test/bntest.c:486: error: BUFFER_OVERRUN_L3
  Offset: [54, +oo] (⇐ [0, +oo] + [54, 64]) Size: [1, +oo] by call to `parse_bigBN`.
Showing all 10 steps of the trace


test/bntest.c:455:37: Array declaration
453.       /* Regression test for carry bug in bn_sqrx8x_internal */
454.       {
455.           static const char *ahex[] = {
                                           ^
456.                         "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
457.               "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",

test/bntest.c:486:15: Call
484.           };
485.   
486.           if (!(TEST_true(parse_bigBN(&a, ahex))
                     ^
487.                   && TEST_true(parse_bigBN(&n, nhex))))
488.               goto err;

test/bntest.c:73:1: Parameter `(*bn_strings)->strlen`
  71.    * Parse BIGNUM from sparse hex-strings, return |BN_hex2bn| result.
  72.    */
  73. > static int parse_bigBN(BIGNUM **out, const char *bn_strings[])
  74.   {
  75.       char *bigstring = glue_strings(bn_strings, NULL);

test/bntest.c:75:23: Call
  73.   static int parse_bigBN(BIGNUM **out, const char *bn_strings[])
  74.   {
  75.       char *bigstring = glue_strings(bn_strings, NULL);
                              ^
  76.       int ret = BN_hex2bn(out, bigstring);
  77.   

test/testutil/driver.c:430:1: <Offset trace>
428.    * Optionally return the whole length of this string in |out_len|
429.    */
430. > char *glue_strings(const char *list[], size_t *out_len)
431.   {
432.       size_t len = 0;

test/testutil/driver.c:430:1: Parameter `(*list)->strlen`
    428.    * Optionally return the whole length of this string in |out_len|
    429.    */
    430. > char *glue_strings(const char *list[], size_t *out_len)
    431.   {
    432.       size_t len = 0;

test/testutil/driver.c:430:1: <Length trace>
428.    * Optionally return the whole length of this string in |out_len|
429.    */
430. > char *glue_strings(const char *list[], size_t *out_len)
431.   {
432.       size_t len = 0;

test/testutil/driver.c:430:1: Parameter `(*list)->strlen`
    428.    * Optionally return the whole length of this string in |out_len|
    429.    */
    430. > char *glue_strings(const char *list[], size_t *out_len)
    431.   {
    432.       size_t len = 0;

test/testutil/driver.c:446:9: Assignment
    444.   
    445.       for (i = 0; list[i] != NULL; i++)
    446.           p += strlen(strcpy(p, list[i]));
                   ^
    447.   
    448.       return ret;

test/testutil/driver.c:446:21: Array access: Offset: [54, +oo] (⇐ [0, +oo] + [54, 64]) Size: [1, +oo] by call to `parse_bigBN` 
    444.   
    445.       for (i = 0; list[i] != NULL; i++)
    446.           p += strlen(strcpy(p, list[i]));
                               ^
    447.   
    448.       return ret;

char *glue_strings(const char *list[], size_t *out_len)
{
    size_t len = 0;
    char *p, *ret;
    int i;
    for (i = 0; list[i] != NULL; i++)
        len += strlen(list[i]);
    if (out_len != NULL)
        *out_len = len;
    if (!TEST_ptr(ret = p = OPENSSL_malloc(len + 1)))
        return NULL;
    for (i = 0; list[i] != NULL; i++)
        p += strlen(strcpy(p, list[i]));
    return ret;
}
['static int test_modexp_mont5(void)\n{\n    BIGNUM *a = NULL, *p = NULL, *m = NULL, *d = NULL, *e = NULL;\n    BIGNUM *b = NULL, *n = NULL, *c = NULL;\n    BN_MONT_CTX *mont = NULL;\n    int st = 0;\n    if (!TEST_ptr(a = BN_new())\n            || !TEST_ptr(p = BN_new())\n            || !TEST_ptr(m = BN_new())\n            || !TEST_ptr(d = BN_new())\n            || !TEST_ptr(e = BN_new())\n            || !TEST_ptr(b = BN_new())\n            || !TEST_ptr(n = BN_new())\n            || !TEST_ptr(c = BN_new())\n            || !TEST_ptr(mont = BN_MONT_CTX_new()))\n        goto err;\n    if (!(TEST_true(BN_bntest_rand(m, 1024, 0, 1))\n            && TEST_true(BN_bntest_rand(a, 1024, 0, 0))))\n        goto err;\n    BN_zero(p);\n    if (!TEST_true(BN_mod_exp_mont_consttime(d, a, p, m, ctx, NULL)))\n        goto err;\n    if (!TEST_BN_eq_one(d))\n        goto err;\n    if (!(TEST_true(BN_hex2bn(&a,\n        "7878787878787878787878787878787878787878787878787878787878787878"\n        "7878787878787878787878787878787878787878787878787878787878787878"\n        "7878787878787878787878787878787878787878787878787878787878787878"\n        "7878787878787878787878787878787878787878787878787878787878787878"))\n        && TEST_true(BN_hex2bn(&b,\n        "095D72C08C097BA488C5E439C655A192EAFB6380073D8C2664668EDDB4060744"\n        "E16E57FB4EDB9AE10A0CEFCDC28A894F689A128379DB279D48A2E20849D68593"\n        "9B7803BCF46CEBF5C533FB0DD35B080593DE5472E3FE5DB951B8BFF9B4CB8F03"\n        "9CC638A5EE8CDD703719F8000E6A9F63BEED5F2FCD52FF293EA05A251BB4AB81"))\n        && TEST_true(BN_hex2bn(&n,\n        "D78AF684E71DB0C39CFF4E64FB9DB567132CB9C50CC98009FEB820B26F2DED9B"\n        "91B9B5E2B83AE0AE4EB4E0523CA726BFBE969B89FD754F674CE99118C3F2D1C5"\n        "D81FDC7C54E02B60262B241D53C040E99E45826ECA37A804668E690E1AFC1CA4"\n        "2C9A15D84D4954425F0B7642FC0BD9D7B24E2618D2DCC9B729D944BADACFDDAF"))))\n        goto err;\n    if (!(TEST_true(BN_MONT_CTX_set(mont, n, ctx))\n            && TEST_true(BN_mod_mul_montgomery(c, a, b, mont, ctx))\n            && TEST_true(BN_mod_mul_montgomery(d, b, a, mont, ctx))\n            && TEST_BN_eq(c, d)))\n        goto err;\n    if (!(TEST_true(parse_bigBN(&n, bn1strings))\n            && TEST_true(parse_bigBN(&a, bn2strings))))\n        goto err;\n    BN_free(b);\n    if (!(TEST_ptr(b = BN_dup(a))\n            && TEST_true(BN_MONT_CTX_set(mont, n, ctx))\n            && TEST_true(BN_mod_mul_montgomery(c, a, a, mont, ctx))\n            && TEST_true(BN_mod_mul_montgomery(d, a, b, mont, ctx))\n            && TEST_BN_eq(c, d)))\n        goto err;\n    {\n        static const char *ahex[] = {\n                      "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",\n            "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",\n            "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",\n            "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",\n            "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF8FFEADBCFC4DAE7FFF908E92820306B",\n            "9544D954000000006C0000000000000000000000000000000000000000000000",\n            "00000000000000000000FF030202FFFFF8FFEBDBCFC4DAE7FFF908E92820306B",\n            "9544D954000000006C000000FF0302030000000000FFFFFFFFFFFFFFFFFFFFFF",\n            "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF01FC00FF02FFFFFFFF",\n            "00FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00FCFD",\n            "FCFFFFFFFFFF000000000000000000FF0302030000000000FFFFFFFFFFFFFFFF",\n            "FF00FCFDFDFF030202FF00000000FFFFFFFFFFFFFFFFFF00FCFDFCFFFFFFFFFF",\n            NULL\n        };\n        static const char *nhex[] = {\n                      "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",\n            "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",\n            "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",\n            "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",\n            "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF8F8F8F8000000",\n            "00000010000000006C0000000000000000000000000000000000000000000000",\n            "00000000000000000000000000000000000000FFFFFFFFFFFFF8F8F8F8000000",\n            "00000010000000006C000000000000000000000000FFFFFFFFFFFFFFFFFFFFFF",\n            "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",\n            "00FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",\n            "FFFFFFFFFFFF000000000000000000000000000000000000FFFFFFFFFFFFFFFF",\n            "FFFFFFFFFFFFFFFFFFFF00000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",\n            NULL\n        };\n        if (!(TEST_true(parse_bigBN(&a, ahex))\n                && TEST_true(parse_bigBN(&n, nhex))))\n            goto err;\n    }\n    BN_free(b);\n    if (!(TEST_ptr(b = BN_dup(a))\n            && TEST_true(BN_MONT_CTX_set(mont, n, ctx))))\n        goto err;\n    if (!TEST_true(BN_mod_mul_montgomery(c, a, a, mont, ctx))\n            || !TEST_true(BN_mod_mul_montgomery(d, a, b, mont, ctx))\n            || !TEST_BN_eq(c, d))\n        goto err;\n    if (!(TEST_true(BN_hex2bn(&a,\n        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"\n        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"\n        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"))\n         && TEST_true(BN_hex2bn(&n,\n        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"\n        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"))\n        && TEST_true(BN_MONT_CTX_set(mont, n, ctx))\n        && TEST_false(BN_mod_mul_montgomery(d, a, a, mont, ctx))))\n        goto err;\n    if (!(TEST_true(BN_hex2bn(&a,\n        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"\n        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"\n        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"\n        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF2020202020DF"))\n        && TEST_true(BN_hex2bn(&b,\n        "2020202020202020202020202020202020202020202020202020202020202020"\n        "2020202020202020202020202020202020202020202020202020202020202020"\n        "20202020202020FF202020202020202020202020202020202020202020202020"\n        "2020202020202020202020202020202020202020202020202020202020202020"))\n        && TEST_true(BN_hex2bn(&n,\n        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"\n        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"\n        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"\n        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF2020202020FF"))\n        && TEST_true(BN_MONT_CTX_set(mont, n, ctx))\n        && TEST_true(BN_mod_exp_mont_consttime(c, a, b, n, ctx, mont))\n        && TEST_true(BN_mod_exp_mont(d, a, b, n, ctx, mont))\n        && TEST_BN_eq(c, d)))\n        goto err;\n    if (!(TEST_true(BN_hex2bn(&a,\n        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"\n        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"\n        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"\n        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF2020202020DF"))\n        && TEST_true(BN_hex2bn(&b,\n        "1FA53F26F8811C58BE0357897AA5E165693230BC9DF5F01DFA6A2D59229EC69D"\n        "9DE6A89C36E3B6957B22D6FAAD5A3C73AE587B710DBE92E83D3A9A3339A085CB"\n        "B58F508CA4F837924BB52CC1698B7FDC2FD74362456A595A5B58E38E38E38E38"\n        "E38E38E38E38E38E38E38E38E38E38E38E38E38E38E38E38E38E38E38E38E38E"))\n        && TEST_true(BN_hex2bn(&n,\n        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"\n        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"\n        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"\n        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF2020202020DF"))\n        && TEST_true(BN_MONT_CTX_set(mont, n, ctx))\n        && TEST_true(BN_mod_exp_mont_consttime(c, a, b, n, ctx, mont))))\n        goto err;\n    BN_zero(d);\n    if (!TEST_BN_eq(c, d))\n        goto err;\n    if (!TEST_true(BN_bntest_rand(p, 1024, 0, 0)))\n        goto err;\n    BN_zero(a);\n    if (!TEST_true(BN_mod_exp_mont_consttime(d, a, p, m, ctx, NULL))\n            || !TEST_BN_eq_zero(d))\n        goto err;\n    if (!(TEST_true(BN_one(a))\n            && TEST_true(BN_MONT_CTX_set(mont, m, ctx))))\n        goto err;\n    if (!TEST_true(BN_from_montgomery(e, a, mont, ctx))\n            || !TEST_true(BN_mod_exp_mont_consttime(d, e, p, m, ctx, NULL))\n            || !TEST_true(BN_mod_exp_simple(a, e, p, m, ctx))\n            || !TEST_BN_eq(a, d))\n        goto err;\n    if (!(TEST_true(BN_bntest_rand(e, 1024, 0, 0))\n            && TEST_true(BN_mod_exp_mont_consttime(d, e, p, m, ctx, NULL))\n            && TEST_true(BN_mod_exp_simple(a, e, p, m, ctx))\n            && TEST_BN_eq(a, d)))\n        goto err;\n    st = 1;\n err:\n    BN_MONT_CTX_free(mont);\n    BN_free(a);\n    BN_free(p);\n    BN_free(m);\n    BN_free(d);\n    BN_free(e);\n    BN_free(b);\n    BN_free(n);\n    BN_free(c);\n    return st;\n}', 'static int parse_bigBN(BIGNUM **out, const char *bn_strings[])\n{\n    char *bigstring = glue_strings(bn_strings, NULL);\n    int ret = BN_hex2bn(out, bigstring);\n    OPENSSL_free(bigstring);\n    return ret;\n}', 'char *glue_strings(const char *list[], size_t *out_len)\n{\n    size_t len = 0;\n    char *p, *ret;\n    int i;\n    for (i = 0; list[i] != NULL; i++)\n        len += strlen(list[i]);\n    if (out_len != NULL)\n        *out_len = len;\n    if (!TEST_ptr(ret = p = OPENSSL_malloc(len + 1)))\n        return NULL;\n    for (i = 0; list[i] != NULL; i++)\n        p += strlen(strcpy(p, list[i]));\n    return ret;\n}']