test/bntest.c:1429: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_exp`.
Showing all 14 steps of the trace


test/bntest.c:1425:17: Call
1423.       if (!TEST_ptr(a = getBN(s, "A"))
1424.               || !TEST_ptr(e = getBN(s, "E"))
1425.               || !TEST_ptr(exp = getBN(s, "Exp"))
                        ^
1426.               || !TEST_ptr(ret = BN_new()))
1427.           goto err;

test/bntest.c:119:9: Call
  117.       }
  118.   
  119.       if (parseBN(&ret, hex) != (int)strlen(hex)) {
                 ^
  120.           TEST_error("Could not decode '%s'", hex);
  121.           return NULL;

test/bntest.c:100:12: Call
    98.   {
    99.       *out = NULL;
    100.       return BN_hex2bn(out, in);
                      ^
    101.   }
    102.   

crypto/bn/bn_print.c:126:1: Parameter `(*bn)->top`
      124.   }
      125.   
      126. > int BN_hex2bn(BIGNUM **bn, const char *a)
      127.   {
      128.       BIGNUM *ret = NULL;

test/bntest.c:1429:10: Call
1427.           goto err;
1428.   
1429.       if (!TEST_true(BN_exp(ret, a, e, ctx))
                 ^
1430.               || !equalBN("A ^ E", exp, ret))
1431.           goto err;

crypto/bn/bn_exp.c:41:1: Parameter `a->top`
  39.   
  40.   /* this one works - simple but works */
  41. > int BN_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
  42.   {
  43.       int i, bits, ret = 0;

crypto/bn/bn_exp.c:61:9: Call
  59.           goto err;
  60.   
  61.       if (BN_copy(v, a) == NULL)
                ^
  62.           goto err;
  63.       bits = BN_num_bits(p);

crypto/bn/bn_lib.c:323:1: <Offset trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `b->top`
    321.   }
    322.   
    323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
    324.   {
    325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: <Length trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `*a->d`
    321.   }
    322.   
    323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
    324.   {
    325.       bn_check_top(b);

crypto/bn/bn_lib.c:329:9: Call
    327.       if (a == b)
    328.           return a;
    329.       if (bn_wexpand(a, b->top) == NULL)
                   ^
    330.           return NULL;
    331.   

crypto/bn/bn_lib.c:948:1: Parameter `*a->d`
      946.   }
      947.   
      948. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
      949.   {
      950.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:333:9: Array access: Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_exp` 
    331.   
    332.       if (b->top > 0)
    333.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                   ^
    334.   
    335.       a->top = b->top;

BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
{
    bn_check_top(b);
    if (a == b)
        return a;
    if (bn_wexpand(a, b->top) == NULL)
        return NULL;
    if (b->top > 0)
        memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
    a->top = b->top;
    a->neg = b->neg;
    bn_check_top(a);
    return a;
}
['static int file_exp(STANZA *s)\n{\n    BIGNUM *a = NULL, *e = NULL, *exp = NULL, *ret = NULL;\n    int st = 0;\n    if (!TEST_ptr(a = getBN(s, "A"))\n            || !TEST_ptr(e = getBN(s, "E"))\n            || !TEST_ptr(exp = getBN(s, "Exp"))\n            || !TEST_ptr(ret = BN_new()))\n        goto err;\n    if (!TEST_true(BN_exp(ret, a, e, ctx))\n            || !equalBN("A ^ E", exp, ret))\n        goto err;\n    st = 1;\nerr:\n    BN_free(a);\n    BN_free(e);\n    BN_free(exp);\n    BN_free(ret);\n    return st;\n}', 'static BIGNUM *getBN(STANZA *s, const char *attribute)\n{\n    const char *hex;\n    BIGNUM *ret = NULL;\n    if ((hex = findattr(s, attribute)) == NULL) {\n        TEST_error("Can\'t find %s in test at line %d", attribute, s->start);\n        return NULL;\n    }\n    if (parseBN(&ret, hex) != (int)strlen(hex)) {\n        TEST_error("Could not decode \'%s\'", hex);\n        return NULL;\n    }\n    return ret;\n}', 'static int parseBN(BIGNUM **out, const char *in)\n{\n    *out = NULL;\n    return BN_hex2bn(out, in);\n}', "int BN_hex2bn(BIGNUM **bn, const char *a)\n{\n    BIGNUM *ret = NULL;\n    BN_ULONG l = 0;\n    int neg = 0, h, m, i, j, k, c;\n    int num;\n    if ((a == NULL) || (*a == '\\0'))\n        return (0);\n    if (*a == '-') {\n        neg = 1;\n        a++;\n    }\n    for (i = 0; i <= (INT_MAX/4) && isxdigit((unsigned char)a[i]); i++)\n        continue;\n    if (i == 0 || i > INT_MAX/4)\n        goto err;\n    num = i + neg;\n    if (bn == NULL)\n        return (num);\n    if (*bn == NULL) {\n        if ((ret = BN_new()) == NULL)\n            return (0);\n    } else {\n        ret = *bn;\n        BN_zero(ret);\n    }\n    if (bn_expand(ret, i * 4) == NULL)\n        goto err;\n    j = i;\n    m = 0;\n    h = 0;\n    while (j > 0) {\n        m = ((BN_BYTES * 2) <= j) ? (BN_BYTES * 2) : j;\n        l = 0;\n        for (;;) {\n            c = a[j - m];\n            k = OPENSSL_hexchar2int(c);\n            if (k < 0)\n                k = 0;\n            l = (l << 4) | k;\n            if (--m <= 0) {\n                ret->d[h++] = l;\n                break;\n            }\n        }\n        j -= (BN_BYTES * 2);\n    }\n    ret->top = h;\n    bn_correct_top(ret);\n    *bn = ret;\n    bn_check_top(ret);\n    if (ret->top != 0)\n        ret->neg = neg;\n    return (num);\n err:\n    if (*bn == NULL)\n        BN_free(ret);\n    return (0);\n}", 'int BN_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)\n{\n    int i, bits, ret = 0;\n    BIGNUM *v, *rr;\n    if (BN_get_flags(p, BN_FLG_CONSTTIME) != 0) {\n        BNerr(BN_F_BN_EXP, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);\n        return 0;\n    }\n    BN_CTX_start(ctx);\n    if ((r == a) || (r == p))\n        rr = BN_CTX_get(ctx);\n    else\n        rr = r;\n    v = BN_CTX_get(ctx);\n    if (rr == NULL || v == NULL)\n        goto err;\n    if (BN_copy(v, a) == NULL)\n        goto err;\n    bits = BN_num_bits(p);\n    if (BN_is_odd(p)) {\n        if (BN_copy(rr, a) == NULL)\n            goto err;\n    } else {\n        if (!BN_one(rr))\n            goto err;\n    }\n    for (i = 1; i < bits; i++) {\n        if (!BN_sqr(v, v, ctx))\n            goto err;\n        if (BN_is_bit_set(p, i)) {\n            if (!BN_mul(rr, rr, v, ctx))\n                goto err;\n        }\n    }\n    if (r != rr && BN_copy(r, rr) == NULL)\n        goto err;\n    ret = 1;\n err:\n    BN_CTX_end(ctx);\n    bn_check_top(r);\n    return (ret);\n}', 'BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)\n{\n    bn_check_top(b);\n    if (a == b)\n        return a;\n    if (bn_wexpand(a, b->top) == NULL)\n        return NULL;\n    if (b->top > 0)\n        memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);\n    a->top = b->top;\n    a->neg = b->neg;\n    bn_check_top(a);\n    return a;\n}', 'BIGNUM *bn_wexpand(BIGNUM *a, int words)\n{\n    return (words <= a->dmax) ? a : bn_expand2(a, words);\n}']