test/bntest.c:449: error: BUFFER_OVERRUN_L3
  Offset: [0, 193] Size: [0, 8388607] by call to `BN_GF2m_arr2poly`.
Showing all 9 steps of the trace


test/bntest.c:437:23: Assignment
435.   {
436.       static int p0[] = { 163, 7, 6, 3, 0, -1 };
437.       static int p1[] = { 193, 15, 0, -1 };
                             ^
438.       BIGNUM *a, *b[2], *c, *d, *e;
439.       int i, j, st = 0;

test/bntest.c:449:5: Call
447.   
448.       BN_GF2m_arr2poly(p0, b[0]);
449.       BN_GF2m_arr2poly(p1, b[1]);
           ^
450.   
451.       for (i = 0; i < NUM0; i++) {

crypto/bn/bn_gf2m.c:1209:1: Parameter `*p`
  1207.    * bit-string.  The array must be terminated by -1.
  1208.    */
  1209. > int BN_GF2m_arr2poly(const int p[], BIGNUM *a)
  1210.   {
  1211.       int i;

crypto/bn/bn_gf2m.c:1216:13: Call
  1214.       BN_zero(a);
  1215.       for (i = 0; p[i] != -1; i++) {
  1216.           if (BN_set_bit(a, p[i]) == 0)
                      ^
  1217.               return 0;
  1218.       }

crypto/bn/bn_lib.c:692:1: <Offset trace>
690.   }
691.   
692. > int BN_set_bit(BIGNUM *a, int n)
693.   {
694.       int i, j, k;

crypto/bn/bn_lib.c:692:1: Parameter `a->top`
    690.   }
    691.   
    692. > int BN_set_bit(BIGNUM *a, int n)
    693.   {
    694.       int i, j, k;

crypto/bn/bn_lib.c:692:1: <Length trace>
690.   }
691.   
692. > int BN_set_bit(BIGNUM *a, int n)
693.   {
694.       int i, j, k;

crypto/bn/bn_lib.c:692:1: Parameter `*a->d`
    690.   }
    691.   
    692. > int BN_set_bit(BIGNUM *a, int n)
    693.   {
    694.       int i, j, k;

crypto/bn/bn_lib.c:709:5: Array access: Offset: [0, 193] Size: [0, 8388607] by call to `BN_GF2m_arr2poly` 
    707.       }
    708.   
    709.       a->d[i] |= (((BN_ULONG)1) << j);
               ^
    710.       bn_check_top(a);
    711.       return (1);

int BN_set_bit(BIGNUM *a, int n)
{
    int i, j, k;
    if (n < 0)
        return 0;
    i = n / BN_BITS2;
    j = n % BN_BITS2;
    if (a->top <= i) {
        if (bn_wexpand(a, i + 1) == NULL)
            return (0);
        for (k = a->top; k < i + 1; k++)
            a->d[k] = 0;
        a->top = i + 1;
    }
    a->d[i] |= (((BN_ULONG)1) << j);
    bn_check_top(a);
    return (1);
}
['static int test_gf2m_mod()\n{\n    static int p0[] = { 163, 7, 6, 3, 0, -1 };\n    static int p1[] = { 193, 15, 0, -1 };\n    BIGNUM *a, *b[2], *c, *d, *e;\n    int i, j, st = 0;\n    a = BN_new();\n    b[0] = BN_new();\n    b[1] = BN_new();\n    c = BN_new();\n    d = BN_new();\n    e = BN_new();\n    BN_GF2m_arr2poly(p0, b[0]);\n    BN_GF2m_arr2poly(p1, b[1]);\n    for (i = 0; i < NUM0; i++) {\n        BN_bntest_rand(a, 1024, 0, 0);\n        for (j = 0; j < 2; j++) {\n            BN_GF2m_mod(c, a, b[j]);\n            BN_GF2m_add(d, a, c);\n            BN_GF2m_mod(e, d, b[j]);\n            if (!BN_is_zero(e)) {\n                printf("GF(2^m) modulo test failed!\\n");\n                goto err;\n            }\n        }\n    }\n    st = 1;\n err:\n    BN_free(a);\n    BN_free(b[0]);\n    BN_free(b[1]);\n    BN_free(c);\n    BN_free(d);\n    BN_free(e);\n    return st;\n}', 'int BN_GF2m_arr2poly(const int p[], BIGNUM *a)\n{\n    int i;\n    bn_check_top(a);\n    BN_zero(a);\n    for (i = 0; p[i] != -1; i++) {\n        if (BN_set_bit(a, p[i]) == 0)\n            return 0;\n    }\n    bn_check_top(a);\n    return 1;\n}', 'int BN_set_bit(BIGNUM *a, int n)\n{\n    int i, j, k;\n    if (n < 0)\n        return 0;\n    i = n / BN_BITS2;\n    j = n % BN_BITS2;\n    if (a->top <= i) {\n        if (bn_wexpand(a, i + 1) == NULL)\n            return (0);\n        for (k = a->top; k < i + 1; k++)\n            a->d[k] = 0;\n        a->top = i + 1;\n    }\n    a->d[i] |= (((BN_ULONG)1) << j);\n    bn_check_top(a);\n    return (1);\n}']