apps/apps.c:2473: error: BUFFER_OVERRUN_L3
  Offset: [-7, +oo] (⇐ [0, 1] + [-7, +oo]) Size: 10240 by call to `BN_hex2bn`.
Showing all 8 steps of the trace


apps/apps.c:2464:1: Array declaration
2462.   	}
2463.   
2464. > static void readbn(BIGNUM **bn, BIO *bconn)
2465.   	{
2466.   	char buf[10240];

apps/apps.c:2473:2: Call
2471.   	assert(buf[l-1] == '\n');
2472.   	buf[l-1] = '\0';
2473.   	BN_hex2bn(bn, buf);
         ^
2474.   	}
2475.   

crypto/bn/bn_print.c:183:7: <Offset trace>
181.   	if (*a == '-') { neg=1; a++; }
182.   
183.   	for (i=0; isxdigit((unsigned char) a[i]); i++)
             ^
184.   		;
185.   

crypto/bn/bn_print.c:183:7: Assignment
  181.   	if (*a == '-') { neg=1; a++; }
  182.   
  183.   	for (i=0; isxdigit((unsigned char) a[i]); i++)
               ^
  184.   		;
  185.   

crypto/bn/bn_print.c:203:2: Assignment
  201.   	if (bn_expand(ret,i*4) == NULL) goto err;
  202.   
  203.   	j=i; /* least significant 'hex' */
          ^
  204.   	m=0;
  205.   	h=0;

crypto/bn/bn_print.c:172:1: <Length trace>
170.   	}
171.   
172. > int BN_hex2bn(BIGNUM **bn, const char *a)
173.   	{
174.   	BIGNUM *ret=NULL;

crypto/bn/bn_print.c:172:1: Parameter `*a`
  170.   	}
  171.   
  172. > int BN_hex2bn(BIGNUM **bn, const char *a)
  173.   	{
  174.   	BIGNUM *ret=NULL;

crypto/bn/bn_print.c:212:6: Array access: Offset: [-7, +oo] (⇐ [0, 1] + [-7, +oo]) Size: 10240 by call to `BN_hex2bn` 
  210.   		for (;;)
  211.   			{
  212.   			c=a[j-m];
              ^
  213.   			if ((c >= '0') && (c <= '9')) k=c-'0';
  214.   			else if ((c >= 'a') && (c <= 'f')) k=c-'a'+10;

int BN_hex2bn(BIGNUM **bn, const char *a)
	{
	BIGNUM *ret=NULL;
	BN_ULONG l=0;
	int neg=0,h,m,i,j,k,c;
	int num;
	if ((a == NULL) || (*a == '\0')) return(0);
	if (*a == '-') { neg=1; a++; }
	for (i=0; isxdigit((unsigned char) a[i]); i++)
		;
	num=i+neg;
	if (bn == NULL) return(num);
	if (*bn == NULL)
		{
		if ((ret=BN_new()) == NULL) return(0);
		}
	else
		{
		ret= *bn;
		BN_zero(ret);
		}
	if (bn_expand(ret,i*4) == NULL) goto err;
	j=i;
	m=0;
	h=0;
	while (j > 0)
		{
		m=((BN_BYTES*2) <= j)?(BN_BYTES*2):j;
		l=0;
		for (;;)
			{
			c=a[j-m];
			if ((c >= '0') && (c <= '9')) k=c-'0';
			else if ((c >= 'a') && (c <= 'f')) k=c-'a'+10;
			else if ((c >= 'A') && (c <= 'F')) k=c-'A'+10;
			else k=0;
			l=(l<<4)|k;
			if (--m <= 0)
				{
				ret->d[h++]=l;
				break;
				}
			}
		j-=(BN_BYTES*2);
		}
	ret->top=h;
	bn_correct_top(ret);
	ret->neg=neg;
	*bn=ret;
	bn_check_top(ret);
	return(num);
err:
	if (*bn == NULL) BN_free(ret);
	return(0);
	}
["static void readbn(BIGNUM **bn, BIO *bconn)\n\t{\n\tchar buf[10240];\n\tint l;\n\tl = BIO_gets(bconn, buf, sizeof buf);\n\tassert(l >= 0);\n\tassert(buf[l-1] == '\\n');\n\tbuf[l-1] = '\\0';\n\tBN_hex2bn(bn, buf);\n\t}", "int BN_hex2bn(BIGNUM **bn, const char *a)\n\t{\n\tBIGNUM *ret=NULL;\n\tBN_ULONG l=0;\n\tint neg=0,h,m,i,j,k,c;\n\tint num;\n\tif ((a == NULL) || (*a == '\\0')) return(0);\n\tif (*a == '-') { neg=1; a++; }\n\tfor (i=0; isxdigit((unsigned char) a[i]); i++)\n\t\t;\n\tnum=i+neg;\n\tif (bn == NULL) return(num);\n\tif (*bn == NULL)\n\t\t{\n\t\tif ((ret=BN_new()) == NULL) return(0);\n\t\t}\n\telse\n\t\t{\n\t\tret= *bn;\n\t\tBN_zero(ret);\n\t\t}\n\tif (bn_expand(ret,i*4) == NULL) goto err;\n\tj=i;\n\tm=0;\n\th=0;\n\twhile (j > 0)\n\t\t{\n\t\tm=((BN_BYTES*2) <= j)?(BN_BYTES*2):j;\n\t\tl=0;\n\t\tfor (;;)\n\t\t\t{\n\t\t\tc=a[j-m];\n\t\t\tif ((c >= '0') && (c <= '9')) k=c-'0';\n\t\t\telse if ((c >= 'a') && (c <= 'f')) k=c-'a'+10;\n\t\t\telse if ((c >= 'A') && (c <= 'F')) k=c-'A'+10;\n\t\t\telse k=0;\n\t\t\tl=(l<<4)|k;\n\t\t\tif (--m <= 0)\n\t\t\t\t{\n\t\t\t\tret->d[h++]=l;\n\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t}\n\t\tj-=(BN_BYTES*2);\n\t\t}\n\tret->top=h;\n\tbn_correct_top(ret);\n\tret->neg=neg;\n\t*bn=ret;\n\tbn_check_top(ret);\n\treturn(num);\nerr:\n\tif (*bn == NULL) BN_free(ret);\n\treturn(0);\n\t}"]