
/src/opensc/src/pkcs15init/pkcs15-starcos.c	[]	[]
/src/opensc/src/libopensc/card-authentic.c	[]	[]
/src/opensc/src/libopensc/pkcs15-jpki.c	[]	[]
/src/opensc/src/libopensc/sc.c	['fuzz_asn1_print', 'fuzz_asn1_sig_value', 'fuzz_pkcs15_tool', 'fuzz_piv_tool', 'fuzz_card', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']	['fuzz_asn1_print', 'fuzz_asn1_sig_value', 'fuzz_pkcs15_tool', 'fuzz_piv_tool', 'fuzz_card', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']
/src/opensc/src/libopensc/ef-gdo.c	[]	[]
/src/opensc/src/libopensc/card-epass2003.c	[]	[]
/src/opensc/src/libopensc/pkcs15-nqApplet.c	[]	[]
/src/opensc/src/libopensc/base64.c	['fuzz_pkcs15_tool']	[]
/src/opensc/src/libopensc/card-entersafe.c	[]	[]
/src/opensc/src/libopensc/card-piv.c	[]	[]
/src/opensc/src/tests/fuzzing/fuzz_pkcs15_decode.c	['fuzz_pkcs15_decode']	['fuzz_pkcs15_decode']
/src/opensc/src/libopensc/../../src/common/constant-time.h	['fuzz_pkcs15_reader', 'fuzz_pkcs15_crypt']	[]
/src/opensc/src/libopensc/iso7816.c	[]	[]
/src/opensc/src/libopensc/pkcs15-tccardos.c	[]	[]
/src/opensc/src/libopensc/pkcs15-openpgp.c	[]	[]
/src/opensc/src/pkcs15init/pkcs15-sc-hsm.c	[]	[]
/src/opensc/src/tests/fuzzing/fuzz_pkcs11.c	['fuzz_pkcs11']	['fuzz_pkcs11']
/src/opensc/src/scconf/parse.c	['fuzz_scconf_parse_string', 'fuzz_asn1_sig_value', 'fuzz_pkcs15_tool', 'fuzz_piv_tool', 'fuzz_card', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']	['fuzz_scconf_parse_string', 'fuzz_asn1_sig_value', 'fuzz_pkcs15_tool', 'fuzz_piv_tool', 'fuzz_card', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']
/src/opensc/src/pkcs15init/pkcs15-openpgp.c	[]	[]
/src/opensc/src/libopensc/padding.c	['fuzz_pkcs15_reader', 'fuzz_pkcs15_crypt']	['fuzz_pkcs15_reader', 'fuzz_pkcs15_crypt']
/src/opensc/src/pkcs15init/pkcs15-cardos.c	[]	[]
/src/opensc/src/libopensc/pkcs15-gids.c	[]	[]
/src/opensc/src/tests/fuzzing/fuzz_asn1_print.c	['fuzz_asn1_print']	['fuzz_asn1_print']
/src/opensc/src/common/compat_strlcpy.c	['fuzz_scconf_parse_string', 'fuzz_asn1_sig_value', 'fuzz_pkcs15_tool', 'fuzz_piv_tool', 'fuzz_card', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']	['fuzz_scconf_parse_string', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']
/src/opensc/src/libopensc/pkcs15.c	['fuzz_pkcs15_tool', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']	['fuzz_pkcs15_tool', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']
/src/opensc/src/pkcs15init/pkcs15-oberthur.c	[]	[]
/src/opensc/src/scconf/sclex.c	['fuzz_scconf_parse_string', 'fuzz_asn1_sig_value', 'fuzz_pkcs15_tool', 'fuzz_piv_tool', 'fuzz_card', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']	['fuzz_scconf_parse_string', 'fuzz_asn1_sig_value', 'fuzz_pkcs15_tool', 'fuzz_piv_tool', 'fuzz_card', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']
/src/opensc/src/libopensc/pkcs15-dnie.c	[]	[]
/src/opensc/src/libopensc/simpletlv.c	[]	[]
/src/opensc/src/libopensc/pkcs15-dtrust.c	[]	[]
/src/opensc/src/libopensc/card-esteid2018.c	[]	[]
/src/opensc/src/libopensc/pkcs15-prkey.c	['fuzz_pkcs15_tool', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']	['fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']
/src/opensc/src/libopensc/card-setcos.c	[]	[]
/src/opensc/src/pkcs11/pkcs11-session.c	[]	[]
/src/opensc/src/pkcs11/pkcs11-global.c	[]	[]
/src/opensc/src/libopensc/ctbcs.c	[]	[]
/src/opensc/src/libopensc/pkcs15-tcos.c	[]	[]
/src/opensc/src/libopensc/pkcs15-idprime.c	[]	[]
/src/opensc/src/libopensc/pkcs15-iasecc.c	[]	[]
/src/opensc/src/libopensc/card-atrust-acos.c	[]	[]
/src/opensc/src/libopensc/compression.c	['fuzz_pkcs15_tool', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']	['fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']
/src/opensc/src/libopensc/muscle.c	[]	[]
/src/opensc/src/libopensc/card-myeid.c	[]	[]
/src/opensc/src/libopensc/iasecc-sm.c	[]	[]
/src/opensc/src/libopensc/pkcs15-piv.c	[]	[]
/src/opensc/src/libopensc/pkcs15-data.c	['fuzz_pkcs15_tool', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']	['fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']
/src/opensc/src/libopensc/card-belpic.c	[]	[]
/src/opensc/src/tests/fuzzing/fuzz_card.c	['fuzz_card']	['fuzz_card']
/src/opensc/src/libopensc/card-isoApplet.c	[]	[]
/src/opensc/src/libopensc/pkcs15-cac.c	[]	[]
/src/opensc/src/libopensc/reader-ctapi.c	['fuzz_asn1_sig_value', 'fuzz_pkcs15_tool', 'fuzz_piv_tool', 'fuzz_card', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']	['fuzz_asn1_sig_value', 'fuzz_pkcs15_tool', 'fuzz_piv_tool', 'fuzz_card', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']
/src/opensc/src/libopensc/sec.c	['fuzz_pkcs15_tool', 'fuzz_card', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_crypt']	['fuzz_card', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_crypt']
/src/opensc/src/libopensc/card-openpgp.c	[]	[]
/src/opensc/src/pkcs11/openssl.c	[]	[]
/src/opensc/src/libopensc/card-idprime.c	[]	[]
/src/opensc/src/tests/fuzzing/fuzz_pkcs15_crypt.c	['fuzz_pkcs15_crypt']	['fuzz_pkcs15_crypt']
/src/opensc/src/libopensc/pkcs15-pubkey.c	['fuzz_pkcs15_tool', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']	['fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']
/src/opensc/src/libopensc/card-cac-common.c	[]	[]
/src/opensc/src/libopensc/card-dtrust.c	[]	[]
/src/opensc/src/libopensc/pkcs15-esinit.c	[]	[]
/src/opensc/src/libopensc/card-dnie.c	[]	[]
/src/opensc/src/libopensc/sm.c	['fuzz_pkcs15_tool', 'fuzz_piv_tool']	['fuzz_piv_tool']
/src/opensc/src/libopensc/pkcs15-din-66291.c	[]	[]
/src/opensc/src/pkcs11/debug.c	[]	[]
/src/opensc/src/libopensc/pkcs15-sec.c	['fuzz_pkcs15_reader', 'fuzz_pkcs15_crypt']	['fuzz_pkcs15_reader', 'fuzz_pkcs15_crypt']
/src/opensc/src/pkcs11/../../src/common/constant-time.h	[]	[]
/src/opensc/src/libopensc/card-oberthur.c	[]	[]
/src/opensc/src/libopensc/card-gemsafeV1.c	[]	[]
/src/opensc/src/tests/fuzzing/../../../src/tools/pkcs15-tool.c	['fuzz_pkcs15_tool']	[]
/src/opensc/src/libopensc/pkcs15-pin.c	['fuzz_pkcs15_tool', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']	['fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']
/src/opensc/src/libopensc/card-skeid.c	[]	[]
/src/opensc/src/pkcs15init/pkcs15-gids.c	[]	[]
/src/opensc/src/sm/sm-eac.c	[]	[]
/src/opensc/src/tests/fuzzing/../../../src/tools/piv-tool.c	['fuzz_piv_tool']	[]
/src/opensc/src/libopensc/card-muscle.c	[]	[]
/src/opensc/src/libopensc/pkcs15-oberthur.c	[]	[]
/src/opensc/src/libopensc/asn1.c	['fuzz_asn1_print', 'fuzz_asn1_sig_value', 'fuzz_pkcs15_tool', 'fuzz_piv_tool', 'fuzz_card', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']	['fuzz_asn1_print', 'fuzz_asn1_sig_value', 'fuzz_piv_tool', 'fuzz_card', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']
/src/opensc/src/libopensc/pkcs15-skeid.c	[]	[]
/src/opensc/src/tests/fuzzing/fuzzer_reader.c	['fuzz_pkcs15_tool', 'fuzz_piv_tool', 'fuzz_card', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']	['fuzz_pkcs15_tool', 'fuzz_piv_tool', 'fuzz_card', 'fuzz_pkcs15_decode', 'fuzz_pkcs15_reader', 'fuzz_pkcs15init', 'fuzz_pkcs15_encode', 'fuzz_pkcs15_crypt']
/src/opensc/src/tools/../pkcs11/pkcs11-display.c	['fuzz_pkcs15_tool']	[]

Directories in report

Directory
/src/opensc/src/libopensc/../../src/libopensc/
/src/opensc/src/tests/fuzzing/
/usr/include/x86_64-linux-gnu/bits/
/src/opensc/src/pkcs15init/
/src/opensc/src/pkcs11/../../src/libopensc/
/src/opensc/src/libopensc/./../tools/
/src/opensc/src/libopensc/
/src/opensc/src/libopensc/../../src/common/
/src/opensc/src/scconf/
/src/opensc/src/tests/fuzzing/../../../src/pkcs15init/
/src/opensc/src/tests/fuzzing/../../../src/tools/
/src/opensc/src/ui/
/src/opensc/src/sm/
/src/opensc/src/common/
/src/opensc/src/pkcs11/../../src/common/
/src/opensc/src/pkcs11/
/src/opensc/src/tools/../pkcs11/
/src/opensc/src/tests/fuzzing/../../tools/