test/bntest.c:1893: error: BUFFER_OVERRUN_L2
  Offset: [0, 536870912] (⇐ [0, 1] + [0, 536870911]) Size: [2, 62] by call to `BN_dec2bn`.
Showing all 7 steps of the trace


test/bntest.c:1876:41: Array declaration
1874.   int test_bn2dec(BIO *bp)
1875.   {
1876.       static const char *bn2dec_tests[] = {
                                                ^
1877.           "0",
1878.           "1",

test/bntest.c:1893:14: Call
1891.   
1892.       for (i = 0; i < OSSL_NELEM(bn2dec_tests); i++) {
1893.           if (!BN_dec2bn(&bn, bn2dec_tests[i]))
                     ^
1894.               goto err;
1895.   

crypto/bn/bn_print.c:213:10: <Offset trace>
211.       }
212.   
213.       for (i = 0; i <= (INT_MAX/4) && isdigit((unsigned char)a[i]); i++)
                ^
214.           continue;
215.   

crypto/bn/bn_print.c:213:10: Assignment
  211.       }
  212.   
  213.       for (i = 0; i <= (INT_MAX/4) && isdigit((unsigned char)a[i]); i++)
                  ^
  214.           continue;
  215.   

crypto/bn/bn_print.c:199:1: <Length trace>
197.   }
198.   
199. > int BN_dec2bn(BIGNUM **bn, const char *a)
200.   {
201.       BIGNUM *ret = NULL;

crypto/bn/bn_print.c:199:1: Parameter `*a`
  197.   }
  198.   
  199. > int BN_dec2bn(BIGNUM **bn, const char *a)
  200.   {
  201.       BIGNUM *ret = NULL;

crypto/bn/bn_print.c:213:37: Array access: Offset: [0, 536870912] (⇐ [0, 1] + [0, 536870911]) Size: [2, 62] by call to `BN_dec2bn` 
  211.       }
  212.   
  213.       for (i = 0; i <= (INT_MAX/4) && isdigit((unsigned char)a[i]); i++)
                                             ^
  214.           continue;
  215.   

int BN_dec2bn(BIGNUM **bn, const char *a)
{
    BIGNUM *ret = NULL;
    BN_ULONG l = 0;
    int neg = 0, i, j;
    int num;
    if ((a == NULL) || (*a == '\0'))
        return (0);
    if (*a == '-') {
        neg = 1;
        a++;
    }
    for (i = 0; i <= (INT_MAX/4) && isdigit((unsigned char)a[i]); i++)
        continue;
    if (i == 0 || i > INT_MAX/4)
        goto err;
    num = i + neg;
    if (bn == NULL)
        return (num);
    if (*bn == NULL) {
        if ((ret = BN_new()) == NULL)
            return (0);
    } else {
        ret = *bn;
        BN_zero(ret);
    }
    if (bn_expand(ret, i * 4) == NULL)
        goto err;
    j = BN_DEC_NUM - (i % BN_DEC_NUM);
    if (j == BN_DEC_NUM)
        j = 0;
    l = 0;
    while (--i >= 0) {
        l *= 10;
        l += *a - '0';
        a++;
        if (++j == BN_DEC_NUM) {
            if (!BN_mul_word(ret, BN_DEC_CONV)
                || !BN_add_word(ret, l))
                goto err;
            l = 0;
            j = 0;
        }
    }
    bn_correct_top(ret);
    *bn = ret;
    bn_check_top(ret);
    if (ret->top != 0)
        ret->neg = neg;
    return (num);
 err:
    if (*bn == NULL)
        BN_free(ret);
    return (0);
}
['int test_bn2dec(BIO *bp)\n{\n    static const char *bn2dec_tests[] = {\n        "0",\n        "1",\n        "-1",\n        "100",\n        "-100",\n        "123456789012345678901234567890",\n        "-123456789012345678901234567890",\n        "123456789012345678901234567890123456789012345678901234567890",\n        "-123456789012345678901234567890123456789012345678901234567890",\n    };\n    int ret = 0;\n    size_t i;\n    BIGNUM *bn = NULL;\n    char *dec = NULL;\n    for (i = 0; i < OSSL_NELEM(bn2dec_tests); i++) {\n        if (!BN_dec2bn(&bn, bn2dec_tests[i]))\n            goto err;\n        dec = BN_bn2dec(bn);\n        if (dec == NULL) {\n            fprintf(stderr, "BN_bn2dec failed on %s.\\n", bn2dec_tests[i]);\n            goto err;\n        }\n        if (strcmp(dec, bn2dec_tests[i]) != 0) {\n            fprintf(stderr, "BN_bn2dec gave %s, wanted %s.\\n", dec,\n                    bn2dec_tests[i]);\n            goto err;\n        }\n        OPENSSL_free(dec);\n        dec = NULL;\n    }\n    ret = 1;\nerr:\n    BN_free(bn);\n    OPENSSL_free(dec);\n    return ret;\n}', "int BN_dec2bn(BIGNUM **bn, const char *a)\n{\n    BIGNUM *ret = NULL;\n    BN_ULONG l = 0;\n    int neg = 0, i, j;\n    int num;\n    if ((a == NULL) || (*a == '\\0'))\n        return (0);\n    if (*a == '-') {\n        neg = 1;\n        a++;\n    }\n    for (i = 0; i <= (INT_MAX/4) && isdigit((unsigned char)a[i]); i++)\n        continue;\n    if (i == 0 || i > INT_MAX/4)\n        goto err;\n    num = i + neg;\n    if (bn == NULL)\n        return (num);\n    if (*bn == NULL) {\n        if ((ret = BN_new()) == NULL)\n            return (0);\n    } else {\n        ret = *bn;\n        BN_zero(ret);\n    }\n    if (bn_expand(ret, i * 4) == NULL)\n        goto err;\n    j = BN_DEC_NUM - (i % BN_DEC_NUM);\n    if (j == BN_DEC_NUM)\n        j = 0;\n    l = 0;\n    while (--i >= 0) {\n        l *= 10;\n        l += *a - '0';\n        a++;\n        if (++j == BN_DEC_NUM) {\n            if (!BN_mul_word(ret, BN_DEC_CONV)\n                || !BN_add_word(ret, l))\n                goto err;\n            l = 0;\n            j = 0;\n        }\n    }\n    bn_correct_top(ret);\n    *bn = ret;\n    bn_check_top(ret);\n    if (ret->top != 0)\n        ret->neg = neg;\n    return (num);\n err:\n    if (*bn == NULL)\n        BN_free(ret);\n    return (0);\n}"]