crypto/ec/ec_mult.c:203: error: BUFFER_OVERRUN_L3
  Offset: 9 Size: [0, 8388607] by call to `BN_consttime_swap`.
Showing all 9 steps of the trace


crypto/ec/ec_mult.c:163:14: Call
161.       EC_POINT_BN_set_flags(s, BN_FLG_CONSTTIME);
162.   
163.       lambda = BN_CTX_get(ctx);
                    ^
164.       k = BN_CTX_get(ctx);
165.       if (k == NULL)

crypto/bn/bn_ctx.c:229:5: Call
  227.       }
  228.       /* OK, make sure the returned bignum is "zero" */
  229.       BN_zero(ret);
             ^
  230.       ctx->used++;
  231.       CTXDBG_RET(ctx, ret);

crypto/bn/bn_lib.c:360:1: Parameter `*a->d`
    358.   }
    359.   
    360. > int BN_set_word(BIGNUM *a, BN_ULONG w)
    361.   {
    362.       bn_check_top(a);

crypto/bn/bn_lib.c:363:9: Call
    361.   {
    362.       bn_check_top(a);
    363.       if (bn_expand(a, (int)sizeof(BN_ULONG) * 8) == NULL)
                   ^
    364.           return 0;
    365.       a->neg = 0;

crypto/bn/bn_lcl.h:651:1: Parameter `*a->d`
      649.                            const BIGNUM *add, const BIGNUM *rem, BN_CTX *ctx);
      650.   
      651. > static ossl_inline BIGNUM *bn_expand(BIGNUM *a, int bits)
      652.   {
      653.       if (bits > (INT_MAX - BN_BITS2 + 1))

crypto/ec/ec_mult.c:203:5: Call
201.        */
202.       kbit = BN_is_bit_set(lambda, order_bits);
203.       BN_consttime_swap(kbit, k, lambda, group_top + 1);
           ^
204.   
205.       group_top = bn_get_top(group->field);

crypto/bn/bn_lib.c:727:1: <Length trace>
725.    * a and b cannot be the same number
726.    */
727. > void BN_consttime_swap(BN_ULONG condition, BIGNUM *a, BIGNUM *b, int nwords)
728.   {
729.       BN_ULONG t;

crypto/bn/bn_lib.c:727:1: Parameter `*b->d`
  725.    * a and b cannot be the same number
  726.    */
  727. > void BN_consttime_swap(BN_ULONG condition, BIGNUM *a, BIGNUM *b, int nwords)
  728.   {
  729.       BN_ULONG t;

crypto/bn/bn_lib.c:786:9: Array access: Offset: 9 Size: [0, 8388607] by call to `BN_consttime_swap` 
  784.           /* Fallthrough */
  785.       case 10:
  786.           BN_CONSTTIME_SWAP(9);   /* Fallthrough */
                 ^
  787.       case 9:
  788.           BN_CONSTTIME_SWAP(8);   /* Fallthrough */

void BN_consttime_swap(BN_ULONG condition, BIGNUM *a, BIGNUM *b, int nwords)
{
    BN_ULONG t;
    int i;
    bn_wcheck_size(a, nwords);
    bn_wcheck_size(b, nwords);
    assert(a != b);
    assert((condition & (condition - 1)) == 0);
    assert(sizeof(BN_ULONG) >= sizeof(int));
    condition = ((condition - 1) >> (BN_BITS2 - 1)) - 1;
    t = (a->top ^ b->top) & condition;
    a->top ^= t;
    b->top ^= t;
    t = (a->neg ^ b->neg) & condition;
    a->neg ^= t;
    b->neg ^= t;
    t = ((a->flags ^ b->flags) & BN_FLG_CONSTTIME) & condition;
    a->flags ^= t;
    b->flags ^= t;
#define BN_CONSTTIME_SWAP(ind) \
        do { \
                t = (a->d[ind] ^ b->d[ind]) & condition; \
                a->d[ind] ^= t; \
                b->d[ind] ^= t; \
        } while (0)
    switch (nwords) {
    default:
        for (i = 10; i < nwords; i++)
            BN_CONSTTIME_SWAP(i);
    case 10:
        BN_CONSTTIME_SWAP(9);
    case 9:
        BN_CONSTTIME_SWAP(8);
    case 8:
        BN_CONSTTIME_SWAP(7);
    case 7:
        BN_CONSTTIME_SWAP(6);
    case 6:
        BN_CONSTTIME_SWAP(5);
    case 5:
        BN_CONSTTIME_SWAP(4);
    case 4:
        BN_CONSTTIME_SWAP(3);
    case 3:
        BN_CONSTTIME_SWAP(2);
    case 2:
        BN_CONSTTIME_SWAP(1);
    case 1:
        BN_CONSTTIME_SWAP(0);
    }
#undef BN_CONSTTIME_SWAP
}
['static int ec_mul_consttime(const EC_GROUP *group, EC_POINT *r,\n                            const BIGNUM *scalar, const EC_POINT *point,\n                            BN_CTX *ctx)\n{\n    int i, order_bits, group_top, kbit, pbit, Z_is_one;\n    EC_POINT *s = NULL;\n    BIGNUM *k = NULL;\n    BIGNUM *lambda = NULL;\n    BN_CTX *new_ctx = NULL;\n    int ret = 0;\n    if (ctx == NULL && (ctx = new_ctx = BN_CTX_secure_new()) == NULL)\n        return 0;\n    BN_CTX_start(ctx);\n    order_bits = BN_num_bits(group->order);\n    s = EC_POINT_new(group);\n    if (s == NULL)\n        goto err;\n    if (point == NULL) {\n        if (!EC_POINT_copy(s, group->generator))\n            goto err;\n    } else {\n        if (!EC_POINT_copy(s, point))\n            goto err;\n    }\n    EC_POINT_BN_set_flags(s, BN_FLG_CONSTTIME);\n    lambda = BN_CTX_get(ctx);\n    k = BN_CTX_get(ctx);\n    if (k == NULL)\n        goto err;\n    group_top = bn_get_top(group->order);\n    if ((bn_wexpand(k, group_top + 1) == NULL)\n        || (bn_wexpand(lambda, group_top + 1) == NULL))\n        goto err;\n    if (!BN_copy(k, scalar))\n        goto err;\n    BN_set_flags(k, BN_FLG_CONSTTIME);\n    if ((BN_num_bits(k) > order_bits) || (BN_is_negative(k))) {\n        if (!BN_nnmod(k, k, group->order, ctx))\n            goto err;\n    }\n    if (!BN_add(lambda, k, group->order))\n        goto err;\n    BN_set_flags(lambda, BN_FLG_CONSTTIME);\n    if (!BN_add(k, lambda, group->order))\n        goto err;\n    kbit = BN_is_bit_set(lambda, order_bits);\n    BN_consttime_swap(kbit, k, lambda, group_top + 1);\n    group_top = bn_get_top(group->field);\n    if ((bn_wexpand(s->X, group_top) == NULL)\n        || (bn_wexpand(s->Y, group_top) == NULL)\n        || (bn_wexpand(s->Z, group_top) == NULL)\n        || (bn_wexpand(r->X, group_top) == NULL)\n        || (bn_wexpand(r->Y, group_top) == NULL)\n        || (bn_wexpand(r->Z, group_top) == NULL))\n        goto err;\n    if (!EC_POINT_copy(r, s))\n        goto err;\n    EC_POINT_BN_set_flags(r, BN_FLG_CONSTTIME);\n    if (!EC_POINT_dbl(group, s, s, ctx))\n        goto err;\n    pbit = 0;\n#define EC_POINT_CSWAP(c, a, b, w, t) do {         \\\n        BN_consttime_swap(c, (a)->X, (b)->X, w);   \\\n        BN_consttime_swap(c, (a)->Y, (b)->Y, w);   \\\n        BN_consttime_swap(c, (a)->Z, (b)->Z, w);   \\\n        t = ((a)->Z_is_one ^ (b)->Z_is_one) & (c); \\\n        (a)->Z_is_one ^= (t);                      \\\n        (b)->Z_is_one ^= (t);                      \\\n} while(0)\n    for (i = order_bits - 1; i >= 0; i--) {\n        kbit = BN_is_bit_set(k, i) ^ pbit;\n        EC_POINT_CSWAP(kbit, r, s, group_top, Z_is_one);\n        if (!EC_POINT_add(group, s, r, s, ctx))\n            goto err;\n        if (!EC_POINT_dbl(group, r, r, ctx))\n            goto err;\n        pbit ^= kbit;\n    }\n    EC_POINT_CSWAP(pbit, r, s, group_top, Z_is_one);\n#undef EC_POINT_CSWAP\n    ret = 1;\n err:\n    EC_POINT_free(s);\n    BN_CTX_end(ctx);\n    BN_CTX_free(new_ctx);\n    return ret;\n}', 'BIGNUM *BN_CTX_get(BN_CTX *ctx)\n{\n    BIGNUM *ret;\n    CTXDBG_ENTRY("BN_CTX_get", ctx);\n    if (ctx->err_stack || ctx->too_many)\n        return NULL;\n    if ((ret = BN_POOL_get(&ctx->pool, ctx->flags)) == NULL) {\n        ctx->too_many = 1;\n        BNerr(BN_F_BN_CTX_GET, BN_R_TOO_MANY_TEMPORARY_VARIABLES);\n        return NULL;\n    }\n    BN_zero(ret);\n    ctx->used++;\n    CTXDBG_RET(ctx, ret);\n    return ret;\n}', 'int BN_set_word(BIGNUM *a, BN_ULONG w)\n{\n    bn_check_top(a);\n    if (bn_expand(a, (int)sizeof(BN_ULONG) * 8) == NULL)\n        return 0;\n    a->neg = 0;\n    a->d[0] = w;\n    a->top = (w ? 1 : 0);\n    bn_check_top(a);\n    return 1;\n}', 'static ossl_inline BIGNUM *bn_expand(BIGNUM *a, int bits)\n{\n    if (bits > (INT_MAX - BN_BITS2 + 1))\n        return NULL;\n    if (((bits+BN_BITS2-1)/BN_BITS2) <= (a)->dmax)\n        return a;\n    return bn_expand2((a),(bits+BN_BITS2-1)/BN_BITS2);\n}', 'void BN_consttime_swap(BN_ULONG condition, BIGNUM *a, BIGNUM *b, int nwords)\n{\n    BN_ULONG t;\n    int i;\n    bn_wcheck_size(a, nwords);\n    bn_wcheck_size(b, nwords);\n    assert(a != b);\n    assert((condition & (condition - 1)) == 0);\n    assert(sizeof(BN_ULONG) >= sizeof(int));\n    condition = ((condition - 1) >> (BN_BITS2 - 1)) - 1;\n    t = (a->top ^ b->top) & condition;\n    a->top ^= t;\n    b->top ^= t;\n    t = (a->neg ^ b->neg) & condition;\n    a->neg ^= t;\n    b->neg ^= t;\n    t = ((a->flags ^ b->flags) & BN_FLG_CONSTTIME) & condition;\n    a->flags ^= t;\n    b->flags ^= t;\n#define BN_CONSTTIME_SWAP(ind) \\\n        do { \\\n                t = (a->d[ind] ^ b->d[ind]) & condition; \\\n                a->d[ind] ^= t; \\\n                b->d[ind] ^= t; \\\n        } while (0)\n    switch (nwords) {\n    default:\n        for (i = 10; i < nwords; i++)\n            BN_CONSTTIME_SWAP(i);\n    case 10:\n        BN_CONSTTIME_SWAP(9);\n    case 9:\n        BN_CONSTTIME_SWAP(8);\n    case 8:\n        BN_CONSTTIME_SWAP(7);\n    case 7:\n        BN_CONSTTIME_SWAP(6);\n    case 6:\n        BN_CONSTTIME_SWAP(5);\n    case 5:\n        BN_CONSTTIME_SWAP(4);\n    case 4:\n        BN_CONSTTIME_SWAP(3);\n    case 3:\n        BN_CONSTTIME_SWAP(2);\n    case 2:\n        BN_CONSTTIME_SWAP(1);\n    case 1:\n        BN_CONSTTIME_SWAP(0);\n    }\n#undef BN_CONSTTIME_SWAP\n}']