ssl/statem/statem_srvr.c:2777: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned64 by call to `BUF_reverse`.
Showing all 5 steps of the trace


ssl/statem/statem_srvr.c:2698:9: Assignment
2696.       if (PACKET_remaining(pkt) == 64
2697.           && EVP_PKEY_id(pkey) == NID_id_GostR3410_2001) {
2698.           len = 64;
                ^
2699.       } else
2700.   #endif

ssl/statem/statem_srvr.c:2777:13: Call
2775.                   goto f_err;
2776.               }
2777.               BUF_reverse(gost_data, data, len);
                    ^
2778.               data = gost_data;
2779.           }

crypto/buffer/buffer.c:194:1: <LHS trace>
192.   }
193.   
194. > void BUF_reverse(unsigned char *out, const unsigned char *in, size_t size)
195.   {
196.       size_t i;

crypto/buffer/buffer.c:194:1: Parameter `size`
  192.   }
  193.   
  194. > void BUF_reverse(unsigned char *out, const unsigned char *in, size_t size)
  195.   {
  196.       size_t i;

crypto/buffer/buffer.c:198:9: Binary operation: ([0, +oo] - 1):unsigned64 by call to `BUF_reverse` 
  196.       size_t i;
  197.       if (in) {
  198.           out += size - 1;
                 ^
  199.           for (i = 0; i < size; i++)
  200.               *out-- = *in++;

void BUF_reverse(unsigned char *out, const unsigned char *in, size_t size)
{
    size_t i;
    if (in) {
        out += size - 1;
        for (i = 0; i < size; i++)
            *out-- = *in++;
    } else {
        unsigned char *q;
        char c;
        q = out + size - 1;
        for (i = 0; i < size / 2; i++) {
            c = *q;
            *q-- = *out;
            *out++ = c;
        }
    }
}
['MSG_PROCESS_RETURN tls_process_cert_verify(SSL *s, PACKET *pkt)\n{\n    EVP_PKEY *pkey = NULL;\n    const unsigned char *sig, *data;\n    unsigned char *gost_data = NULL;\n    int al, ret = MSG_PROCESS_ERROR;\n    int type = 0, j;\n    unsigned int len;\n    X509 *peer;\n    const EVP_MD *md = NULL;\n    long hdatalen = 0;\n    void *hdata;\n    EVP_MD_CTX *mctx = EVP_MD_CTX_new();\n    if (mctx == NULL) {\n        SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY, ERR_R_MALLOC_FAILURE);\n        al = SSL_AD_INTERNAL_ERROR;\n        goto f_err;\n    }\n    peer = s->session->peer;\n    pkey = X509_get0_pubkey(peer);\n    type = X509_certificate_type(peer, pkey);\n    if (!(type & EVP_PKT_SIGN)) {\n        SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY,\n               SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE);\n        al = SSL_AD_ILLEGAL_PARAMETER;\n        goto f_err;\n    }\n#ifndef OPENSSL_NO_GOST\n    if (PACKET_remaining(pkt) == 64\n        && EVP_PKEY_id(pkey) == NID_id_GostR3410_2001) {\n        len = 64;\n    } else\n#endif\n    {\n        if (SSL_USE_SIGALGS(s)) {\n            int rv;\n            if (!PACKET_get_bytes(pkt, &sig, 2)) {\n                al = SSL_AD_DECODE_ERROR;\n                goto f_err;\n            }\n            rv = tls12_check_peer_sigalg(&md, s, sig, pkey);\n            if (rv == -1) {\n                al = SSL_AD_INTERNAL_ERROR;\n                goto f_err;\n            } else if (rv == 0) {\n                al = SSL_AD_DECODE_ERROR;\n                goto f_err;\n            }\n#ifdef SSL_DEBUG\n            fprintf(stderr, "USING TLSv1.2 HASH %s\\n", EVP_MD_name(md));\n#endif\n        } else {\n            int idx = ssl_cert_type(NULL, pkey);\n            if (idx >= 0)\n                md = s->s3->tmp.md[idx];\n            if (md == NULL) {\n                al = SSL_AD_INTERNAL_ERROR;\n                goto f_err;\n            }\n        }\n        if (!PACKET_get_net_2(pkt, &len)) {\n            SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY, SSL_R_LENGTH_MISMATCH);\n            al = SSL_AD_DECODE_ERROR;\n            goto f_err;\n        }\n    }\n    j = EVP_PKEY_size(pkey);\n    if (((int)len > j) || ((int)PACKET_remaining(pkt) > j)\n            || (PACKET_remaining(pkt) == 0)) {\n        SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY, SSL_R_WRONG_SIGNATURE_SIZE);\n        al = SSL_AD_DECODE_ERROR;\n        goto f_err;\n    }\n    if (!PACKET_get_bytes(pkt, &data, len)) {\n        SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY, SSL_R_LENGTH_MISMATCH);\n        al = SSL_AD_DECODE_ERROR;\n        goto f_err;\n    }\n    hdatalen = BIO_get_mem_data(s->s3->handshake_buffer, &hdata);\n    if (hdatalen <= 0) {\n        SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY, ERR_R_INTERNAL_ERROR);\n        al = SSL_AD_INTERNAL_ERROR;\n        goto f_err;\n    }\n#ifdef SSL_DEBUG\n    fprintf(stderr, "Using client verify alg %s\\n", EVP_MD_name(md));\n#endif\n    if (!EVP_VerifyInit_ex(mctx, md, NULL)\n        || !EVP_VerifyUpdate(mctx, hdata, hdatalen)) {\n        SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY, ERR_R_EVP_LIB);\n        al = SSL_AD_INTERNAL_ERROR;\n        goto f_err;\n    }\n#ifndef OPENSSL_NO_GOST\n    {\n        int pktype = EVP_PKEY_id(pkey);\n        if (pktype == NID_id_GostR3410_2001\n            || pktype == NID_id_GostR3410_2012_256\n            || pktype == NID_id_GostR3410_2012_512) {\n            if ((gost_data = OPENSSL_malloc(len)) == NULL) {\n                SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY, ERR_R_MALLOC_FAILURE);\n                al = SSL_AD_INTERNAL_ERROR;\n                goto f_err;\n            }\n            BUF_reverse(gost_data, data, len);\n            data = gost_data;\n        }\n    }\n#endif\n    if (s->version == SSL3_VERSION\n        && !EVP_MD_CTX_ctrl(mctx, EVP_CTRL_SSL3_MASTER_SECRET,\n                            s->session->master_key_length,\n                            s->session->master_key)) {\n        SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY, ERR_R_EVP_LIB);\n        al = SSL_AD_INTERNAL_ERROR;\n        goto f_err;\n    }\n    if (EVP_VerifyFinal(mctx, data, len, pkey) <= 0) {\n        al = SSL_AD_DECRYPT_ERROR;\n        SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY, SSL_R_BAD_SIGNATURE);\n        goto f_err;\n    }\n    ret = MSG_PROCESS_CONTINUE_PROCESSING;\n    if (0) {\n f_err:\n        ssl3_send_alert(s, SSL3_AL_FATAL, al);\n        ossl_statem_set_error(s);\n    }\n    BIO_free(s->s3->handshake_buffer);\n    s->s3->handshake_buffer = NULL;\n    EVP_MD_CTX_free(mctx);\n    OPENSSL_free(gost_data);\n    return ret;\n}', 'void BUF_reverse(unsigned char *out, const unsigned char *in, size_t size)\n{\n    size_t i;\n    if (in) {\n        out += size - 1;\n        for (i = 0; i < size; i++)\n            *out-- = *in++;\n    } else {\n        unsigned char *q;\n        char c;\n        q = out + size - 1;\n        for (i = 0; i < size / 2; i++) {\n            c = *q;\n            *q-- = *out;\n            *out++ = c;\n        }\n    }\n}']