test/bntest.c:425: error: BUFFER_OVERRUN_L3
  Offset: [54, +oo] (⇐ [0, +oo] + [54, 64]) Size: [1, +oo] by call to `glue`.
Showing all 8 steps of the trace


test/bntest.c:394:37: Array declaration
392.       /* Regression test for carry bug in bn_sqrx8x_internal */
393.       {
394.           static const char *ahex[] = {
                                           ^
395.                         "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
396.               "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",

test/bntest.c:425:21: Call
423.   	};
424.   
425.           bigstring = glue(ahex);
                           ^
426.           BN_hex2bn(&a, bigstring);
427.           OPENSSL_free(bigstring);

test/bntest.c:308:1: <Offset trace>
306.   };
307.   
308. > static char *glue(const char *list[])
309.   {
310.       size_t len = 0;

test/bntest.c:308:1: Parameter `(*list)->strlen`
  306.   };
  307.   
  308. > static char *glue(const char *list[])
  309.   {
  310.       size_t len = 0;

test/bntest.c:308:1: <Length trace>
306.   };
307.   
308. > static char *glue(const char *list[])
309.   {
310.       size_t len = 0;

test/bntest.c:308:1: Parameter `(*list)->strlen`
  306.   };
  307.   
  308. > static char *glue(const char *list[])
  309.   {
  310.       size_t len = 0;

test/bntest.c:319:9: Assignment
  317.               return NULL;
  318.       for (i = 0; list[i] != NULL; i++)
  319.           p += strlen(strcpy(p, list[i]));
                 ^
  320.       return save;
  321.   }

test/bntest.c:319:21: Array access: Offset: [54, +oo] (⇐ [0, +oo] + [54, 64]) Size: [1, +oo] by call to `glue` 
  317.               return NULL;
  318.       for (i = 0; list[i] != NULL; i++)
  319.           p += strlen(strcpy(p, list[i]));
                             ^
  320.       return save;
  321.   }

static char *glue(const char *list[])
{
    size_t len = 0;
    char *p, *save;
    int i;
    for (i = 0; list[i] != NULL; i++)
        len += strlen(list[i]);
    if (!TEST_ptr(p = save = OPENSSL_malloc(len + 1)))
            return NULL;
    for (i = 0; list[i] != NULL; i++)
        p += strlen(strcpy(p, list[i]));
    return save;
}
['static int test_modexp_mont5(void)\n{\n    BIGNUM *a = NULL, *p = NULL, *m = NULL, *d = NULL, *e = NULL;\n    BIGNUM *b = NULL, *n = NULL, *c = NULL;\n    BN_MONT_CTX *mont = NULL;\n    char *bigstring;\n    int st = 0;\n    if (!TEST_ptr(a = BN_new())\n            || !TEST_ptr(p = BN_new())\n            || !TEST_ptr(m = BN_new())\n            || !TEST_ptr(d = BN_new())\n            || !TEST_ptr(e = BN_new())\n            || !TEST_ptr(b = BN_new())\n            || !TEST_ptr(n = BN_new())\n            || !TEST_ptr(c = BN_new())\n            || !TEST_ptr(mont = BN_MONT_CTX_new()))\n        goto err;\n    BN_bntest_rand(m, 1024, 0, 1);\n    BN_bntest_rand(a, 1024, 0, 0);\n    BN_zero(p);\n    if (!TEST_true(BN_mod_exp_mont_consttime(d, a, p, m, ctx, NULL)))\n        goto err;\n    if (!TEST_BN_eq_one(d))\n        goto err;\n    BN_hex2bn(&a,\n        "7878787878787878787878787878787878787878787878787878787878787878"\n        "7878787878787878787878787878787878787878787878787878787878787878"\n        "7878787878787878787878787878787878787878787878787878787878787878"\n        "7878787878787878787878787878787878787878787878787878787878787878");\n    BN_hex2bn(&b,\n        "095D72C08C097BA488C5E439C655A192EAFB6380073D8C2664668EDDB4060744"\n        "E16E57FB4EDB9AE10A0CEFCDC28A894F689A128379DB279D48A2E20849D68593"\n        "9B7803BCF46CEBF5C533FB0DD35B080593DE5472E3FE5DB951B8BFF9B4CB8F03"\n        "9CC638A5EE8CDD703719F8000E6A9F63BEED5F2FCD52FF293EA05A251BB4AB81");\n    BN_hex2bn(&n,\n        "D78AF684E71DB0C39CFF4E64FB9DB567132CB9C50CC98009FEB820B26F2DED9B"\n        "91B9B5E2B83AE0AE4EB4E0523CA726BFBE969B89FD754F674CE99118C3F2D1C5"\n        "D81FDC7C54E02B60262B241D53C040E99E45826ECA37A804668E690E1AFC1CA4"\n        "2C9A15D84D4954425F0B7642FC0BD9D7B24E2618D2DCC9B729D944BADACFDDAF");\n    BN_MONT_CTX_set(mont, n, ctx);\n    BN_mod_mul_montgomery(c, a, b, mont, ctx);\n    BN_mod_mul_montgomery(d, b, a, mont, ctx);\n    if (!TEST_BN_eq(c, d))\n        goto err;\n    bigstring = glue(bn1strings);\n    BN_hex2bn(&n, bigstring);\n    OPENSSL_free(bigstring);\n    bigstring = glue(bn2strings);\n    BN_hex2bn(&a, bigstring);\n    OPENSSL_free(bigstring);\n    BN_free(b);\n    b = BN_dup(a);\n    BN_MONT_CTX_set(mont, n, ctx);\n    BN_mod_mul_montgomery(c, a, a, mont, ctx);\n    BN_mod_mul_montgomery(d, a, b, mont, ctx);\n    if (!TEST_BN_eq(c, d))\n        goto err;\n    {\n        static const char *ahex[] = {\n                      "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",\n            "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",\n            "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",\n            "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",\n            "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF8FFEADBCFC4DAE7FFF908E92820306B",\n            "9544D954000000006C0000000000000000000000000000000000000000000000",\n            "00000000000000000000FF030202FFFFF8FFEBDBCFC4DAE7FFF908E92820306B",\n            "9544D954000000006C000000FF0302030000000000FFFFFFFFFFFFFFFFFFFFFF",\n            "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF01FC00FF02FFFFFFFF",\n            "00FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00FCFD",\n            "FCFFFFFFFFFF000000000000000000FF0302030000000000FFFFFFFFFFFFFFFF",\n            "FF00FCFDFDFF030202FF00000000FFFFFFFFFFFFFFFFFF00FCFDFCFFFFFFFFFF",\n            NULL\n\t};\n        static const char *nhex[] = {\n                      "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",\n            "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",\n            "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",\n            "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",\n            "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF8F8F8F8000000",\n            "00000010000000006C0000000000000000000000000000000000000000000000",\n            "00000000000000000000000000000000000000FFFFFFFFFFFFF8F8F8F8000000",\n            "00000010000000006C000000000000000000000000FFFFFFFFFFFFFFFFFFFFFF",\n            "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",\n            "00FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",\n            "FFFFFFFFFFFF000000000000000000000000000000000000FFFFFFFFFFFFFFFF",\n            "FFFFFFFFFFFFFFFFFFFF00000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",\n            NULL\n\t};\n        bigstring = glue(ahex);\n        BN_hex2bn(&a, bigstring);\n        OPENSSL_free(bigstring);\n        bigstring = glue(nhex);\n        BN_hex2bn(&n, bigstring);\n        OPENSSL_free(bigstring);\n    }\n    BN_free(b);\n    b = BN_dup(a);\n    BN_MONT_CTX_set(mont, n, ctx);\n    BN_mod_mul_montgomery(c, a, a, mont, ctx);\n    BN_mod_mul_montgomery(d, a, b, mont, ctx);\n    if (!TEST_BN_eq(c, d))\n        goto err;\n    BN_bntest_rand(p, 1024, 0, 0);\n    BN_zero(a);\n    if (!TEST_true(BN_mod_exp_mont_consttime(d, a, p, m, ctx, NULL))\n            || !TEST_BN_eq_zero(d))\n        goto err;\n    BN_one(a);\n    BN_MONT_CTX_set(mont, m, ctx);\n    if (!TEST_true(BN_from_montgomery(e, a, mont, ctx))\n            || !TEST_true(BN_mod_exp_mont_consttime(d, e, p, m, ctx, NULL))\n            || !TEST_true(BN_mod_exp_simple(a, e, p, m, ctx))\n            || !TEST_BN_eq(a, d))\n        goto err;\n    BN_bntest_rand(e, 1024, 0, 0);\n    if (!TEST_true(BN_mod_exp_mont_consttime(d, e, p, m, ctx, NULL))\n            || !TEST_true(BN_mod_exp_simple(a, e, p, m, ctx))\n            || !TEST_BN_eq(a, d))\n        goto err;\n    st = 1;\nerr:\n    BN_MONT_CTX_free(mont);\n    BN_free(a);\n    BN_free(p);\n    BN_free(m);\n    BN_free(d);\n    BN_free(e);\n    BN_free(b);\n    BN_free(n);\n    BN_free(c);\n    return st;\n}', 'static char *glue(const char *list[])\n{\n    size_t len = 0;\n    char *p, *save;\n    int i;\n    for (i = 0; list[i] != NULL; i++)\n        len += strlen(list[i]);\n    if (!TEST_ptr(p = save = OPENSSL_malloc(len + 1)))\n            return NULL;\n    for (i = 0; list[i] != NULL; i++)\n        p += strlen(strcpy(p, list[i]));\n    return save;\n}']