crypto/ec/ecx_meth.c:100: error: BUFFER_OVERRUN_L3
  Offset added: [32, 57] Size: [32, 57].
Showing all 12 steps of the trace


crypto/ec/ecx_meth.c:100:32: <Offset trace>
98.               }
99.           } else {
100.               memcpy(privkey, p, KEYLENID(id));
                                      ^
101.           }
102.           switch (id) {

crypto/ec/ecx_meth.c:100:32: Assignment
98.               }
99.           } else {
100.               memcpy(privkey, p, KEYLENID(id));
                                      ^
101.           }
102.           switch (id) {

crypto/ec/ecx_meth.c:80:34: <Length trace>
78.           memcpy(pubkey, p, plen);
79.       } else {
80.           privkey = key->privkey = OPENSSL_secure_malloc(KEYLENID(id));
                                       ^
81.           if (privkey == NULL) {
82.               ECerr(EC_F_ECX_KEY_OP, ERR_R_MALLOC_FAILURE);

crypto/ec/ecx_meth.c:80:34: Assignment
78.           memcpy(pubkey, p, plen);
79.       } else {
80.           privkey = key->privkey = OPENSSL_secure_malloc(KEYLENID(id));
                                       ^
81.           if (privkey == NULL) {
82.               ECerr(EC_F_ECX_KEY_OP, ERR_R_MALLOC_FAILURE);

crypto/ec/ecx_meth.c:80:34: Call
78.           memcpy(pubkey, p, plen);
79.       } else {
80.           privkey = key->privkey = OPENSSL_secure_malloc(KEYLENID(id));
                                       ^
81.           if (privkey == NULL) {
82.               ECerr(EC_F_ECX_KEY_OP, ERR_R_MALLOC_FAILURE);

crypto/mem_sec.c:114:1: Parameter `num`
  112.   }
  113.   
  114. > void *CRYPTO_secure_malloc(size_t num, const char *file, int line)
  115.   {
  116.   #ifdef OPENSSL_SECURE_MEMORY

crypto/mem_sec.c:121:16: Call
  119.   
  120.       if (!secure_mem_initialized) {
  121.           return CRYPTO_malloc(num, file, line);
                        ^
  122.       }
  123.       CRYPTO_THREAD_write_lock(sec_malloc_lock);

crypto/mem.c:201:9: Assignment
    199.   
    200.       if (num == 0)
    201.           return NULL;
                   ^
    202.   
    203.       FAILTEST();

crypto/mem_sec.c:121:9: Assignment
  119.   
  120.       if (!secure_mem_initialized) {
  121.           return CRYPTO_malloc(num, file, line);
                 ^
  122.       }
  123.       CRYPTO_THREAD_write_lock(sec_malloc_lock);

crypto/ec/ecx_meth.c:80:19: Assignment
78.           memcpy(pubkey, p, plen);
79.       } else {
80.           privkey = key->privkey = OPENSSL_secure_malloc(KEYLENID(id));
                        ^
81.           if (privkey == NULL) {
82.               ECerr(EC_F_ECX_KEY_OP, ERR_R_MALLOC_FAILURE);

crypto/ec/ecx_meth.c:80:9: Assignment
78.           memcpy(pubkey, p, plen);
79.       } else {
80.           privkey = key->privkey = OPENSSL_secure_malloc(KEYLENID(id));
              ^
81.           if (privkey == NULL) {
82.               ECerr(EC_F_ECX_KEY_OP, ERR_R_MALLOC_FAILURE);

crypto/ec/ecx_meth.c:100:13: Array access: Offset added: [32, 57] Size: [32, 57]
98.               }
99.           } else {
100.               memcpy(privkey, p, KEYLENID(id));
                   ^
101.           }
102.           switch (id) {

static int ecx_key_op(EVP_PKEY *pkey, int id, const X509_ALGOR *palg,
                      const unsigned char *p, int plen, ecx_key_op_t op)
{
    ECX_KEY *key = NULL;
    unsigned char *privkey, *pubkey;
    if (op != KEY_OP_KEYGEN) {
        if (palg != NULL) {
            int ptype;
            X509_ALGOR_get0(NULL, &ptype, NULL, palg);
            if (ptype != V_ASN1_UNDEF) {
                ECerr(EC_F_ECX_KEY_OP, EC_R_INVALID_ENCODING);
                return 0;
            }
        }
        if (p == NULL || plen != KEYLENID(id)) {
            ECerr(EC_F_ECX_KEY_OP, EC_R_INVALID_ENCODING);
            return 0;
        }
    }
    key = OPENSSL_zalloc(sizeof(*key));
    if (key == NULL) {
        ECerr(EC_F_ECX_KEY_OP, ERR_R_MALLOC_FAILURE);
        return 0;
    }
    pubkey = key->pubkey;
    if (op == KEY_OP_PUBLIC) {
        memcpy(pubkey, p, plen);
    } else {
        privkey = key->privkey = OPENSSL_secure_malloc(KEYLENID(id));
        if (privkey == NULL) {
            ECerr(EC_F_ECX_KEY_OP, ERR_R_MALLOC_FAILURE);
            goto err;
        }
        if (op == KEY_OP_KEYGEN) {
            if (RAND_priv_bytes(privkey, KEYLENID(id)) <= 0) {
                OPENSSL_secure_free(privkey);
                key->privkey = NULL;
                goto err;
            }
            if (id == EVP_PKEY_X25519) {
                privkey[0] &= 248;
                privkey[X25519_KEYLEN - 1] &= 127;
                privkey[X25519_KEYLEN - 1] |= 64;
            } else if (id == EVP_PKEY_X448) {
                privkey[0] &= 252;
                privkey[X448_KEYLEN - 1] |= 128;
            }
        } else {
            memcpy(privkey, p, KEYLENID(id));
        }
        switch (id) {
        case EVP_PKEY_X25519:
            X25519_public_from_private(pubkey, privkey);
            break;
        case EVP_PKEY_ED25519:
            ED25519_public_from_private(pubkey, privkey);
            break;
        case EVP_PKEY_X448:
            X448_public_from_private(pubkey, privkey);
            break;
        case EVP_PKEY_ED448:
            ED448_public_from_private(pubkey, privkey);
            break;
        }
    }
    EVP_PKEY_assign(pkey, id, key);
    return 1;
 err:
    OPENSSL_free(key);
    return 0;
}
['static int ecx_key_op(EVP_PKEY *pkey, int id, const X509_ALGOR *palg,\n                      const unsigned char *p, int plen, ecx_key_op_t op)\n{\n    ECX_KEY *key = NULL;\n    unsigned char *privkey, *pubkey;\n    if (op != KEY_OP_KEYGEN) {\n        if (palg != NULL) {\n            int ptype;\n            X509_ALGOR_get0(NULL, &ptype, NULL, palg);\n            if (ptype != V_ASN1_UNDEF) {\n                ECerr(EC_F_ECX_KEY_OP, EC_R_INVALID_ENCODING);\n                return 0;\n            }\n        }\n        if (p == NULL || plen != KEYLENID(id)) {\n            ECerr(EC_F_ECX_KEY_OP, EC_R_INVALID_ENCODING);\n            return 0;\n        }\n    }\n    key = OPENSSL_zalloc(sizeof(*key));\n    if (key == NULL) {\n        ECerr(EC_F_ECX_KEY_OP, ERR_R_MALLOC_FAILURE);\n        return 0;\n    }\n    pubkey = key->pubkey;\n    if (op == KEY_OP_PUBLIC) {\n        memcpy(pubkey, p, plen);\n    } else {\n        privkey = key->privkey = OPENSSL_secure_malloc(KEYLENID(id));\n        if (privkey == NULL) {\n            ECerr(EC_F_ECX_KEY_OP, ERR_R_MALLOC_FAILURE);\n            goto err;\n        }\n        if (op == KEY_OP_KEYGEN) {\n            if (RAND_priv_bytes(privkey, KEYLENID(id)) <= 0) {\n                OPENSSL_secure_free(privkey);\n                key->privkey = NULL;\n                goto err;\n            }\n            if (id == EVP_PKEY_X25519) {\n                privkey[0] &= 248;\n                privkey[X25519_KEYLEN - 1] &= 127;\n                privkey[X25519_KEYLEN - 1] |= 64;\n            } else if (id == EVP_PKEY_X448) {\n                privkey[0] &= 252;\n                privkey[X448_KEYLEN - 1] |= 128;\n            }\n        } else {\n            memcpy(privkey, p, KEYLENID(id));\n        }\n        switch (id) {\n        case EVP_PKEY_X25519:\n            X25519_public_from_private(pubkey, privkey);\n            break;\n        case EVP_PKEY_ED25519:\n            ED25519_public_from_private(pubkey, privkey);\n            break;\n        case EVP_PKEY_X448:\n            X448_public_from_private(pubkey, privkey);\n            break;\n        case EVP_PKEY_ED448:\n            ED448_public_from_private(pubkey, privkey);\n            break;\n        }\n    }\n    EVP_PKEY_assign(pkey, id, key);\n    return 1;\n err:\n    OPENSSL_free(key);\n    return 0;\n}', 'void *CRYPTO_secure_malloc(size_t num, const char *file, int line)\n{\n#ifdef OPENSSL_SECURE_MEMORY\n    void *ret;\n    size_t actual_size;\n    if (!secure_mem_initialized) {\n        return CRYPTO_malloc(num, file, line);\n    }\n    CRYPTO_THREAD_write_lock(sec_malloc_lock);\n    ret = sh_malloc(num);\n    actual_size = ret ? sh_actual_size(ret) : 0;\n    secure_mem_used += actual_size;\n    CRYPTO_THREAD_unlock(sec_malloc_lock);\n    return ret;\n#else\n    return CRYPTO_malloc(num, file, line);\n#endif\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    INCREMENT(malloc_count);\n    if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)\n        return malloc_impl(num, file, line);\n    if (num == 0)\n        return NULL;\n    FAILTEST();\n    if (allow_customize) {\n        allow_customize = 0;\n    }\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    (void)(file); (void)(line);\n    ret = malloc(num);\n#endif\n    return ret;\n}']