crypto/bn/bntest.c:731: error: BUFFER_OVERRUN_L3
  Offset: [-15, +oo] (⇐ [0, 1] + [-15, +oo]) Size: 65 by call to `BN_hex2bn`.
Showing all 7 steps of the trace


crypto/bn/bntest.c:731:2: Call
729.   
730.   	/* Regression test for a BN_sqr overflow bug. */
731.   	BN_hex2bn(&a,
        ^
732.   		"80000000000000008000000000000001FFFFFFFFFFFFFFFE0000000000000000");
733.   	BN_sqr(c, a, ctx);

crypto/bn/bn_print.c:183:7: <Offset trace>
181.   	if (*a == '-') { neg=1; a++; }
182.   
183.   	for (i=0; isxdigit((unsigned char) a[i]); i++)
             ^
184.   		;
185.   

crypto/bn/bn_print.c:183:7: Assignment
  181.   	if (*a == '-') { neg=1; a++; }
  182.   
  183.   	for (i=0; isxdigit((unsigned char) a[i]); i++)
               ^
  184.   		;
  185.   

crypto/bn/bn_print.c:203:2: Assignment
  201.   	if (bn_expand(ret,i*4) == NULL) goto err;
  202.   
  203.   	j=i; /* least significant 'hex' */
          ^
  204.   	m=0;
  205.   	h=0;

crypto/bn/bn_print.c:172:1: <Length trace>
170.   	}
171.   
172. > int BN_hex2bn(BIGNUM **bn, const char *a)
173.   	{
174.   	BIGNUM *ret=NULL;

crypto/bn/bn_print.c:172:1: Parameter `*a`
  170.   	}
  171.   
  172. > int BN_hex2bn(BIGNUM **bn, const char *a)
  173.   	{
  174.   	BIGNUM *ret=NULL;

crypto/bn/bn_print.c:212:6: Array access: Offset: [-15, +oo] (⇐ [0, 1] + [-15, +oo]) Size: 65 by call to `BN_hex2bn` 
  210.   		for (;;)
  211.   			{
  212.   			c=a[j-m];
              ^
  213.   			if ((c >= '0') && (c <= '9')) k=c-'0';
  214.   			else if ((c >= 'a') && (c <= 'f')) k=c-'a'+10;

int BN_hex2bn(BIGNUM **bn, const char *a)
	{
	BIGNUM *ret=NULL;
	BN_ULONG l=0;
	int neg=0,h,m,i,j,k,c;
	int num;
	if ((a == NULL) || (*a == '\0')) return(0);
	if (*a == '-') { neg=1; a++; }
	for (i=0; isxdigit((unsigned char) a[i]); i++)
		;
	num=i+neg;
	if (bn == NULL) return(num);
	if (*bn == NULL)
		{
		if ((ret=BN_new()) == NULL) return(0);
		}
	else
		{
		ret= *bn;
		BN_zero(ret);
		}
	if (bn_expand(ret,i*4) == NULL) goto err;
	j=i;
	m=0;
	h=0;
	while (j > 0)
		{
		m=((BN_BYTES*2) <= j)?(BN_BYTES*2):j;
		l=0;
		for (;;)
			{
			c=a[j-m];
			if ((c >= '0') && (c <= '9')) k=c-'0';
			else if ((c >= 'a') && (c <= 'f')) k=c-'a'+10;
			else if ((c >= 'A') && (c <= 'F')) k=c-'A'+10;
			else k=0;
			l=(l<<4)|k;
			if (--m <= 0)
				{
				ret->d[h++]=l;
				break;
				}
			}
		j-=(BN_BYTES*2);
		}
	ret->top=h;
	bn_correct_top(ret);
	ret->neg=neg;
	*bn=ret;
	bn_check_top(ret);
	return(num);
err:
	if (*bn == NULL) BN_free(ret);
	return(0);
	}
['int test_sqr(BIO *bp, BN_CTX *ctx)\n\t{\n\tBIGNUM *a,*c,*d,*e;\n\tint i, ret = 0;\n\ta = BN_new();\n\tc = BN_new();\n\td = BN_new();\n\te = BN_new();\n\tif (a == NULL || c == NULL || d == NULL || e == NULL)\n\t\t{\n\t\tgoto err;\n\t\t}\n\tfor (i=0; i<num0; i++)\n\t\t{\n\t\tBN_bntest_rand(a,40+i*10,0,0);\n\t\ta->neg=rand_neg();\n\t\tBN_sqr(c,a,ctx);\n\t\tif (bp != NULL)\n\t\t\t{\n\t\t\tif (!results)\n\t\t\t\t{\n\t\t\t\tBN_print(bp,a);\n\t\t\t\tBIO_puts(bp," * ");\n\t\t\t\tBN_print(bp,a);\n\t\t\t\tBIO_puts(bp," - ");\n\t\t\t\t}\n\t\t\tBN_print(bp,c);\n\t\t\tBIO_puts(bp,"\\n");\n\t\t\t}\n\t\tBN_div(d,e,c,a,ctx);\n\t\tBN_sub(d,d,a);\n\t\tif(!BN_is_zero(d) || !BN_is_zero(e))\n\t\t\t{\n\t\t\tfprintf(stderr,"Square test failed!\\n");\n\t\t\tgoto err;\n\t\t\t}\n\t\t}\n\tBN_hex2bn(&a,\n\t\t"80000000000000008000000000000001FFFFFFFFFFFFFFFE0000000000000000");\n\tBN_sqr(c, a, ctx);\n\tif (bp != NULL)\n\t\t{\n\t\tif (!results)\n\t\t\t{\n\t\t\tBN_print(bp,a);\n\t\t\tBIO_puts(bp," * ");\n\t\t\tBN_print(bp,a);\n\t\t\tBIO_puts(bp," - ");\n\t\t\t}\n\t\tBN_print(bp,c);\n\t\tBIO_puts(bp,"\\n");\n\t\t}\n\tBN_mul(d, a, a, ctx);\n\tif (BN_cmp(c, d))\n\t\t{\n\t\tfprintf(stderr, "Square test failed: BN_sqr and BN_mul produce "\n\t\t\t"different results!\\n");\n\t\tgoto err;\n\t\t}\n\tBN_hex2bn(&a,\n\t\t"80000000000000000000000080000001FFFFFFFE000000000000000000000000");\n\tBN_sqr(c, a, ctx);\n\tif (bp != NULL)\n\t\t{\n\t\tif (!results)\n\t\t\t{\n\t\t\tBN_print(bp,a);\n\t\t\tBIO_puts(bp," * ");\n\t\t\tBN_print(bp,a);\n\t\t\tBIO_puts(bp," - ");\n\t\t\t}\n\t\tBN_print(bp,c);\n\t\tBIO_puts(bp,"\\n");\n\t\t}\n\tBN_mul(d, a, a, ctx);\n\tif (BN_cmp(c, d))\n\t\t{\n\t\tfprintf(stderr, "Square test failed: BN_sqr and BN_mul produce "\n\t\t\t"different results!\\n");\n\t\tgoto err;\n\t\t}\n\tret = 1;\nerr:\n\tif (a != NULL) BN_free(a);\n\tif (c != NULL) BN_free(c);\n\tif (d != NULL) BN_free(d);\n\tif (e != NULL) BN_free(e);\n\treturn ret;\n\t}', "int BN_hex2bn(BIGNUM **bn, const char *a)\n\t{\n\tBIGNUM *ret=NULL;\n\tBN_ULONG l=0;\n\tint neg=0,h,m,i,j,k,c;\n\tint num;\n\tif ((a == NULL) || (*a == '\\0')) return(0);\n\tif (*a == '-') { neg=1; a++; }\n\tfor (i=0; isxdigit((unsigned char) a[i]); i++)\n\t\t;\n\tnum=i+neg;\n\tif (bn == NULL) return(num);\n\tif (*bn == NULL)\n\t\t{\n\t\tif ((ret=BN_new()) == NULL) return(0);\n\t\t}\n\telse\n\t\t{\n\t\tret= *bn;\n\t\tBN_zero(ret);\n\t\t}\n\tif (bn_expand(ret,i*4) == NULL) goto err;\n\tj=i;\n\tm=0;\n\th=0;\n\twhile (j > 0)\n\t\t{\n\t\tm=((BN_BYTES*2) <= j)?(BN_BYTES*2):j;\n\t\tl=0;\n\t\tfor (;;)\n\t\t\t{\n\t\t\tc=a[j-m];\n\t\t\tif ((c >= '0') && (c <= '9')) k=c-'0';\n\t\t\telse if ((c >= 'a') && (c <= 'f')) k=c-'a'+10;\n\t\t\telse if ((c >= 'A') && (c <= 'F')) k=c-'A'+10;\n\t\t\telse k=0;\n\t\t\tl=(l<<4)|k;\n\t\t\tif (--m <= 0)\n\t\t\t\t{\n\t\t\t\tret->d[h++]=l;\n\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t}\n\t\tj-=(BN_BYTES*2);\n\t\t}\n\tret->top=h;\n\tbn_correct_top(ret);\n\tret->neg=neg;\n\t*bn=ret;\n\tbn_check_top(ret);\n\treturn(num);\nerr:\n\tif (*bn == NULL) BN_free(ret);\n\treturn(0);\n\t}"]