crypto/ec/ecx_meth.c:96: error: BUFFER_OVERRUN_L3
  Offset: 55 Size: [32, 57].
Showing all 10 steps of the trace


crypto/ec/ecx_meth.c:79:34: <Length trace>
77.           memcpy(pubkey, p, plen);
78.       } else {
79.           privkey = key->privkey = OPENSSL_secure_malloc(KEYLENID(id));
                                       ^
80.           if (privkey == NULL) {
81.               ECerr(EC_F_ECX_KEY_OP, ERR_R_MALLOC_FAILURE);

crypto/ec/ecx_meth.c:79:34: Assignment
77.           memcpy(pubkey, p, plen);
78.       } else {
79.           privkey = key->privkey = OPENSSL_secure_malloc(KEYLENID(id));
                                       ^
80.           if (privkey == NULL) {
81.               ECerr(EC_F_ECX_KEY_OP, ERR_R_MALLOC_FAILURE);

crypto/ec/ecx_meth.c:79:34: Call
77.           memcpy(pubkey, p, plen);
78.       } else {
79.           privkey = key->privkey = OPENSSL_secure_malloc(KEYLENID(id));
                                       ^
80.           if (privkey == NULL) {
81.               ECerr(EC_F_ECX_KEY_OP, ERR_R_MALLOC_FAILURE);

crypto/mem_sec.c:116:1: Parameter `num`
  114.   }
  115.   
  116. > void *CRYPTO_secure_malloc(size_t num, const char *file, int line)
  117.   {
  118.   #ifdef IMPLEMENTED

crypto/mem_sec.c:123:16: Call
  121.   
  122.       if (!secure_mem_initialized) {
  123.           return CRYPTO_malloc(num, file, line);
                        ^
  124.       }
  125.       CRYPTO_THREAD_write_lock(sec_malloc_lock);

crypto/mem.c:201:9: Assignment
    199.   
    200.       if (num == 0)
    201.           return NULL;
                   ^
    202.   
    203.       FAILTEST();

crypto/mem_sec.c:123:9: Assignment
  121.   
  122.       if (!secure_mem_initialized) {
  123.           return CRYPTO_malloc(num, file, line);
                 ^
  124.       }
  125.       CRYPTO_THREAD_write_lock(sec_malloc_lock);

crypto/ec/ecx_meth.c:79:19: Assignment
77.           memcpy(pubkey, p, plen);
78.       } else {
79.           privkey = key->privkey = OPENSSL_secure_malloc(KEYLENID(id));
                        ^
80.           if (privkey == NULL) {
81.               ECerr(EC_F_ECX_KEY_OP, ERR_R_MALLOC_FAILURE);

crypto/ec/ecx_meth.c:79:9: Assignment
77.           memcpy(pubkey, p, plen);
78.       } else {
79.           privkey = key->privkey = OPENSSL_secure_malloc(KEYLENID(id));
              ^
80.           if (privkey == NULL) {
81.               ECerr(EC_F_ECX_KEY_OP, ERR_R_MALLOC_FAILURE);

crypto/ec/ecx_meth.c:96:17: Array access: Offset: 55 Size: [32, 57]
94.               } else if (id == EVP_PKEY_X448) {
95.                   privkey[0] &= 252;
96.                   privkey[X448_KEYLEN - 1] |= 128;
                      ^
97.               }
98.           } else {

static int ecx_key_op(EVP_PKEY *pkey, int id, const X509_ALGOR *palg,
                      const unsigned char *p, int plen, ecx_key_op_t op)
{
    ECX_KEY *key = NULL;
    unsigned char *privkey, *pubkey;
    if (op != KEY_OP_KEYGEN) {
        if (palg != NULL) {
            int ptype;
            X509_ALGOR_get0(NULL, &ptype, NULL, palg);
            if (ptype != V_ASN1_UNDEF) {
                ECerr(EC_F_ECX_KEY_OP, EC_R_INVALID_ENCODING);
                return 0;
            }
        }
        if (p == NULL || plen != KEYLENID(id)) {
            ECerr(EC_F_ECX_KEY_OP, EC_R_INVALID_ENCODING);
            return 0;
        }
    }
    key = OPENSSL_zalloc(sizeof(*key));
    if (key == NULL) {
        ECerr(EC_F_ECX_KEY_OP, ERR_R_MALLOC_FAILURE);
        return 0;
    }
    pubkey = key->pubkey;
    if (op == KEY_OP_PUBLIC) {
        memcpy(pubkey, p, plen);
    } else {
        privkey = key->privkey = OPENSSL_secure_malloc(KEYLENID(id));
        if (privkey == NULL) {
            ECerr(EC_F_ECX_KEY_OP, ERR_R_MALLOC_FAILURE);
            goto err;
        }
        if (op == KEY_OP_KEYGEN) {
            if (RAND_priv_bytes(privkey, KEYLENID(id)) <= 0) {
                OPENSSL_secure_free(privkey);
                key->privkey = NULL;
                goto err;
            }
            if (id == EVP_PKEY_X25519) {
                privkey[0] &= 248;
                privkey[X25519_KEYLEN - 1] &= 127;
                privkey[X25519_KEYLEN - 1] |= 64;
            } else if (id == EVP_PKEY_X448) {
                privkey[0] &= 252;
                privkey[X448_KEYLEN - 1] |= 128;
            }
        } else {
            memcpy(privkey, p, KEYLENID(id));
        }
        switch (id) {
        case EVP_PKEY_X25519:
            X25519_public_from_private(pubkey, privkey);
            break;
        case EVP_PKEY_ED25519:
            ED25519_public_from_private(pubkey, privkey);
            break;
        case EVP_PKEY_X448:
            X448_public_from_private(pubkey, privkey);
            break;
        case EVP_PKEY_ED448:
            ED448_public_from_private(pubkey, privkey);
            break;
        }
    }
    EVP_PKEY_assign(pkey, id, key);
    return 1;
 err:
    OPENSSL_free(key);
    return 0;
}
['static int ecx_key_op(EVP_PKEY *pkey, int id, const X509_ALGOR *palg,\n                      const unsigned char *p, int plen, ecx_key_op_t op)\n{\n    ECX_KEY *key = NULL;\n    unsigned char *privkey, *pubkey;\n    if (op != KEY_OP_KEYGEN) {\n        if (palg != NULL) {\n            int ptype;\n            X509_ALGOR_get0(NULL, &ptype, NULL, palg);\n            if (ptype != V_ASN1_UNDEF) {\n                ECerr(EC_F_ECX_KEY_OP, EC_R_INVALID_ENCODING);\n                return 0;\n            }\n        }\n        if (p == NULL || plen != KEYLENID(id)) {\n            ECerr(EC_F_ECX_KEY_OP, EC_R_INVALID_ENCODING);\n            return 0;\n        }\n    }\n    key = OPENSSL_zalloc(sizeof(*key));\n    if (key == NULL) {\n        ECerr(EC_F_ECX_KEY_OP, ERR_R_MALLOC_FAILURE);\n        return 0;\n    }\n    pubkey = key->pubkey;\n    if (op == KEY_OP_PUBLIC) {\n        memcpy(pubkey, p, plen);\n    } else {\n        privkey = key->privkey = OPENSSL_secure_malloc(KEYLENID(id));\n        if (privkey == NULL) {\n            ECerr(EC_F_ECX_KEY_OP, ERR_R_MALLOC_FAILURE);\n            goto err;\n        }\n        if (op == KEY_OP_KEYGEN) {\n            if (RAND_priv_bytes(privkey, KEYLENID(id)) <= 0) {\n                OPENSSL_secure_free(privkey);\n                key->privkey = NULL;\n                goto err;\n            }\n            if (id == EVP_PKEY_X25519) {\n                privkey[0] &= 248;\n                privkey[X25519_KEYLEN - 1] &= 127;\n                privkey[X25519_KEYLEN - 1] |= 64;\n            } else if (id == EVP_PKEY_X448) {\n                privkey[0] &= 252;\n                privkey[X448_KEYLEN - 1] |= 128;\n            }\n        } else {\n            memcpy(privkey, p, KEYLENID(id));\n        }\n        switch (id) {\n        case EVP_PKEY_X25519:\n            X25519_public_from_private(pubkey, privkey);\n            break;\n        case EVP_PKEY_ED25519:\n            ED25519_public_from_private(pubkey, privkey);\n            break;\n        case EVP_PKEY_X448:\n            X448_public_from_private(pubkey, privkey);\n            break;\n        case EVP_PKEY_ED448:\n            ED448_public_from_private(pubkey, privkey);\n            break;\n        }\n    }\n    EVP_PKEY_assign(pkey, id, key);\n    return 1;\n err:\n    OPENSSL_free(key);\n    return 0;\n}', 'void *CRYPTO_secure_malloc(size_t num, const char *file, int line)\n{\n#ifdef IMPLEMENTED\n    void *ret;\n    size_t actual_size;\n    if (!secure_mem_initialized) {\n        return CRYPTO_malloc(num, file, line);\n    }\n    CRYPTO_THREAD_write_lock(sec_malloc_lock);\n    ret = sh_malloc(num);\n    actual_size = ret ? sh_actual_size(ret) : 0;\n    secure_mem_used += actual_size;\n    CRYPTO_THREAD_unlock(sec_malloc_lock);\n    return ret;\n#else\n    return CRYPTO_malloc(num, file, line);\n#endif\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    INCREMENT(malloc_count);\n    if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)\n        return malloc_impl(num, file, line);\n    if (num == 0)\n        return NULL;\n    FAILTEST();\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    (void)(file); (void)(line);\n    ret = malloc(num);\n#endif\n    return ret;\n}']