crypto/srp/srp_vfy.c:297: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned32 by call to `BN_bin2bn`.
Showing all 8 steps of the trace


crypto/srp/srp_vfy.c:296:8: Call
294.   		goto err;
295.   
296.   	len = t_fromb64(tmp, ch);
              ^
297.   	if ((newgN->bn = BN_bin2bn(tmp, len, NULL)))
298.   		return newgN;

crypto/srp/srp_vfy.c:98:3: Assignment
  96.   	/* if nothing valid to process we have a zero length response */
  97.   	if (i == 0)
  98.   		return 0;
           ^
  99.   	size = i;
  100.   	i = size - 1;

crypto/srp/srp_vfy.c:296:2: Assignment
294.   		goto err;
295.   
296.   	len = t_fromb64(tmp, ch);
        ^
297.   	if ((newgN->bn = BN_bin2bn(tmp, len, NULL)))
298.   		return newgN;

crypto/srp/srp_vfy.c:297:19: Call
295.   
296.   	len = t_fromb64(tmp, ch);
297.   	if ((newgN->bn = BN_bin2bn(tmp, len, NULL)))
                         ^
298.   		return newgN;
299.   

crypto/bn/bn_lib.c:582:1: <LHS trace>
580.   	}
581.   
582. > BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)
583.   	{
584.   	unsigned int i,m;

crypto/bn/bn_lib.c:582:1: Parameter `len`
  580.   	}
  581.   
  582. > BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)
  583.   	{
  584.   	unsigned int i,m;

crypto/bn/bn_lib.c:594:2: Assignment
  592.   	bn_check_top(ret);
  593.   	l=0;
  594.   	n=len;
          ^
  595.   	if (n == 0)
  596.   		{

crypto/bn/bn_lib.c:600:2: Binary operation: ([0, +oo] - 1):unsigned32 by call to `BN_bin2bn` 
  598.   		return(ret);
  599.   		}
  600.   	i=((n-1)/BN_BYTES)+1;
          ^
  601.   	m=((n-1)%(BN_BYTES));
  602.   	if (bn_wexpand(ret, (int)i) == NULL)

BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)
	{
	unsigned int i,m;
	unsigned int n;
	BN_ULONG l;
	BIGNUM  *bn = NULL;
	if (ret == NULL)
		ret = bn = BN_new();
	if (ret == NULL) return(NULL);
	bn_check_top(ret);
	l=0;
	n=len;
	if (n == 0)
		{
		ret->top=0;
		return(ret);
		}
	i=((n-1)/BN_BYTES)+1;
	m=((n-1)%(BN_BYTES));
	if (bn_wexpand(ret, (int)i) == NULL)
		{
		if (bn) BN_free(bn);
		return NULL;
		}
	ret->top=i;
	ret->neg=0;
	while (n--)
		{
		l=(l<<8L)| *(s++);
		if (m-- == 0)
			{
			ret->d[--i]=l;
			l=0;
			m=BN_BYTES-1;
			}
		}
	bn_correct_top(ret);
	return(ret);
	}
['static SRP_gN_cache *SRP_gN_new_init(const char *ch)\n\t{\n\tunsigned char tmp[MAX_LEN];\n\tint len;\n\tSRP_gN_cache *newgN = (SRP_gN_cache *)OPENSSL_malloc(sizeof(SRP_gN_cache));\n\tif (newgN == NULL)\n\t\treturn NULL;\n\tif ((newgN->b64_bn = BUF_strdup(ch)) == NULL)\n\t\tgoto err;\n\tlen = t_fromb64(tmp, ch);\n\tif ((newgN->bn = BN_bin2bn(tmp, len, NULL)))\n\t\treturn newgN;\n\tOPENSSL_free(newgN->b64_bn);\nerr:\n\tOPENSSL_free(newgN);\n\treturn NULL;\n\t}', "static int t_fromb64(unsigned char *a, const char *src)\n\t{\n\tchar *loc;\n\tint i, j;\n\tint size;\n\twhile(*src && (*src == ' ' || *src == '\\t' || *src == '\\n'))\n\t\t++src;\n\tsize = strlen(src);\n\ti = 0;\n\twhile(i < size)\n\t\t{\n\t\tloc = strchr(b64table, src[i]);\n\t\tif(loc == (char *) 0) break;\n\t\telse a[i] = loc - b64table;\n\t\t++i;\n\t\t}\n\tif (i == 0)\n\t\treturn 0;\n\tsize = i;\n\ti = size - 1;\n\tj = size;\n\twhile(1)\n\t\t{\n\t\ta[j] = a[i];\n\t\tif(--i < 0) break;\n\t\ta[j] |= (a[i] & 3) << 6;\n\t\t--j;\n\t\ta[j] = (unsigned char) ((a[i] & 0x3c) >> 2);\n\t\tif(--i < 0) break;\n\t\ta[j] |= (a[i] & 0xf) << 4;\n\t\t--j;\n\t\ta[j] = (unsigned char) ((a[i] & 0x30) >> 4);\n\t\tif(--i < 0) break;\n\t\ta[j] |= (a[i] << 2);\n\t\ta[--j] = 0;\n\t\tif(--i < 0) break;\n\t\t}\n\twhile(a[j] == 0 && j <= size) ++j;\n\ti = 0;\n\twhile (j <= size) a[i++] = a[j++];\n\treturn i;\n\t}", 'BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)\n\t{\n\tunsigned int i,m;\n\tunsigned int n;\n\tBN_ULONG l;\n\tBIGNUM  *bn = NULL;\n\tif (ret == NULL)\n\t\tret = bn = BN_new();\n\tif (ret == NULL) return(NULL);\n\tbn_check_top(ret);\n\tl=0;\n\tn=len;\n\tif (n == 0)\n\t\t{\n\t\tret->top=0;\n\t\treturn(ret);\n\t\t}\n\ti=((n-1)/BN_BYTES)+1;\n\tm=((n-1)%(BN_BYTES));\n\tif (bn_wexpand(ret, (int)i) == NULL)\n\t\t{\n\t\tif (bn) BN_free(bn);\n\t\treturn NULL;\n\t\t}\n\tret->top=i;\n\tret->neg=0;\n\twhile (n--)\n\t\t{\n\t\tl=(l<<8L)| *(s++);\n\t\tif (m-- == 0)\n\t\t\t{\n\t\t\tret->d[--i]=l;\n\t\t\tl=0;\n\t\t\tm=BN_BYTES-1;\n\t\t\t}\n\t\t}\n\tbn_correct_top(ret);\n\treturn(ret);\n\t}']