crypto/rsa/rsa_sp800_56b_check.c:143: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_gcd`.
Showing all 12 steps of the trace


crypto/rsa/rsa_sp800_56b_check.c:141:15: Call
139.       ret = (gcd != NULL)
140.             /* (Step 5d) GCD(p-1, e) = 1 */
141.             && (BN_copy(p1, p) != NULL)
                     ^
142.             && BN_sub_word(p1, 1)
143.             && BN_gcd(gcd, p1, e, ctx)

crypto/bn/bn_lib.c:281:1: Parameter `a->top`
  279.   }
  280.   
  281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
  282.   {
  283.       bn_check_top(b);

crypto/rsa/rsa_sp800_56b_check.c:143:14: Call
141.             && (BN_copy(p1, p) != NULL)
142.             && BN_sub_word(p1, 1)
143.             && BN_gcd(gcd, p1, e, ctx)
                    ^
144.             && BN_is_one(gcd);
145.   

crypto/bn/bn_gcd.c:15:1: Parameter `in_a->top`
  13.   static BIGNUM *euclid(BIGNUM *a, BIGNUM *b);
  14.   
  15. > int BN_gcd(BIGNUM *r, const BIGNUM *in_a, const BIGNUM *in_b, BN_CTX *ctx)
  16.   {
  17.       BIGNUM *a, *b, *t;

crypto/bn/bn_gcd.c:29:9: Call
  27.           goto err;
  28.   
  29.       if (BN_copy(a, in_a) == NULL)
                ^
  30.           goto err;
  31.       if (BN_copy(b, in_b) == NULL)

crypto/bn/bn_lib.c:281:1: <Offset trace>
279.   }
280.   
281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
282.   {
283.       bn_check_top(b);

crypto/bn/bn_lib.c:281:1: Parameter `b->top`
    279.   }
    280.   
    281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
    282.   {
    283.       bn_check_top(b);

crypto/bn/bn_lib.c:281:1: <Length trace>
279.   }
280.   
281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
282.   {
283.       bn_check_top(b);

crypto/bn/bn_lib.c:281:1: Parameter `*a->d`
    279.   }
    280.   
    281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
    282.   {
    283.       bn_check_top(b);

crypto/bn/bn_lib.c:287:9: Call
    285.       if (a == b)
    286.           return a;
    287.       if (bn_wexpand(a, b->top) == NULL)
                   ^
    288.           return NULL;
    289.   

crypto/bn/bn_lib.c:960:1: Parameter `*a->d`
      958.   }
      959.   
      960. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
      961.   {
      962.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:291:9: Array access: Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_gcd` 
    289.   
    290.       if (b->top > 0)
    291.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                   ^
    292.   
    293.       a->neg = b->neg;

BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
{
    bn_check_top(b);
    if (a == b)
        return a;
    if (bn_wexpand(a, b->top) == NULL)
        return NULL;
    if (b->top > 0)
        memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
    a->neg = b->neg;
    a->top = b->top;
    a->flags |= b->flags & BN_FLG_FIXED_TOP;
    bn_check_top(a);
    return a;
}
['int rsa_check_prime_factor(BIGNUM *p, BIGNUM *e, int nbits, BN_CTX *ctx)\n{\n    int checks = bn_rsa_fips186_4_prime_MR_min_checks(nbits);\n    int ret = 0;\n    BIGNUM *p1 = NULL, *gcd = NULL;\n    if (BN_is_prime_fasttest_ex(p, checks, ctx, 1, NULL) != 1\n            || rsa_check_prime_factor_range(p, nbits, ctx) != 1)\n        return 0;\n    BN_CTX_start(ctx);\n    p1 = BN_CTX_get(ctx);\n    gcd = BN_CTX_get(ctx);\n    ret = (gcd != NULL)\n          && (BN_copy(p1, p) != NULL)\n          && BN_sub_word(p1, 1)\n          && BN_gcd(gcd, p1, e, ctx)\n          && BN_is_one(gcd);\n    BN_clear(p1);\n    BN_CTX_end(ctx);\n    return ret;\n}', 'BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)\n{\n    bn_check_top(b);\n    if (a == b)\n        return a;\n    if (bn_wexpand(a, b->top) == NULL)\n        return NULL;\n    if (b->top > 0)\n        memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);\n    a->neg = b->neg;\n    a->top = b->top;\n    a->flags |= b->flags & BN_FLG_FIXED_TOP;\n    bn_check_top(a);\n    return a;\n}', 'int BN_gcd(BIGNUM *r, const BIGNUM *in_a, const BIGNUM *in_b, BN_CTX *ctx)\n{\n    BIGNUM *a, *b, *t;\n    int ret = 0;\n    bn_check_top(in_a);\n    bn_check_top(in_b);\n    BN_CTX_start(ctx);\n    a = BN_CTX_get(ctx);\n    b = BN_CTX_get(ctx);\n    if (b == NULL)\n        goto err;\n    if (BN_copy(a, in_a) == NULL)\n        goto err;\n    if (BN_copy(b, in_b) == NULL)\n        goto err;\n    a->neg = 0;\n    b->neg = 0;\n    if (BN_cmp(a, b) < 0) {\n        t = a;\n        a = b;\n        b = t;\n    }\n    t = euclid(a, b);\n    if (t == NULL)\n        goto err;\n    if (BN_copy(r, t) == NULL)\n        goto err;\n    ret = 1;\n err:\n    BN_CTX_end(ctx);\n    bn_check_top(r);\n    return ret;\n}', 'BIGNUM *bn_wexpand(BIGNUM *a, int words)\n{\n    return (words <= a->dmax) ? a : bn_expand2(a, words);\n}']