crypto/bn/bn_print.c:109: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: [0, +oo].
Showing all 12 steps of the trace


crypto/bn/bn_print.c:73:9: <Length trace>
71.        *     <= 3 * BN_num_bits(a) / 10 + 3 * BN_num_bits / 1000 + 1 + 1
72.        */
73.       i = BN_num_bits(a) * 3;
              ^
74.       num = (i / 10 + i / 1000 + 1) + 1;
75.       bn_data_num = num / BN_DEC_NUM + 1;

crypto/bn/bn_print.c:73:9: Call
71.        *     <= 3 * BN_num_bits(a) / 10 + 3 * BN_num_bits / 1000 + 1 + 1
72.        */
73.       i = BN_num_bits(a) * 3;
              ^
74.       num = (i / 10 + i / 1000 + 1) + 1;
75.       bn_data_num = num / BN_DEC_NUM + 1;

crypto/bn/bn_lib.c:167:9: Assignment
  165.   
  166.       if (BN_is_zero(a))
  167.           return 0;
                 ^
  168.       return ((i * BN_BITS2) + BN_num_bits_word(a->d[i]));
  169.   }

crypto/bn/bn_print.c:73:5: Assignment
71.        *     <= 3 * BN_num_bits(a) / 10 + 3 * BN_num_bits / 1000 + 1 + 1
72.        */
73.       i = BN_num_bits(a) * 3;
          ^
74.       num = (i / 10 + i / 1000 + 1) + 1;
75.       bn_data_num = num / BN_DEC_NUM + 1;

crypto/bn/bn_print.c:74:5: Assignment
72.        */
73.       i = BN_num_bits(a) * 3;
74.       num = (i / 10 + i / 1000 + 1) + 1;
          ^
75.       bn_data_num = num / BN_DEC_NUM + 1;
76.       bn_data = OPENSSL_malloc(bn_data_num * sizeof(BN_ULONG));

crypto/bn/bn_print.c:75:5: Assignment
73.       i = BN_num_bits(a) * 3;
74.       num = (i / 10 + i / 1000 + 1) + 1;
75.       bn_data_num = num / BN_DEC_NUM + 1;
          ^
76.       bn_data = OPENSSL_malloc(bn_data_num * sizeof(BN_ULONG));
77.       buf = OPENSSL_malloc(num + 3);

crypto/bn/bn_print.c:76:15: Call
74.       num = (i / 10 + i / 1000 + 1) + 1;
75.       bn_data_num = num / BN_DEC_NUM + 1;
76.       bn_data = OPENSSL_malloc(bn_data_num * sizeof(BN_ULONG));
                    ^
77.       buf = OPENSSL_malloc(num + 3);
78.       if ((buf == NULL) || (bn_data == NULL)) {

crypto/mem.c:79:9: Assignment
  77.   
  78.       if (num <= 0)
  79.           return NULL;
                ^
  80.   
  81.       allow_customize = 0;

crypto/bn/bn_print.c:76:5: Assignment
74.       num = (i / 10 + i / 1000 + 1) + 1;
75.       bn_data_num = num / BN_DEC_NUM + 1;
76.       bn_data = OPENSSL_malloc(bn_data_num * sizeof(BN_ULONG));
          ^
77.       buf = OPENSSL_malloc(num + 3);
78.       if ((buf == NULL) || (bn_data == NULL)) {

crypto/bn/bn_print.c:87:5: Assignment
85.   #define BUF_REMAIN (num+3 - (size_t)(p - buf))
86.       p = buf;
87.       lp = bn_data;
          ^
88.       if (BN_is_zero(t)) {
89.           *(p++) = '0';

crypto/bn/bn_print.c:103:9: Assignment
101.               lp++;
102.           }
103.           lp--;
               ^
104.           /*
105.            * We now have a series of blocks, BN_DEC_NUM chars in length, where

crypto/bn/bn_print.c:109:50: Array access: Offset: [-1, +oo] Size: [0, +oo]
107.            * order.
108.            */
109.           BIO_snprintf(p, BUF_REMAIN, BN_DEC_FMT1, *lp);
                                                        ^
110.           while (*p)
111.               p++;

char *BN_bn2dec(const BIGNUM *a)
{
    int i = 0, num, ok = 0;
    char *buf = NULL;
    char *p;
    BIGNUM *t = NULL;
    BN_ULONG *bn_data = NULL, *lp;
    int bn_data_num;
    i = BN_num_bits(a) * 3;
    num = (i / 10 + i / 1000 + 1) + 1;
    bn_data_num = num / BN_DEC_NUM + 1;
    bn_data = OPENSSL_malloc(bn_data_num * sizeof(BN_ULONG));
    buf = OPENSSL_malloc(num + 3);
    if ((buf == NULL) || (bn_data == NULL)) {
        BNerr(BN_F_BN_BN2DEC, ERR_R_MALLOC_FAILURE);
        goto err;
    }
    if ((t = BN_dup(a)) == NULL)
        goto err;
#define BUF_REMAIN (num+3 - (size_t)(p - buf))
    p = buf;
    lp = bn_data;
    if (BN_is_zero(t)) {
        *(p++) = '0';
        *(p++) = '\0';
    } else {
        if (BN_is_negative(t))
            *p++ = '-';
        while (!BN_is_zero(t)) {
            if (lp - bn_data >= bn_data_num)
                goto err;
            *lp = BN_div_word(t, BN_DEC_CONV);
            if (*lp == (BN_ULONG)-1)
                goto err;
            lp++;
        }
        lp--;
        BIO_snprintf(p, BUF_REMAIN, BN_DEC_FMT1, *lp);
        while (*p)
            p++;
        while (lp != bn_data) {
            lp--;
            BIO_snprintf(p, BUF_REMAIN, BN_DEC_FMT2, *lp);
            while (*p)
                p++;
        }
    }
    ok = 1;
 err:
    OPENSSL_free(bn_data);
    BN_free(t);
    if (ok)
        return buf;
    OPENSSL_free(buf);
    return NULL;
}
["char *BN_bn2dec(const BIGNUM *a)\n{\n    int i = 0, num, ok = 0;\n    char *buf = NULL;\n    char *p;\n    BIGNUM *t = NULL;\n    BN_ULONG *bn_data = NULL, *lp;\n    int bn_data_num;\n    i = BN_num_bits(a) * 3;\n    num = (i / 10 + i / 1000 + 1) + 1;\n    bn_data_num = num / BN_DEC_NUM + 1;\n    bn_data = OPENSSL_malloc(bn_data_num * sizeof(BN_ULONG));\n    buf = OPENSSL_malloc(num + 3);\n    if ((buf == NULL) || (bn_data == NULL)) {\n        BNerr(BN_F_BN_BN2DEC, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    if ((t = BN_dup(a)) == NULL)\n        goto err;\n#define BUF_REMAIN (num+3 - (size_t)(p - buf))\n    p = buf;\n    lp = bn_data;\n    if (BN_is_zero(t)) {\n        *(p++) = '0';\n        *(p++) = '\\0';\n    } else {\n        if (BN_is_negative(t))\n            *p++ = '-';\n        while (!BN_is_zero(t)) {\n            if (lp - bn_data >= bn_data_num)\n                goto err;\n            *lp = BN_div_word(t, BN_DEC_CONV);\n            if (*lp == (BN_ULONG)-1)\n                goto err;\n            lp++;\n        }\n        lp--;\n        BIO_snprintf(p, BUF_REMAIN, BN_DEC_FMT1, *lp);\n        while (*p)\n            p++;\n        while (lp != bn_data) {\n            lp--;\n            BIO_snprintf(p, BUF_REMAIN, BN_DEC_FMT2, *lp);\n            while (*p)\n                p++;\n        }\n    }\n    ok = 1;\n err:\n    OPENSSL_free(bn_data);\n    BN_free(t);\n    if (ok)\n        return buf;\n    OPENSSL_free(buf);\n    return NULL;\n}", 'int BN_num_bits(const BIGNUM *a)\n{\n    int i = a->top - 1;\n    bn_check_top(a);\n    if (BN_is_zero(a))\n        return 0;\n    return ((i * BN_BITS2) + BN_num_bits_word(a->d[i]));\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)\n        return malloc_impl(num, file, line);\n    if (num <= 0)\n        return NULL;\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    osslargused(file); osslargused(line);\n    ret = malloc(num);\n#endif\n    return ret;\n}']