crypto/ec/ec2_oct.c:305: error: BUFFER_OVERRUN_L3
  Offset: [16, +oo] (⇐ 1 + [15, +oo]) Size: [0, 8388607] by call to `EC_POINT_set_compressed_coordinates`.
Showing all 27 steps of the trace


crypto/ec/ec2_oct.c:297:10: Call
295.           goto err;
296.   
297.       if (!BN_bin2bn(buf + 1, field_len, x))
                ^
298.           goto err;
299.       if (BN_num_bits(x) > m) {

crypto/bn/bn_lib.c:374:1: Parameter `ret->top`
  372.   }
  373.   
  374. > BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)
  375.   {
  376.       unsigned int i, m;

crypto/ec/ec2_oct.c:305:14: Call
303.   
304.       if (form == POINT_CONVERSION_COMPRESSED) {
305.           if (!EC_POINT_set_compressed_coordinates(group, point, x, y_bit, ctx))
                    ^
306.               goto err;
307.       } else {

crypto/ec/ec_oct.c:18:1: Parameter `x->top`
  16.   #include "ec_lcl.h"
  17.   
  18. > int EC_POINT_set_compressed_coordinates(const EC_GROUP *group, EC_POINT *point,
  19.                                           const BIGNUM *x, int y_bit, BN_CTX *ctx)
  20.   {

crypto/ec/ec_oct.c:34:20: Call
  32.       if (group->meth->flags & EC_FLAGS_DEFAULT_OCT) {
  33.           if (group->meth->field_type == NID_X9_62_prime_field)
  34.               return ec_GFp_simple_set_compressed_coordinates(group, point, x,
                           ^
  35.                                                               y_bit, ctx);
  36.           else

crypto/ec/ecp_oct.c:37:12: Call
    35.   
    36.       BN_CTX_start(ctx);
    37.       tmp1 = BN_CTX_get(ctx);
                     ^
    38.       tmp2 = BN_CTX_get(ctx);
    39.       x = BN_CTX_get(ctx);

crypto/bn/bn_ctx.c:221:5: Call
      219.       }
      220.       /* OK, make sure the returned bignum is "zero" */
      221.       BN_zero(ret);
                 ^
      222.       /* clear BN_FLG_CONSTTIME if leaked from previous frames */
      223.       ret->flags &= (~BN_FLG_CONSTTIME);

crypto/bn/bn_lib.c:361:1: Parameter `*a->d`
        359.   }
        360.   
        361. > int BN_set_word(BIGNUM *a, BN_ULONG w)
        362.   {
        363.       bn_check_top(a);

crypto/bn/bn_lib.c:364:9: Call
        362.   {
        363.       bn_check_top(a);
        364.       if (bn_expand(a, (int)sizeof(BN_ULONG) * 8) == NULL)
                       ^
        365.           return 0;
        366.       a->neg = 0;

crypto/bn/bn_lcl.h:660:1: Parameter `*a->d`
          658.                            const BIGNUM *add, const BIGNUM *rem, BN_CTX *ctx);
          659.   
          660. > static ossl_inline BIGNUM *bn_expand(BIGNUM *a, int bits)
          661.   {
          662.       if (bits > (INT_MAX - BN_BITS2 + 1))

crypto/ec/ecp_oct.c:60:14: Call
    58.               goto err;
    59.       } else {
    60.           if (!BN_mod_sqr(tmp2, x_, group->field, ctx))
                       ^
    61.               goto err;
    62.           if (!BN_mod_mul(tmp1, tmp2, x_, group->field, ctx))

crypto/bn/bn_mod.c:222:1: Parameter `*r->d`
      220.   }
      221.   
      222. > int BN_mod_sqr(BIGNUM *r, const BIGNUM *a, const BIGNUM *m, BN_CTX *ctx)
      223.   {
      224.       if (!BN_sqr(r, a, ctx))

crypto/bn/bn_mod.c:224:10: Call
      222.   int BN_mod_sqr(BIGNUM *r, const BIGNUM *a, const BIGNUM *m, BN_CTX *ctx)
      223.   {
      224.       if (!BN_sqr(r, a, ctx))
                      ^
      225.           return 0;
      226.       /* r->neg == 0,  thus we don't need BN_nnmod */

crypto/bn/bn_sqr.c:17:1: Parameter `*r->d`
        15.    * I've just gone over this and it is now %20 faster on x86 - eay - 27 Jun 96
        16.    */
        17. > int BN_sqr(BIGNUM *r, const BIGNUM *a, BN_CTX *ctx)
        18.   {
        19.       int ret = bn_sqr_fixed_top(r, a, ctx);

crypto/bn/bn_sqr.c:19:15: Call
        17.   int BN_sqr(BIGNUM *r, const BIGNUM *a, BN_CTX *ctx)
        18.   {
        19.       int ret = bn_sqr_fixed_top(r, a, ctx);
                            ^
        20.   
        21.       bn_correct_top(r);

crypto/bn/bn_sqr.c:27:1: Parameter `a->top`
          25.   }
          26.   
          27. > int bn_sqr_fixed_top(BIGNUM *r, const BIGNUM *a, BN_CTX *ctx)
          28.   {
          29.       int max, al;

crypto/bn/bn_sqr.c:35:5: Assignment
          33.       bn_check_top(a);
          34.   
          35.       al = a->top;
                    ^
          36.       if (al <= 0) {
          37.           r->top = 0;

crypto/bn/bn_sqr.c:84:17: Call
          82.                   if (bn_wexpand(tmp, max) == NULL)
          83.                       goto err;
          84.                   bn_sqr_normal(rr->d, a->d, al, tmp->d);
                                ^
          85.               }
          86.           }

crypto/bn/bn_sqr.c:109:1: <Offset trace>
107.   
108.   /* tmp must have 2*n words */
109. > void bn_sqr_normal(BN_ULONG *r, const BN_ULONG *a, int n, BN_ULONG *tmp)
110.   {
111.       int i, j, max;

crypto/bn/bn_sqr.c:109:1: Parameter `n`
            107.   
            108.   /* tmp must have 2*n words */
            109. > void bn_sqr_normal(BN_ULONG *r, const BN_ULONG *a, int n, BN_ULONG *tmp)
            110.   {
            111.       int i, j, max;

crypto/bn/bn_sqr.c:120:5: Assignment
            118.       rp[0] = rp[max - 1] = 0;
            119.       rp++;
            120.       j = n;
                       ^
            121.   
            122.       if (--j > 0) {

crypto/bn/bn_sqr.c:122:9: Assignment
            120.       j = n;
            121.   
            122.       if (--j > 0) {
                           ^
            123.           ap++;
            124.           rp[j] = bn_mul_words(rp, ap, j, ap[-1]);

crypto/bn/bn_sqr.c:109:1: <Length trace>
107.   
108.   /* tmp must have 2*n words */
109. > void bn_sqr_normal(BN_ULONG *r, const BN_ULONG *a, int n, BN_ULONG *tmp)
110.   {
111.       int i, j, max;

crypto/bn/bn_sqr.c:109:1: Parameter `*r`
            107.   
            108.   /* tmp must have 2*n words */
            109. > void bn_sqr_normal(BN_ULONG *r, const BN_ULONG *a, int n, BN_ULONG *tmp)
            110.   {
            111.       int i, j, max;

crypto/bn/bn_sqr.c:117:5: Assignment
            115.       max = n * 2;
            116.       ap = a;
            117.       rp = r;
                       ^
            118.       rp[0] = rp[max - 1] = 0;
            119.       rp++;

crypto/bn/bn_sqr.c:119:5: Assignment
            117.       rp = r;
            118.       rp[0] = rp[max - 1] = 0;
            119.       rp++;
                       ^
            120.       j = n;
            121.   

crypto/bn/bn_sqr.c:124:9: Array access: Offset: [16, +oo] (⇐ 1 + [15, +oo]) Size: [0, 8388607] by call to `EC_POINT_set_compressed_coordinates` 
            122.       if (--j > 0) {
            123.           ap++;
            124.           rp[j] = bn_mul_words(rp, ap, j, ap[-1]);
                           ^
            125.           rp += 2;
            126.       }

void bn_sqr_normal(BN_ULONG *r, const BN_ULONG *a, int n, BN_ULONG *tmp)
{
    int i, j, max;
    const BN_ULONG *ap;
    BN_ULONG *rp;
    max = n * 2;
    ap = a;
    rp = r;
    rp[0] = rp[max - 1] = 0;
    rp++;
    j = n;
    if (--j > 0) {
        ap++;
        rp[j] = bn_mul_words(rp, ap, j, ap[-1]);
        rp += 2;
    }
    for (i = n - 2; i > 0; i--) {
        j--;
        ap++;
        rp[j] = bn_mul_add_words(rp, ap, j, ap[-1]);
        rp += 2;
    }
    bn_add_words(r, r, r, max);
    bn_sqr_words(tmp, a, n);
    bn_add_words(r, r, tmp, max);
}
['int ec_GF2m_simple_oct2point(const EC_GROUP *group, EC_POINT *point,\n                             const unsigned char *buf, size_t len,\n                             BN_CTX *ctx)\n{\n    point_conversion_form_t form;\n    int y_bit, m;\n    BN_CTX *new_ctx = NULL;\n    BIGNUM *x, *y, *yxi;\n    size_t field_len, enc_len;\n    int ret = 0;\n    if (len == 0) {\n        ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_BUFFER_TOO_SMALL);\n        return 0;\n    }\n    form = buf[0];\n    y_bit = form & 1;\n    form = form & ~1U;\n    if ((form != 0) && (form != POINT_CONVERSION_COMPRESSED)\n        && (form != POINT_CONVERSION_UNCOMPRESSED)\n        && (form != POINT_CONVERSION_HYBRID)) {\n        ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);\n        return 0;\n    }\n    if ((form == 0 || form == POINT_CONVERSION_UNCOMPRESSED) && y_bit) {\n        ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);\n        return 0;\n    }\n    if (form == 0) {\n        if (len != 1) {\n            ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);\n            return 0;\n        }\n        return EC_POINT_set_to_infinity(group, point);\n    }\n    m = EC_GROUP_get_degree(group);\n    field_len = (m + 7) / 8;\n    enc_len =\n        (form ==\n         POINT_CONVERSION_COMPRESSED) ? 1 + field_len : 1 + 2 * field_len;\n    if (len != enc_len) {\n        ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);\n        return 0;\n    }\n    if (ctx == NULL) {\n        ctx = new_ctx = BN_CTX_new();\n        if (ctx == NULL)\n            return 0;\n    }\n    BN_CTX_start(ctx);\n    x = BN_CTX_get(ctx);\n    y = BN_CTX_get(ctx);\n    yxi = BN_CTX_get(ctx);\n    if (yxi == NULL)\n        goto err;\n    if (!BN_bin2bn(buf + 1, field_len, x))\n        goto err;\n    if (BN_num_bits(x) > m) {\n        ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);\n        goto err;\n    }\n    if (form == POINT_CONVERSION_COMPRESSED) {\n        if (!EC_POINT_set_compressed_coordinates(group, point, x, y_bit, ctx))\n            goto err;\n    } else {\n        if (!BN_bin2bn(buf + 1 + field_len, field_len, y))\n            goto err;\n        if (BN_num_bits(y) > m) {\n            ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);\n            goto err;\n        }\n        if (form == POINT_CONVERSION_HYBRID) {\n            if (!group->meth->field_div(group, yxi, y, x, ctx))\n                goto err;\n            if (y_bit != BN_is_odd(yxi)) {\n                ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);\n                goto err;\n            }\n        }\n        if (!EC_POINT_set_affine_coordinates(group, point, x, y, ctx))\n            goto err;\n    }\n    ret = 1;\n err:\n    BN_CTX_end(ctx);\n    BN_CTX_free(new_ctx);\n    return ret;\n}', 'BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)\n{\n    unsigned int i, m;\n    unsigned int n;\n    BN_ULONG l;\n    BIGNUM *bn = NULL;\n    if (ret == NULL)\n        ret = bn = BN_new();\n    if (ret == NULL)\n        return NULL;\n    bn_check_top(ret);\n    for ( ; len > 0 && *s == 0; s++, len--)\n        continue;\n    n = len;\n    if (n == 0) {\n        ret->top = 0;\n        return ret;\n    }\n    i = ((n - 1) / BN_BYTES) + 1;\n    m = ((n - 1) % (BN_BYTES));\n    if (bn_wexpand(ret, (int)i) == NULL) {\n        BN_free(bn);\n        return NULL;\n    }\n    ret->top = i;\n    ret->neg = 0;\n    l = 0;\n    while (n--) {\n        l = (l << 8L) | *(s++);\n        if (m-- == 0) {\n            ret->d[--i] = l;\n            l = 0;\n            m = BN_BYTES - 1;\n        }\n    }\n    bn_correct_top(ret);\n    return ret;\n}', 'int EC_POINT_set_compressed_coordinates(const EC_GROUP *group, EC_POINT *point,\n                                        const BIGNUM *x, int y_bit, BN_CTX *ctx)\n{\n    if (group->meth->point_set_compressed_coordinates == NULL\n        && !(group->meth->flags & EC_FLAGS_DEFAULT_OCT)) {\n        ECerr(EC_F_EC_POINT_SET_COMPRESSED_COORDINATES,\n              ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);\n        return 0;\n    }\n    if (!ec_point_is_compat(point, group)) {\n        ECerr(EC_F_EC_POINT_SET_COMPRESSED_COORDINATES,\n              EC_R_INCOMPATIBLE_OBJECTS);\n        return 0;\n    }\n    if (group->meth->flags & EC_FLAGS_DEFAULT_OCT) {\n        if (group->meth->field_type == NID_X9_62_prime_field)\n            return ec_GFp_simple_set_compressed_coordinates(group, point, x,\n                                                            y_bit, ctx);\n        else\n#ifdef OPENSSL_NO_EC2M\n        {\n            ECerr(EC_F_EC_POINT_SET_COMPRESSED_COORDINATES,\n                  EC_R_GF2M_NOT_SUPPORTED);\n            return 0;\n        }\n#else\n            return ec_GF2m_simple_set_compressed_coordinates(group, point, x,\n                                                             y_bit, ctx);\n#endif\n    }\n    return group->meth->point_set_compressed_coordinates(group, point, x,\n                                                         y_bit, ctx);\n}', 'int ec_GFp_simple_set_compressed_coordinates(const EC_GROUP *group,\n                                             EC_POINT *point,\n                                             const BIGNUM *x_, int y_bit,\n                                             BN_CTX *ctx)\n{\n    BN_CTX *new_ctx = NULL;\n    BIGNUM *tmp1, *tmp2, *x, *y;\n    int ret = 0;\n    ERR_clear_error();\n    if (ctx == NULL) {\n        ctx = new_ctx = BN_CTX_new();\n        if (ctx == NULL)\n            return 0;\n    }\n    y_bit = (y_bit != 0);\n    BN_CTX_start(ctx);\n    tmp1 = BN_CTX_get(ctx);\n    tmp2 = BN_CTX_get(ctx);\n    x = BN_CTX_get(ctx);\n    y = BN_CTX_get(ctx);\n    if (y == NULL)\n        goto err;\n    if (!BN_nnmod(x, x_, group->field, ctx))\n        goto err;\n    if (group->meth->field_decode == 0) {\n        if (!group->meth->field_sqr(group, tmp2, x_, ctx))\n            goto err;\n        if (!group->meth->field_mul(group, tmp1, tmp2, x_, ctx))\n            goto err;\n    } else {\n        if (!BN_mod_sqr(tmp2, x_, group->field, ctx))\n            goto err;\n        if (!BN_mod_mul(tmp1, tmp2, x_, group->field, ctx))\n            goto err;\n    }\n    if (group->a_is_minus3) {\n        if (!BN_mod_lshift1_quick(tmp2, x, group->field))\n            goto err;\n        if (!BN_mod_add_quick(tmp2, tmp2, x, group->field))\n            goto err;\n        if (!BN_mod_sub_quick(tmp1, tmp1, tmp2, group->field))\n            goto err;\n    } else {\n        if (group->meth->field_decode) {\n            if (!group->meth->field_decode(group, tmp2, group->a, ctx))\n                goto err;\n            if (!BN_mod_mul(tmp2, tmp2, x, group->field, ctx))\n                goto err;\n        } else {\n            if (!group->meth->field_mul(group, tmp2, group->a, x, ctx))\n                goto err;\n        }\n        if (!BN_mod_add_quick(tmp1, tmp1, tmp2, group->field))\n            goto err;\n    }\n    if (group->meth->field_decode) {\n        if (!group->meth->field_decode(group, tmp2, group->b, ctx))\n            goto err;\n        if (!BN_mod_add_quick(tmp1, tmp1, tmp2, group->field))\n            goto err;\n    } else {\n        if (!BN_mod_add_quick(tmp1, tmp1, group->b, group->field))\n            goto err;\n    }\n    if (!BN_mod_sqrt(y, tmp1, group->field, ctx)) {\n        unsigned long err = ERR_peek_last_error();\n        if (ERR_GET_LIB(err) == ERR_LIB_BN\n            && ERR_GET_REASON(err) == BN_R_NOT_A_SQUARE) {\n            ERR_clear_error();\n            ECerr(EC_F_EC_GFP_SIMPLE_SET_COMPRESSED_COORDINATES,\n                  EC_R_INVALID_COMPRESSED_POINT);\n        } else\n            ECerr(EC_F_EC_GFP_SIMPLE_SET_COMPRESSED_COORDINATES,\n                  ERR_R_BN_LIB);\n        goto err;\n    }\n    if (y_bit != BN_is_odd(y)) {\n        if (BN_is_zero(y)) {\n            int kron;\n            kron = BN_kronecker(x, group->field, ctx);\n            if (kron == -2)\n                goto err;\n            if (kron == 1)\n                ECerr(EC_F_EC_GFP_SIMPLE_SET_COMPRESSED_COORDINATES,\n                      EC_R_INVALID_COMPRESSION_BIT);\n            else\n                ECerr(EC_F_EC_GFP_SIMPLE_SET_COMPRESSED_COORDINATES,\n                      EC_R_INVALID_COMPRESSED_POINT);\n            goto err;\n        }\n        if (!BN_usub(y, group->field, y))\n            goto err;\n    }\n    if (y_bit != BN_is_odd(y)) {\n        ECerr(EC_F_EC_GFP_SIMPLE_SET_COMPRESSED_COORDINATES,\n              ERR_R_INTERNAL_ERROR);\n        goto err;\n    }\n    if (!EC_POINT_set_affine_coordinates(group, point, x, y, ctx))\n        goto err;\n    ret = 1;\n err:\n    BN_CTX_end(ctx);\n    BN_CTX_free(new_ctx);\n    return ret;\n}', 'BIGNUM *BN_CTX_get(BN_CTX *ctx)\n{\n    BIGNUM *ret;\n    CTXDBG("ENTER BN_CTX_get()", ctx);\n    if (ctx->err_stack || ctx->too_many)\n        return NULL;\n    if ((ret = BN_POOL_get(&ctx->pool, ctx->flags)) == NULL) {\n        ctx->too_many = 1;\n        BNerr(BN_F_BN_CTX_GET, BN_R_TOO_MANY_TEMPORARY_VARIABLES);\n        return NULL;\n    }\n    BN_zero(ret);\n    ret->flags &= (~BN_FLG_CONSTTIME);\n    ctx->used++;\n    CTXDBG("LEAVE BN_CTX_get()", ctx);\n    return ret;\n}', 'int BN_set_word(BIGNUM *a, BN_ULONG w)\n{\n    bn_check_top(a);\n    if (bn_expand(a, (int)sizeof(BN_ULONG) * 8) == NULL)\n        return 0;\n    a->neg = 0;\n    a->d[0] = w;\n    a->top = (w ? 1 : 0);\n    a->flags &= ~BN_FLG_FIXED_TOP;\n    bn_check_top(a);\n    return 1;\n}', 'static ossl_inline BIGNUM *bn_expand(BIGNUM *a, int bits)\n{\n    if (bits > (INT_MAX - BN_BITS2 + 1))\n        return NULL;\n    if (((bits+BN_BITS2-1)/BN_BITS2) <= (a)->dmax)\n        return a;\n    return bn_expand2((a),(bits+BN_BITS2-1)/BN_BITS2);\n}', 'int BN_mod_sqr(BIGNUM *r, const BIGNUM *a, const BIGNUM *m, BN_CTX *ctx)\n{\n    if (!BN_sqr(r, a, ctx))\n        return 0;\n    return BN_mod(r, r, m, ctx);\n}', 'int BN_sqr(BIGNUM *r, const BIGNUM *a, BN_CTX *ctx)\n{\n    int ret = bn_sqr_fixed_top(r, a, ctx);\n    bn_correct_top(r);\n    bn_check_top(r);\n    return ret;\n}', 'int bn_sqr_fixed_top(BIGNUM *r, const BIGNUM *a, BN_CTX *ctx)\n{\n    int max, al;\n    int ret = 0;\n    BIGNUM *tmp, *rr;\n    bn_check_top(a);\n    al = a->top;\n    if (al <= 0) {\n        r->top = 0;\n        r->neg = 0;\n        return 1;\n    }\n    BN_CTX_start(ctx);\n    rr = (a != r) ? r : BN_CTX_get(ctx);\n    tmp = BN_CTX_get(ctx);\n    if (rr == NULL || tmp == NULL)\n        goto err;\n    max = 2 * al;\n    if (bn_wexpand(rr, max) == NULL)\n        goto err;\n    if (al == 4) {\n#ifndef BN_SQR_COMBA\n        BN_ULONG t[8];\n        bn_sqr_normal(rr->d, a->d, 4, t);\n#else\n        bn_sqr_comba4(rr->d, a->d);\n#endif\n    } else if (al == 8) {\n#ifndef BN_SQR_COMBA\n        BN_ULONG t[16];\n        bn_sqr_normal(rr->d, a->d, 8, t);\n#else\n        bn_sqr_comba8(rr->d, a->d);\n#endif\n    } else {\n#if defined(BN_RECURSION)\n        if (al < BN_SQR_RECURSIVE_SIZE_NORMAL) {\n            BN_ULONG t[BN_SQR_RECURSIVE_SIZE_NORMAL * 2];\n            bn_sqr_normal(rr->d, a->d, al, t);\n        } else {\n            int j, k;\n            j = BN_num_bits_word((BN_ULONG)al);\n            j = 1 << (j - 1);\n            k = j + j;\n            if (al == j) {\n                if (bn_wexpand(tmp, k * 2) == NULL)\n                    goto err;\n                bn_sqr_recursive(rr->d, a->d, al, tmp->d);\n            } else {\n                if (bn_wexpand(tmp, max) == NULL)\n                    goto err;\n                bn_sqr_normal(rr->d, a->d, al, tmp->d);\n            }\n        }\n#else\n        if (bn_wexpand(tmp, max) == NULL)\n            goto err;\n        bn_sqr_normal(rr->d, a->d, al, tmp->d);\n#endif\n    }\n    rr->neg = 0;\n    rr->top = max;\n    rr->flags |= BN_FLG_FIXED_TOP;\n    if (r != rr && BN_copy(r, rr) == NULL)\n        goto err;\n    ret = 1;\n err:\n    bn_check_top(rr);\n    bn_check_top(tmp);\n    BN_CTX_end(ctx);\n    return ret;\n}', 'void bn_sqr_normal(BN_ULONG *r, const BN_ULONG *a, int n, BN_ULONG *tmp)\n{\n    int i, j, max;\n    const BN_ULONG *ap;\n    BN_ULONG *rp;\n    max = n * 2;\n    ap = a;\n    rp = r;\n    rp[0] = rp[max - 1] = 0;\n    rp++;\n    j = n;\n    if (--j > 0) {\n        ap++;\n        rp[j] = bn_mul_words(rp, ap, j, ap[-1]);\n        rp += 2;\n    }\n    for (i = n - 2; i > 0; i--) {\n        j--;\n        ap++;\n        rp[j] = bn_mul_add_words(rp, ap, j, ap[-1]);\n        rp += 2;\n    }\n    bn_add_words(r, r, r, max);\n    bn_sqr_words(tmp, a, n);\n    bn_add_words(r, r, tmp, max);\n}']