test/rsa_sp800_56b_test.c:510: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 536870848] by call to `rsa_fips186_4_gen_prob_primes`.
Showing all 17 steps of the trace


test/rsa_sp800_56b_test.c:490:9: Call
488.       BN_CTX_start(ctx);
489.   
490.       e = bn_load(ctx, cav_e, sizeof(cav_e));
               ^
491.       Xp = bn_load(ctx, cav_Xp, sizeof(cav_Xp));
492.       Xp1 = bn_load(ctx, cav_Xp1, sizeof(cav_Xp1));

test/rsa_sp800_56b_test.c:170:9: Call
  168.       BIGNUM *ret = BN_CTX_get(ctx);
  169.       if (ret != NULL)
  170.           BN_bin2bn(data, sz, ret);
                 ^
  171.       return ret;
  172.   }

crypto/bn/bn_lib.c:372:1: Parameter `ret->top`
    370.   }
    371.   
    372. > BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)
    373.   {
    374.       unsigned int i, m;

test/rsa_sp800_56b_test.c:510:14: Call
508.       q2 = BN_CTX_get(ctx);
509.       ret = TEST_ptr(q2)
510.             && TEST_true(rsa_fips186_4_gen_prob_primes(key, p1, p2, NULL, Xp, Xp1,
                    ^
511.                                                        Xp2, q1, q2, NULL, Xq, Xq1,
512.                                                        Xq2, 2048, e, ctx, NULL))

crypto/rsa/rsa_sp800_56b_gen.c:51:1: Parameter `Xpout->d`
  49.    *     (Required for CAVS testing).
  50.    */
  51. > int rsa_fips186_4_gen_prob_primes(RSA *rsa, BIGNUM *p1, BIGNUM *p2,
  52.                                     BIGNUM *Xpout, const BIGNUM *Xp,
  53.                                     const BIGNUM *Xp1, const BIGNUM *Xp2,

crypto/rsa/rsa_sp800_56b_gen.c:97:10: Call
  95.   
  96.       /* (Step 4) Generate p, Xp */
  97.       if (!bn_rsa_fips186_4_gen_prob_primes(rsa->p, Xpo, p1, p2, Xp, Xp1, Xp2,
                  ^
  98.                                             nbits, e, ctx, cb))
  99.           goto err;

crypto/bn/bn_rsa_fips186_4.c:167:1: Parameter `*Xpout->d`
    165.    * Returns: 1 on success otherwise it returns 0.
    166.    */
    167. > int bn_rsa_fips186_4_gen_prob_primes(BIGNUM *p, BIGNUM *Xpout,
    168.                                        BIGNUM *p1, BIGNUM *p2,
    169.                                        const BIGNUM *Xp, const BIGNUM *Xp1,

crypto/bn/bn_rsa_fips186_4.c:215:10: Call
    213.           goto err;
    214.       /* (Steps 4.3/5.3) - generate prime */
    215.       if (!bn_rsa_fips186_4_derive_prime(p, Xpout, Xp, p1i, p2i, nlen, e, ctx, cb))
                    ^
    216.           goto err;
    217.       ret = 1;

crypto/bn/bn_rsa_fips186_4.c:253:1: Parameter `*X->d`
      251.    *     Y, X, r1, r2, e are not NULL.
      252.    */
      253. > int bn_rsa_fips186_4_derive_prime(BIGNUM *Y, BIGNUM *X, const BIGNUM *Xin,
      254.                                     const BIGNUM *r1, const BIGNUM *r2, int nlen,
      255.                                     const BIGNUM *e, BN_CTX *ctx, BN_GENCB *cb)

crypto/bn/bn_rsa_fips186_4.c:275:24: Call
      273.           goto err;
      274.   
      275.       if (Xin != NULL && BN_copy(X, Xin) == NULL)
                                    ^
      276.           goto err;
      277.   

crypto/bn/bn_lib.c:281:1: <Offset trace>
279.   }
280.   
281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
282.   {
283.       bn_check_top(b);

crypto/bn/bn_lib.c:281:1: Parameter `b->top`
        279.   }
        280.   
        281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
        282.   {
        283.       bn_check_top(b);

crypto/bn/bn_lib.c:281:1: <Length trace>
279.   }
280.   
281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
282.   {
283.       bn_check_top(b);

crypto/bn/bn_lib.c:281:1: Parameter `*a->d`
        279.   }
        280.   
        281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
        282.   {
        283.       bn_check_top(b);

crypto/bn/bn_lib.c:287:9: Call
        285.       if (a == b)
        286.           return a;
        287.       if (bn_wexpand(a, b->top) == NULL)
                       ^
        288.           return NULL;
        289.   

crypto/bn/bn_lib.c:960:1: Parameter `*a->d`
          958.   }
          959.   
          960. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
          961.   {
          962.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:291:9: Array access: Offset added: [8, +oo] Size: [0, 536870848] by call to `rsa_fips186_4_gen_prob_primes` 
        289.   
        290.       if (b->top > 0)
        291.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                       ^
        292.   
        293.       a->neg = b->neg;

BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
{
    bn_check_top(b);
    if (a == b)
        return a;
    if (bn_wexpand(a, b->top) == NULL)
        return NULL;
    if (b->top > 0)
        memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
    a->neg = b->neg;
    a->top = b->top;
    a->flags |= b->flags & BN_FLG_FIXED_TOP;
    bn_check_top(a);
    return a;
}
['static int test_fips1864_keygen_kat(void)\n{\n    int ret = 0;\n    RSA *key = NULL;\n    BN_CTX *ctx = NULL;\n    BIGNUM *e, *Xp, *Xp1, *Xp2, *Xq, *Xq1, *Xq2;\n    BIGNUM *p1, *p2, *q1, *q2;\n    BIGNUM *p1_exp, *p2_exp, *q1_exp, *q2_exp;\n    BIGNUM *p_exp, *q_exp, *n_exp, *d_exp;\n    const BIGNUM *p, *q, *n, *d, *e2;\n    if (!(TEST_ptr(key = RSA_new()) && TEST_ptr(ctx = BN_CTX_new())))\n        goto err;\n    BN_CTX_start(ctx);\n    e = bn_load(ctx, cav_e, sizeof(cav_e));\n    Xp = bn_load(ctx, cav_Xp, sizeof(cav_Xp));\n    Xp1 = bn_load(ctx, cav_Xp1, sizeof(cav_Xp1));\n    Xp2 = bn_load(ctx, cav_Xp2, sizeof(cav_Xp2));\n    Xq = bn_load(ctx, cav_Xq, sizeof(cav_Xq));\n    Xq1 = bn_load(ctx, cav_Xq1, sizeof(cav_Xq1));\n    Xq2 = bn_load(ctx, cav_Xq2, sizeof(cav_Xq2));\n    p1_exp = bn_load(ctx, cav_p1, sizeof(cav_p1));\n    p2_exp = bn_load(ctx, cav_p2, sizeof(cav_p2));\n    q1_exp = bn_load(ctx, cav_q1, sizeof(cav_q1));\n    q2_exp = bn_load(ctx, cav_q2, sizeof(cav_q2));\n    p_exp = bn_load(ctx, cav_p, sizeof(cav_p));\n    q_exp = bn_load(ctx, cav_q, sizeof(cav_q));\n    n_exp = bn_load(ctx, cav_n, sizeof(cav_n));\n    d_exp = bn_load(ctx, cav_d, sizeof(cav_d));\n    p1 = BN_CTX_get(ctx);\n    p2 = BN_CTX_get(ctx);\n    q1 = BN_CTX_get(ctx);\n    q2 = BN_CTX_get(ctx);\n    ret = TEST_ptr(q2)\n          && TEST_true(rsa_fips186_4_gen_prob_primes(key, p1, p2, NULL, Xp, Xp1,\n                                                     Xp2, q1, q2, NULL, Xq, Xq1,\n                                                     Xq2, 2048, e, ctx, NULL))\n          && TEST_true(rsa_sp800_56b_derive_params_from_pq(key, 2048, e, ctx))\n          && TEST_BN_eq(p1_exp, p1)\n          && TEST_BN_eq(p2_exp, p2)\n          && TEST_BN_eq(q1_exp, q1)\n          && TEST_BN_eq(q2_exp, q2);\n    if (!ret)\n        goto err;\n    RSA_get0_key(key, &n, &e2, &d);\n    RSA_get0_factors(key, &p, &q);\n    ret = TEST_BN_eq(e, e2)\n          && TEST_BN_eq(p_exp, p)\n          && TEST_BN_eq(q_exp, q)\n          && TEST_BN_eq(n_exp, n)\n          && TEST_BN_eq(d_exp, d);\nerr:\n    RSA_free(key);\n    BN_CTX_end(ctx);\n    BN_CTX_free(ctx);\n    return ret;\n}', 'static BIGNUM *bn_load(BN_CTX *ctx, const unsigned char *data, int sz)\n{\n    BIGNUM *ret = BN_CTX_get(ctx);\n    if (ret != NULL)\n        BN_bin2bn(data, sz, ret);\n    return ret;\n}', 'BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)\n{\n    unsigned int i, m;\n    unsigned int n;\n    BN_ULONG l;\n    BIGNUM *bn = NULL;\n    if (ret == NULL)\n        ret = bn = BN_new();\n    if (ret == NULL)\n        return NULL;\n    bn_check_top(ret);\n    for ( ; len > 0 && *s == 0; s++, len--)\n        continue;\n    n = len;\n    if (n == 0) {\n        ret->top = 0;\n        return ret;\n    }\n    i = ((n - 1) / BN_BYTES) + 1;\n    m = ((n - 1) % (BN_BYTES));\n    if (bn_wexpand(ret, (int)i) == NULL) {\n        BN_free(bn);\n        return NULL;\n    }\n    ret->top = i;\n    ret->neg = 0;\n    l = 0;\n    while (n--) {\n        l = (l << 8L) | *(s++);\n        if (m-- == 0) {\n            ret->d[--i] = l;\n            l = 0;\n            m = BN_BYTES - 1;\n        }\n    }\n    bn_correct_top(ret);\n    return ret;\n}', 'int rsa_fips186_4_gen_prob_primes(RSA *rsa, BIGNUM *p1, BIGNUM *p2,\n                                  BIGNUM *Xpout, const BIGNUM *Xp,\n                                  const BIGNUM *Xp1, const BIGNUM *Xp2,\n                                  BIGNUM *q1, BIGNUM *q2, BIGNUM *Xqout,\n                                  const BIGNUM *Xq, const BIGNUM *Xq1,\n                                  const BIGNUM *Xq2, int nbits,\n                                  const BIGNUM *e, BN_CTX *ctx, BN_GENCB *cb)\n{\n    int ret = 0, ok;\n    BIGNUM *Xpo = NULL, *Xqo = NULL, *tmp = NULL;\n    if (nbits < RSA_FIPS1864_MIN_KEYGEN_KEYSIZE) {\n        RSAerr(RSA_F_RSA_FIPS186_4_GEN_PROB_PRIMES, RSA_R_INVALID_KEY_LENGTH);\n        return 0;\n    }\n    if (!rsa_check_public_exponent(e)) {\n        RSAerr(RSA_F_RSA_FIPS186_4_GEN_PROB_PRIMES,\n               RSA_R_PUB_EXPONENT_OUT_OF_RANGE);\n        goto err;\n    }\n    BN_CTX_start(ctx);\n    tmp = BN_CTX_get(ctx);\n    Xpo = (Xpout != NULL) ? Xpout : BN_CTX_get(ctx);\n    Xqo = (Xqout != NULL) ? Xqout : BN_CTX_get(ctx);\n    if (tmp == NULL || Xpo == NULL || Xqo == NULL)\n        goto err;\n    if (rsa->p == NULL)\n        rsa->p = BN_secure_new();\n    if (rsa->q == NULL)\n        rsa->q = BN_secure_new();\n    if (rsa->p == NULL || rsa->q == NULL)\n        goto err;\n    if (!bn_rsa_fips186_4_gen_prob_primes(rsa->p, Xpo, p1, p2, Xp, Xp1, Xp2,\n                                          nbits, e, ctx, cb))\n        goto err;\n    for(;;) {\n        if (!bn_rsa_fips186_4_gen_prob_primes(rsa->q, Xqo, q1, q2, Xq, Xq1,\n                                              Xq2, nbits, e, ctx, cb))\n            goto err;\n        ok = rsa_check_pminusq_diff(tmp, Xpo, Xqo, nbits);\n        if (ok < 0)\n            goto err;\n        if (ok == 0)\n            continue;\n        ok = rsa_check_pminusq_diff(tmp, rsa->p, rsa->q, nbits);\n        if (ok < 0)\n            goto err;\n        if (ok == 0)\n            continue;\n        break;\n    }\n    ret = 1;\nerr:\n    if (Xpo != Xpout)\n        BN_clear(Xpo);\n    if (Xqo != Xqout)\n        BN_clear(Xqo);\n    BN_clear(tmp);\n    BN_CTX_end(ctx);\n    return ret;\n}', 'int bn_rsa_fips186_4_gen_prob_primes(BIGNUM *p, BIGNUM *Xpout,\n                                     BIGNUM *p1, BIGNUM *p2,\n                                     const BIGNUM *Xp, const BIGNUM *Xp1,\n                                     const BIGNUM *Xp2, int nlen,\n                                     const BIGNUM *e, BN_CTX *ctx, BN_GENCB *cb)\n{\n    int ret = 0;\n    BIGNUM *p1i = NULL, *p2i = NULL, *Xp1i = NULL, *Xp2i = NULL;\n    int bitlen;\n    if (p == NULL || Xpout == NULL)\n        return 0;\n    BN_CTX_start(ctx);\n    p1i = (p1 != NULL) ? p1 : BN_CTX_get(ctx);\n    p2i = (p2 != NULL) ? p2 : BN_CTX_get(ctx);\n    Xp1i = (Xp1 != NULL) ? (BIGNUM *)Xp1 : BN_CTX_get(ctx);\n    Xp2i = (Xp2 != NULL) ? (BIGNUM *)Xp2 : BN_CTX_get(ctx);\n    if (p1i == NULL || p2i == NULL || Xp1i == NULL || Xp2i == NULL)\n        goto err;\n    bitlen = bn_rsa_fips186_4_aux_prime_min_size(nlen);\n    if (bitlen == 0)\n        goto err;\n    if (Xp1 == NULL) {\n        if (!BN_priv_rand(Xp1i, bitlen, BN_RAND_TOP_ONE, BN_RAND_BOTTOM_ODD))\n            goto err;\n    }\n    if (Xp2 == NULL) {\n        if (!BN_priv_rand(Xp2i, bitlen, BN_RAND_TOP_ONE, BN_RAND_BOTTOM_ODD))\n            goto err;\n    }\n    if (!bn_rsa_fips186_4_find_aux_prob_prime(Xp1i, p1i, ctx, cb)\n            || !bn_rsa_fips186_4_find_aux_prob_prime(Xp2i, p2i, ctx, cb))\n        goto err;\n    if ((BN_num_bits(p1i) + BN_num_bits(p2i)) >=\n            bn_rsa_fips186_4_aux_prime_max_sum_size_for_prob_primes(nlen))\n        goto err;\n    if (!bn_rsa_fips186_4_derive_prime(p, Xpout, Xp, p1i, p2i, nlen, e, ctx, cb))\n        goto err;\n    ret = 1;\nerr:\n    if (p1 == NULL)\n        BN_clear(p1i);\n    if (p2 == NULL)\n        BN_clear(p2i);\n    if (Xp1 == NULL)\n        BN_clear(Xp1i);\n    if (Xp2 == NULL)\n        BN_clear(Xp2i);\n    BN_CTX_end(ctx);\n    return ret;\n}', 'int bn_rsa_fips186_4_derive_prime(BIGNUM *Y, BIGNUM *X, const BIGNUM *Xin,\n                                  const BIGNUM *r1, const BIGNUM *r2, int nlen,\n                                  const BIGNUM *e, BN_CTX *ctx, BN_GENCB *cb)\n{\n    int ret = 0;\n    int i, imax;\n    int bits = nlen >> 1;\n    int checks = bn_rsa_fips186_4_prime_MR_min_checks(nlen);\n    BIGNUM *tmp, *R, *r1r2x2, *y1, *r1x2;\n    if (checks == 0)\n        return 0;\n    BN_CTX_start(ctx);\n    R = BN_CTX_get(ctx);\n    tmp = BN_CTX_get(ctx);\n    r1r2x2 = BN_CTX_get(ctx);\n    y1 = BN_CTX_get(ctx);\n    r1x2 = BN_CTX_get(ctx);\n    if (r1x2 == NULL)\n        goto err;\n    if (Xin != NULL && BN_copy(X, Xin) == NULL)\n        goto err;\n    if (!(BN_lshift1(r1x2, r1)\n            && BN_gcd(tmp, r1x2, r2, ctx)\n            && BN_is_one(tmp)\n            && BN_mod_inverse(R, r2, r1x2, ctx)\n            && BN_mul(R, R, r2, ctx)\n            && BN_mod_inverse(tmp, r1x2, r2, ctx)\n            && BN_mul(tmp, tmp, r1x2, ctx)\n            && BN_sub(R, R, tmp)\n            && BN_mul(r1r2x2, r1x2, r2, ctx)))\n        goto err;\n    if (BN_is_negative(R) && !BN_add(R, R, r1r2x2))\n        goto err;\n    imax = 5 * bits;\n    for (;;) {\n        if (Xin == NULL) {\n            if (!BN_priv_rand(X, bits, BN_RAND_TOP_TWO, BN_RAND_BOTTOM_ANY))\n                goto end;\n        }\n        if (!BN_mod_sub(Y, R, X, r1r2x2, ctx) || !BN_add(Y, Y, X))\n            goto err;\n        i = 0;\n        for (;;) {\n            if (BN_num_bits(Y) > bits) {\n                if (Xin == NULL)\n                    break;\n                else\n                    goto err;\n            }\n            BN_GENCB_call(cb, 0, 2);\n            if (BN_copy(y1, Y) == NULL\n                    || !BN_sub_word(y1, 1)\n                    || !BN_gcd(tmp, y1, e, ctx))\n                goto err;\n            if (BN_is_one(tmp)\n                    && BN_is_prime_fasttest_ex(Y, checks, ctx, 1, cb))\n                goto end;\n            if (++i >= imax || !BN_add(Y, Y, r1r2x2))\n                goto err;\n        }\n    }\nend:\n    ret = 1;\n    BN_GENCB_call(cb, 3, 0);\nerr:\n    BN_clear(y1);\n    BN_CTX_end(ctx);\n    return ret;\n}', 'BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)\n{\n    bn_check_top(b);\n    if (a == b)\n        return a;\n    if (bn_wexpand(a, b->top) == NULL)\n        return NULL;\n    if (b->top > 0)\n        memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);\n    a->neg = b->neg;\n    a->top = b->top;\n    a->flags |= b->flags & BN_FLG_FIXED_TOP;\n    bn_check_top(a);\n    return a;\n}', 'BIGNUM *bn_wexpand(BIGNUM *a, int words)\n{\n    return (words <= a->dmax) ? a : bn_expand2(a, words);\n}']