crypto/bn/bn_rsa_fips186_4.c:128: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 67108856] by call to `BN_copy`.
Showing all 12 steps of the trace


crypto/bn/bn_rsa_fips186_4.c:120:1: Parameter `Xp1->top`
118.    * Returns: 1 on success otherwise it returns 0.
119.    */
120. > static int bn_rsa_fips186_4_find_aux_prob_prime(const BIGNUM *Xp1,
121.                                                   BIGNUM *p1, BN_CTX *ctx,
122.                                                   BN_GENCB *cb)

crypto/bn/bn_rsa_fips186_4.c:126:59: Call
124.       int ret = 0;
125.       int i = 0;
126.       int checks = bn_rsa_fips186_4_aux_prime_MR_min_checks(BN_num_bits(Xp1));
                                                                 ^
127.   
128.       if (checks == 0 || BN_copy(p1, Xp1) == NULL)

crypto/bn/bn_lib.c:140:9: Call
  138.       bn_check_top(a);
  139.   
  140.       if (BN_is_zero(a))
                 ^
  141.           return 0;
  142.       return ((i * BN_BITS2) + BN_num_bits_word(a->d[i]));

crypto/bn/bn_lib.c:864:1: Parameter `a->top`
    862.   }
    863.   
    864. > int BN_is_zero(const BIGNUM *a)
    865.   {
    866.       return a->top == 0;

crypto/bn/bn_rsa_fips186_4.c:128:24: Call
126.       int checks = bn_rsa_fips186_4_aux_prime_MR_min_checks(BN_num_bits(Xp1));
127.   
128.       if (checks == 0 || BN_copy(p1, Xp1) == NULL)
                              ^
129.           return 0;
130.   

crypto/bn/bn_lib.c:281:1: <Offset trace>
279.   }
280.   
281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
282.   {
283.       bn_check_top(b);

crypto/bn/bn_lib.c:281:1: Parameter `b->top`
  279.   }
  280.   
  281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
  282.   {
  283.       bn_check_top(b);

crypto/bn/bn_lib.c:281:1: <Length trace>
279.   }
280.   
281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
282.   {
283.       bn_check_top(b);

crypto/bn/bn_lib.c:281:1: Parameter `*a->d`
  279.   }
  280.   
  281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
  282.   {
  283.       bn_check_top(b);

crypto/bn/bn_lib.c:287:9: Call
  285.       if (a == b)
  286.           return a;
  287.       if (bn_wexpand(a, b->top) == NULL)
                 ^
  288.           return NULL;
  289.   

crypto/bn/bn_lib.c:960:1: Parameter `*a->d`
    958.   }
    959.   
    960. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
    961.   {
    962.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:291:9: Array access: Offset added: [8, +oo] Size: [0, 67108856] by call to `BN_copy` 
  289.   
  290.       if (b->top > 0)
  291.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                 ^
  292.   
  293.       a->neg = b->neg;

BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
{
    bn_check_top(b);
    if (a == b)
        return a;
    if (bn_wexpand(a, b->top) == NULL)
        return NULL;
    if (b->top > 0)
        memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
    a->neg = b->neg;
    a->top = b->top;
    a->flags |= b->flags & BN_FLG_FIXED_TOP;
    bn_check_top(a);
    return a;
}
['static int bn_rsa_fips186_4_find_aux_prob_prime(const BIGNUM *Xp1,\n                                                BIGNUM *p1, BN_CTX *ctx,\n                                                BN_GENCB *cb)\n{\n    int ret = 0;\n    int i = 0;\n    int checks = bn_rsa_fips186_4_aux_prime_MR_min_checks(BN_num_bits(Xp1));\n    if (checks == 0 || BN_copy(p1, Xp1) == NULL)\n        return 0;\n    for(;;) {\n        i++;\n        BN_GENCB_call(cb, 0, i);\n        if (BN_is_prime_fasttest_ex(p1, checks, ctx, 1, cb))\n            break;\n        if (!BN_add_word(p1, 2))\n            goto err;\n    }\n    BN_GENCB_call(cb, 2, i);\n    ret = 1;\nerr:\n    return ret;\n}', 'int BN_num_bits(const BIGNUM *a)\n{\n    int i = a->top - 1;\n    bn_check_top(a);\n    if (BN_is_zero(a))\n        return 0;\n    return ((i * BN_BITS2) + BN_num_bits_word(a->d[i]));\n}', 'int BN_is_zero(const BIGNUM *a)\n{\n    return a->top == 0;\n}', 'BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)\n{\n    bn_check_top(b);\n    if (a == b)\n        return a;\n    if (bn_wexpand(a, b->top) == NULL)\n        return NULL;\n    if (b->top > 0)\n        memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);\n    a->neg = b->neg;\n    a->top = b->top;\n    a->flags |= b->flags & BN_FLG_FIXED_TOP;\n    bn_check_top(a);\n    return a;\n}', 'BIGNUM *bn_wexpand(BIGNUM *a, int words)\n{\n    return (words <= a->dmax) ? a : bn_expand2(a, words);\n}']