crypto/rsa/rsa_pmeth.c:743: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 67108856] by call to `RSA_generate_multi_prime_key`.
Showing all 15 steps of the trace


crypto/rsa/rsa_pmeth.c:727:39: Call
725.       if (rctx->pub_exp == NULL) {
726.           rctx->pub_exp = BN_new();
727.           if (rctx->pub_exp == NULL || !BN_set_word(rctx->pub_exp, RSA_F4))
                                             ^
728.               return 0;
729.       }

crypto/bn/bn_lib.c:366:15: Assignment
  364.       a->neg = 0;
  365.       a->d[0] = w;
  366.       a->top = (w ? 1 : 0);
                       ^
  367.       a->flags &= ~BN_FLG_FIXED_TOP;
  368.       bn_check_top(a);

crypto/bn/bn_lib.c:366:5: Assignment
  364.       a->neg = 0;
  365.       a->d[0] = w;
  366.       a->top = (w ? 1 : 0);
             ^
  367.       a->flags &= ~BN_FLG_FIXED_TOP;
  368.       bn_check_top(a);

crypto/rsa/rsa_pmeth.c:743:11: Call
741.           pcb = NULL;
742.       }
743.       ret = RSA_generate_multi_prime_key(rsa, rctx->nbits, rctx->primes,
                 ^
744.                                          rctx->pub_exp, pcb);
745.       BN_GENCB_free(pcb);

crypto/rsa/rsa_gen.c:41:1: Parameter `e_value->top`
  39.   }
  40.   
  41. > int RSA_generate_multi_prime_key(RSA *rsa, int bits, int primes,
  42.                                    BIGNUM *e_value, BN_GENCB *cb)
  43.   {

crypto/rsa/rsa_gen.c:62:12: Call
  60.       }
  61.   #endif /* FIPS_MODE */
  62.       return rsa_builtin_keygen(rsa, bits, primes, e_value, cb);
                   ^
  63.   }
  64.   

crypto/rsa/rsa_gen.c:65:1: Parameter `e_value->top`
    63.   }
    64.   
    65. > static int rsa_builtin_keygen(RSA *rsa, int bits, int primes, BIGNUM *e_value,
    66.                                 BN_GENCB *cb)
    67.   {

crypto/rsa/rsa_gen.c:150:9: Call
    148.       }
    149.   
    150.       if (BN_copy(rsa->e, e_value) == NULL)
                   ^
    151.           goto err;
    152.   

crypto/bn/bn_lib.c:281:1: <Offset trace>
279.   }
280.   
281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
282.   {
283.       bn_check_top(b);

crypto/bn/bn_lib.c:281:1: Parameter `b->top`
      279.   }
      280.   
      281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      282.   {
      283.       bn_check_top(b);

crypto/bn/bn_lib.c:281:1: <Length trace>
279.   }
280.   
281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
282.   {
283.       bn_check_top(b);

crypto/bn/bn_lib.c:281:1: Parameter `*a->d`
      279.   }
      280.   
      281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      282.   {
      283.       bn_check_top(b);

crypto/bn/bn_lib.c:287:9: Call
      285.       if (a == b)
      286.           return a;
      287.       if (bn_wexpand(a, b->top) == NULL)
                     ^
      288.           return NULL;
      289.   

crypto/bn/bn_lib.c:960:1: Parameter `*a->d`
        958.   }
        959.   
        960. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
        961.   {
        962.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:291:9: Array access: Offset added: [8, +oo] Size: [0, 67108856] by call to `RSA_generate_multi_prime_key` 
      289.   
      290.       if (b->top > 0)
      291.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                     ^
      292.   
      293.       a->neg = b->neg;

BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
{
    bn_check_top(b);
    if (a == b)
        return a;
    if (bn_wexpand(a, b->top) == NULL)
        return NULL;
    if (b->top > 0)
        memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
    a->neg = b->neg;
    a->top = b->top;
    a->flags |= b->flags & BN_FLG_FIXED_TOP;
    bn_check_top(a);
    return a;
}
['static int pkey_rsa_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)\n{\n    RSA *rsa = NULL;\n    RSA_PKEY_CTX *rctx = ctx->data;\n    BN_GENCB *pcb;\n    int ret;\n    if (rctx->pub_exp == NULL) {\n        rctx->pub_exp = BN_new();\n        if (rctx->pub_exp == NULL || !BN_set_word(rctx->pub_exp, RSA_F4))\n            return 0;\n    }\n    rsa = RSA_new();\n    if (rsa == NULL)\n        return 0;\n    if (ctx->pkey_gencb) {\n        pcb = BN_GENCB_new();\n        if (pcb == NULL) {\n            RSA_free(rsa);\n            return 0;\n        }\n        evp_pkey_set_cb_translate(pcb, ctx);\n    } else {\n        pcb = NULL;\n    }\n    ret = RSA_generate_multi_prime_key(rsa, rctx->nbits, rctx->primes,\n                                       rctx->pub_exp, pcb);\n    BN_GENCB_free(pcb);\n    if (ret > 0 && !rsa_set_pss_param(rsa, ctx)) {\n        RSA_free(rsa);\n        return 0;\n    }\n    if (ret > 0)\n        EVP_PKEY_assign(pkey, ctx->pmeth->pkey_id, rsa);\n    else\n        RSA_free(rsa);\n    return ret;\n}', 'int BN_set_word(BIGNUM *a, BN_ULONG w)\n{\n    bn_check_top(a);\n    if (bn_expand(a, (int)sizeof(BN_ULONG) * 8) == NULL)\n        return 0;\n    a->neg = 0;\n    a->d[0] = w;\n    a->top = (w ? 1 : 0);\n    a->flags &= ~BN_FLG_FIXED_TOP;\n    bn_check_top(a);\n    return 1;\n}', 'int RSA_generate_multi_prime_key(RSA *rsa, int bits, int primes,\n                                 BIGNUM *e_value, BN_GENCB *cb)\n{\n#ifndef FIPS_MODE\n    if (rsa->meth->rsa_multi_prime_keygen != NULL) {\n        return rsa->meth->rsa_multi_prime_keygen(rsa, bits, primes,\n                                                 e_value, cb);\n    } else if (rsa->meth->rsa_keygen != NULL) {\n        if (primes == 2)\n            return rsa->meth->rsa_keygen(rsa, bits, e_value, cb);\n        else\n            return 0;\n    }\n#endif\n    return rsa_builtin_keygen(rsa, bits, primes, e_value, cb);\n}', 'static int rsa_builtin_keygen(RSA *rsa, int bits, int primes, BIGNUM *e_value,\n                              BN_GENCB *cb)\n{\n#ifdef FIPS_MODE\n    if (primes != 2)\n        return 0;\n    return rsa_sp800_56b_generate_key(rsa, bits, e_value, cb);\n#else\n    BIGNUM *r0 = NULL, *r1 = NULL, *r2 = NULL, *tmp, *prime;\n    int ok = -1, n = 0, bitsr[RSA_MAX_PRIME_NUM], bitse = 0;\n    int i = 0, quo = 0, rmd = 0, adj = 0, retries = 0;\n    RSA_PRIME_INFO *pinfo = NULL;\n    STACK_OF(RSA_PRIME_INFO) *prime_infos = NULL;\n    BN_CTX *ctx = NULL;\n    BN_ULONG bitst = 0;\n    unsigned long error = 0;\n    if (bits < RSA_MIN_MODULUS_BITS) {\n        ok = 0;\n        RSAerr(RSA_F_RSA_BUILTIN_KEYGEN, RSA_R_KEY_SIZE_TOO_SMALL);\n        goto err;\n    }\n    if (primes < RSA_DEFAULT_PRIME_NUM || primes > rsa_multip_cap(bits)) {\n        ok = 0;\n        RSAerr(RSA_F_RSA_BUILTIN_KEYGEN, RSA_R_KEY_PRIME_NUM_INVALID);\n        goto err;\n    }\n    ctx = BN_CTX_new();\n    if (ctx == NULL)\n        goto err;\n    BN_CTX_start(ctx);\n    r0 = BN_CTX_get(ctx);\n    r1 = BN_CTX_get(ctx);\n    r2 = BN_CTX_get(ctx);\n    if (r2 == NULL)\n        goto err;\n    quo = bits / primes;\n    rmd = bits % primes;\n    for (i = 0; i < primes; i++)\n        bitsr[i] = (i < rmd) ? quo + 1 : quo;\n    if (!rsa->n && ((rsa->n = BN_new()) == NULL))\n        goto err;\n    if (!rsa->d && ((rsa->d = BN_secure_new()) == NULL))\n        goto err;\n    if (!rsa->e && ((rsa->e = BN_new()) == NULL))\n        goto err;\n    if (!rsa->p && ((rsa->p = BN_secure_new()) == NULL))\n        goto err;\n    if (!rsa->q && ((rsa->q = BN_secure_new()) == NULL))\n        goto err;\n    if (!rsa->dmp1 && ((rsa->dmp1 = BN_secure_new()) == NULL))\n        goto err;\n    if (!rsa->dmq1 && ((rsa->dmq1 = BN_secure_new()) == NULL))\n        goto err;\n    if (!rsa->iqmp && ((rsa->iqmp = BN_secure_new()) == NULL))\n        goto err;\n    if (primes > RSA_DEFAULT_PRIME_NUM) {\n        rsa->version = RSA_ASN1_VERSION_MULTI;\n        prime_infos = sk_RSA_PRIME_INFO_new_reserve(NULL, primes - 2);\n        if (prime_infos == NULL)\n            goto err;\n        if (rsa->prime_infos != NULL) {\n            sk_RSA_PRIME_INFO_pop_free(rsa->prime_infos, rsa_multip_info_free);\n        }\n        rsa->prime_infos = prime_infos;\n        for (i = 2; i < primes; i++) {\n            pinfo = rsa_multip_info_new();\n            if (pinfo == NULL)\n                goto err;\n            (void)sk_RSA_PRIME_INFO_push(prime_infos, pinfo);\n        }\n    }\n    if (BN_copy(rsa->e, e_value) == NULL)\n        goto err;\n    for (i = 0; i < primes; i++) {\n        adj = 0;\n        retries = 0;\n        if (i == 0) {\n            prime = rsa->p;\n        } else if (i == 1) {\n            prime = rsa->q;\n        } else {\n            pinfo = sk_RSA_PRIME_INFO_value(prime_infos, i - 2);\n            prime = pinfo->r;\n        }\n        BN_set_flags(prime, BN_FLG_CONSTTIME);\n        for (;;) {\n redo:\n            if (!BN_generate_prime_ex(prime, bitsr[i] + adj, 0, NULL, NULL, cb))\n                goto err;\n            {\n                int j;\n                for (j = 0; j < i; j++) {\n                    BIGNUM *prev_prime;\n                    if (j == 0)\n                        prev_prime = rsa->p;\n                    else if (j == 1)\n                        prev_prime = rsa->q;\n                    else\n                        prev_prime = sk_RSA_PRIME_INFO_value(prime_infos,\n                                                             j - 2)->r;\n                    if (!BN_cmp(prime, prev_prime)) {\n                        goto redo;\n                    }\n                }\n            }\n            if (!BN_sub(r2, prime, BN_value_one()))\n                goto err;\n            ERR_set_mark();\n            BN_set_flags(r2, BN_FLG_CONSTTIME);\n            if (BN_mod_inverse(r1, r2, rsa->e, ctx) != NULL) {\n                break;\n            }\n            error = ERR_peek_last_error();\n            if (ERR_GET_LIB(error) == ERR_LIB_BN\n                && ERR_GET_REASON(error) == BN_R_NO_INVERSE) {\n                ERR_pop_to_mark();\n            } else {\n                goto err;\n            }\n            if (!BN_GENCB_call(cb, 2, n++))\n                goto err;\n        }\n        bitse += bitsr[i];\n        if (i == 1) {\n            if (!BN_mul(r1, rsa->p, rsa->q, ctx))\n                goto err;\n        } else if (i != 0) {\n            if (!BN_mul(r1, rsa->n, prime, ctx))\n                goto err;\n        } else {\n            if (!BN_GENCB_call(cb, 3, i))\n                goto err;\n            continue;\n        }\n        if (!BN_rshift(r2, r1, bitse - 4))\n            goto err;\n        bitst = BN_get_word(r2);\n        if (bitst < 0x9 || bitst > 0xF) {\n            bitse -= bitsr[i];\n            if (!BN_GENCB_call(cb, 2, n++))\n                goto err;\n            if (primes > 4) {\n                if (bitst < 0x9)\n                    adj++;\n                else\n                    adj--;\n            } else if (retries == 4) {\n                i = -1;\n                bitse = 0;\n                continue;\n            }\n            retries++;\n            goto redo;\n        }\n        if (i > 1 && BN_copy(pinfo->pp, rsa->n) == NULL)\n            goto err;\n        if (BN_copy(rsa->n, r1) == NULL)\n            goto err;\n        if (!BN_GENCB_call(cb, 3, i))\n            goto err;\n    }\n    if (BN_cmp(rsa->p, rsa->q) < 0) {\n        tmp = rsa->p;\n        rsa->p = rsa->q;\n        rsa->q = tmp;\n    }\n    if (!BN_sub(r1, rsa->p, BN_value_one()))\n        goto err;\n    if (!BN_sub(r2, rsa->q, BN_value_one()))\n        goto err;\n    if (!BN_mul(r0, r1, r2, ctx))\n        goto err;\n    for (i = 2; i < primes; i++) {\n        pinfo = sk_RSA_PRIME_INFO_value(prime_infos, i - 2);\n        if (!BN_sub(pinfo->d, pinfo->r, BN_value_one()))\n            goto err;\n        if (!BN_mul(r0, r0, pinfo->d, ctx))\n            goto err;\n    }\n    {\n        BIGNUM *pr0 = BN_new();\n        if (pr0 == NULL)\n            goto err;\n        BN_with_flags(pr0, r0, BN_FLG_CONSTTIME);\n        if (!BN_mod_inverse(rsa->d, rsa->e, pr0, ctx)) {\n            BN_free(pr0);\n            goto err;\n        }\n        BN_free(pr0);\n    }\n    {\n        BIGNUM *d = BN_new();\n        if (d == NULL)\n            goto err;\n        BN_with_flags(d, rsa->d, BN_FLG_CONSTTIME);\n        if (!BN_mod(rsa->dmp1, d, r1, ctx)\n            || !BN_mod(rsa->dmq1, d, r2, ctx)) {\n            BN_free(d);\n            goto err;\n        }\n        for (i = 2; i < primes; i++) {\n            pinfo = sk_RSA_PRIME_INFO_value(prime_infos, i - 2);\n            if (!BN_mod(pinfo->d, d, pinfo->d, ctx)) {\n                BN_free(d);\n                goto err;\n            }\n        }\n        BN_free(d);\n    }\n    {\n        BIGNUM *p = BN_new();\n        if (p == NULL)\n            goto err;\n        BN_with_flags(p, rsa->p, BN_FLG_CONSTTIME);\n        if (!BN_mod_inverse(rsa->iqmp, rsa->q, p, ctx)) {\n            BN_free(p);\n            goto err;\n        }\n        for (i = 2; i < primes; i++) {\n            pinfo = sk_RSA_PRIME_INFO_value(prime_infos, i - 2);\n            BN_with_flags(p, pinfo->r, BN_FLG_CONSTTIME);\n            if (!BN_mod_inverse(pinfo->t, pinfo->pp, p, ctx)) {\n                BN_free(p);\n                goto err;\n            }\n        }\n        BN_free(p);\n    }\n    ok = 1;\n err:\n    if (ok == -1) {\n        RSAerr(RSA_F_RSA_BUILTIN_KEYGEN, ERR_LIB_BN);\n        ok = 0;\n    }\n    if (ctx != NULL)\n        BN_CTX_end(ctx);\n    BN_CTX_free(ctx);\n    return ok;\n#endif\n}', 'BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)\n{\n    bn_check_top(b);\n    if (a == b)\n        return a;\n    if (bn_wexpand(a, b->top) == NULL)\n        return NULL;\n    if (b->top > 0)\n        memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);\n    a->neg = b->neg;\n    a->top = b->top;\n    a->flags |= b->flags & BN_FLG_FIXED_TOP;\n    bn_check_top(a);\n    return a;\n}', 'BIGNUM *bn_wexpand(BIGNUM *a, int words)\n{\n    return (words <= a->dmax) ? a : bn_expand2(a, words);\n}']