crypto/rsa/rsa_eay.c:130: error: BUFFER_OVERRUN_L3
  Offset: [1, 20] (⇐ 1 + [0, 19]) Size: [0, +oo] by call to `RSA_padding_add_PKCS1_OAEP`.
Showing all 12 steps of the trace


crypto/rsa/rsa_eay.c:117:6: Call
115.   	BN_init(&ret);
116.   	if ((ctx=BN_CTX_new()) == NULL) goto err;
117.   	num=BN_num_bytes(rsa->n);
            ^
118.   	if ((buf=(unsigned char *)Malloc(num)) == NULL)
119.   		{

crypto/bn/bn_lib.c:245:19: Assignment
  243.   	bn_check_top(a);
  244.   
  245.   	if (a->top == 0) return(0);
                           ^
  246.   	l=a->d[a->top-1];
  247.   	i=(a->top-1)*BN_BITS2;

crypto/rsa/rsa_eay.c:117:2: Assignment
115.   	BN_init(&ret);
116.   	if ((ctx=BN_CTX_new()) == NULL) goto err;
117.   	num=BN_num_bytes(rsa->n);
        ^
118.   	if ((buf=(unsigned char *)Malloc(num)) == NULL)
119.   		{

crypto/rsa/rsa_eay.c:118:28: Array declaration
116.   	if ((ctx=BN_CTX_new()) == NULL) goto err;
117.   	num=BN_num_bytes(rsa->n);
118.   	if ((buf=(unsigned char *)Malloc(num)) == NULL)
                                  ^
119.   		{
120.   		RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT,ERR_R_MALLOC_FAILURE);

crypto/rsa/rsa_eay.c:118:7: Assignment
116.   	if ((ctx=BN_CTX_new()) == NULL) goto err;
117.   	num=BN_num_bytes(rsa->n);
118.   	if ((buf=(unsigned char *)Malloc(num)) == NULL)
             ^
119.   		{
120.   		RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT,ERR_R_MALLOC_FAILURE);

crypto/rsa/rsa_eay.c:130:12: Call
128.   		break;
129.   	case RSA_PKCS1_OAEP_PADDING:
130.   	        i=RSA_padding_add_PKCS1_OAEP(buf,num,from,flen,NULL,0);
                  ^
131.   		break;
132.   	case RSA_SSLV23_PADDING:

crypto/rsa/rsa_oaep.c:64:10: <Offset trace>
62.   
63.       MGF1(seedmask, SHA_DIGEST_LENGTH, db, emlen - SHA_DIGEST_LENGTH);
64.       for (i = 0; i < SHA_DIGEST_LENGTH; i++)
               ^
65.   	seed[i] ^= seedmask[i];
66.   

crypto/rsa/rsa_oaep.c:64:10: Assignment
  62.   
  63.       MGF1(seedmask, SHA_DIGEST_LENGTH, db, emlen - SHA_DIGEST_LENGTH);
  64.       for (i = 0; i < SHA_DIGEST_LENGTH; i++)
                 ^
  65.   	seed[i] ^= seedmask[i];
  66.   

crypto/rsa/rsa_oaep.c:16:1: <Length trace>
14.   int MGF1(unsigned char *mask, long len, unsigned char *seed, long seedlen);
15.   
16. > int RSA_padding_add_PKCS1_OAEP(unsigned char *to, int tlen,
17.   	     unsigned char *from, int flen, unsigned char *param, int plen)
18.       {

crypto/rsa/rsa_oaep.c:16:1: Parameter `*to`
  14.   int MGF1(unsigned char *mask, long len, unsigned char *seed, long seedlen);
  15.   
  16. > int RSA_padding_add_PKCS1_OAEP(unsigned char *to, int tlen,
  17.   	     unsigned char *from, int flen, unsigned char *param, int plen)
  18.       {

crypto/rsa/rsa_oaep.c:44:5: Assignment
  42.   
  43.       to[0] = 0;
  44.       seed = to + 1;
            ^
  45.       db = to + SHA_DIGEST_LENGTH + 1;
  46.   

crypto/rsa/rsa_oaep.c:65:2: Array access: Offset: [1, 20] (⇐ 1 + [0, 19]) Size: [0, +oo] by call to `RSA_padding_add_PKCS1_OAEP` 
  63.       MGF1(seedmask, SHA_DIGEST_LENGTH, db, emlen - SHA_DIGEST_LENGTH);
  64.       for (i = 0; i < SHA_DIGEST_LENGTH; i++)
  65.   	seed[i] ^= seedmask[i];
         ^
  66.   
  67.       Free(dbmask);

int RSA_padding_add_PKCS1_OAEP(unsigned char *to, int tlen,
	     unsigned char *from, int flen, unsigned char *param, int plen)
    {
    int i, emlen = tlen - 1;
    unsigned char *db, *seed;
    unsigned char *dbmask, seedmask[SHA_DIGEST_LENGTH];
    if (flen > emlen - 2 * SHA_DIGEST_LENGTH - 1)
	{
	RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_OAEP,
	       RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE);
	return (0);
	}
    if (emlen < 2 * SHA_DIGEST_LENGTH + 1)
	{
	RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_OAEP, RSA_R_KEY_SIZE_TOO_SMALL);
	return (0);
	}
    dbmask = Malloc(emlen - SHA_DIGEST_LENGTH);
    if (dbmask == NULL)
	{
	RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_OAEP, ERR_R_MALLOC_FAILURE);
	return (0);
	}
    to[0] = 0;
    seed = to + 1;
    db = to + SHA_DIGEST_LENGTH + 1;
    SHA1(param, plen, db);
    memset(db + SHA_DIGEST_LENGTH, 0,
	   emlen - flen - 2 * SHA_DIGEST_LENGTH - 1);
    db[emlen - flen - SHA_DIGEST_LENGTH - 1] = 0x01;
    memcpy(db + emlen - flen - SHA_DIGEST_LENGTH, from, (unsigned int) flen);
    RAND_bytes(seed, SHA_DIGEST_LENGTH);
#ifdef PKCS_TESTVECT
    memcpy(seed,
	   "\xaa\xfd\x12\xf6\x59\xca\xe6\x34\x89\xb4\x79\xe5\x07\x6d\xde\xc2\xf0\x6c\xb5\x8f",
	   20);
#endif
    MGF1(dbmask, emlen - SHA_DIGEST_LENGTH, seed, SHA_DIGEST_LENGTH);
    for (i = 0; i < emlen - SHA_DIGEST_LENGTH; i++)
	db[i] ^= dbmask[i];
    MGF1(seedmask, SHA_DIGEST_LENGTH, db, emlen - SHA_DIGEST_LENGTH);
    for (i = 0; i < SHA_DIGEST_LENGTH; i++)
	seed[i] ^= seedmask[i];
    Free(dbmask);
    return (1);
    }
['static int RSA_eay_public_encrypt(int flen, unsigned char *from,\n\t     unsigned char *to, RSA *rsa, int padding)\n\t{\n\tBIGNUM f,ret;\n\tint i,j,k,num=0,r= -1;\n\tunsigned char *buf=NULL;\n\tBN_CTX *ctx=NULL;\n\tBN_init(&f);\n\tBN_init(&ret);\n\tif ((ctx=BN_CTX_new()) == NULL) goto err;\n\tnum=BN_num_bytes(rsa->n);\n\tif ((buf=(unsigned char *)Malloc(num)) == NULL)\n\t\t{\n\t\tRSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT,ERR_R_MALLOC_FAILURE);\n\t\tgoto err;\n\t\t}\n\tswitch (padding)\n\t\t{\n\tcase RSA_PKCS1_PADDING:\n\t\ti=RSA_padding_add_PKCS1_type_2(buf,num,from,flen);\n\t\tbreak;\n\tcase RSA_PKCS1_OAEP_PADDING:\n\t        i=RSA_padding_add_PKCS1_OAEP(buf,num,from,flen,NULL,0);\n\t\tbreak;\n\tcase RSA_SSLV23_PADDING:\n\t\ti=RSA_padding_add_SSLv23(buf,num,from,flen);\n\t\tbreak;\n\tcase RSA_NO_PADDING:\n\t\ti=RSA_padding_add_none(buf,num,from,flen);\n\t\tbreak;\n\tdefault:\n\t\tRSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT,RSA_R_UNKNOWN_PADDING_TYPE);\n\t\tgoto err;\n\t\t}\n\tif (i <= 0) goto err;\n\tif (BN_bin2bn(buf,num,&f) == NULL) goto err;\n\tif ((rsa->_method_mod_n == NULL) && (rsa->flags & RSA_FLAG_CACHE_PUBLIC))\n\t\t{\n\t\tif ((rsa->_method_mod_n=BN_MONT_CTX_new()) != NULL)\n\t\t\tif (!BN_MONT_CTX_set(rsa->_method_mod_n,rsa->n,ctx))\n\t\t\t    goto err;\n\t\t}\n\tif (!rsa->meth->bn_mod_exp(&ret,&f,rsa->e,rsa->n,ctx,\n\t\trsa->_method_mod_n)) goto err;\n\tj=BN_num_bytes(&ret);\n\ti=BN_bn2bin(&ret,&(to[num-j]));\n\tfor (k=0; k<(num-i); k++)\n\t\tto[k]=0;\n\tr=num;\nerr:\n\tif (ctx != NULL) BN_CTX_free(ctx);\n\tBN_clear_free(&f);\n\tBN_clear_free(&ret);\n\tif (buf != NULL)\n\t\t{\n\t\tmemset(buf,0,num);\n\t\tFree(buf);\n\t\t}\n\treturn(r);\n\t}', 'int BN_num_bits(BIGNUM *a)\n\t{\n\tBN_ULONG l;\n\tint i;\n\tbn_check_top(a);\n\tif (a->top == 0) return(0);\n\tl=a->d[a->top-1];\n\ti=(a->top-1)*BN_BITS2;\n\tif (l == 0)\n\t\t{\n#if !defined(NO_STDIO) && !defined(WIN16)\n\t\tfprintf(stderr,"BAD TOP VALUE\\n");\n#endif\n\t\tabort();\n\t\t}\n\treturn(i+BN_num_bits_word(l));\n\t}', 'int RSA_padding_add_PKCS1_OAEP(unsigned char *to, int tlen,\n\t     unsigned char *from, int flen, unsigned char *param, int plen)\n    {\n    int i, emlen = tlen - 1;\n    unsigned char *db, *seed;\n    unsigned char *dbmask, seedmask[SHA_DIGEST_LENGTH];\n    if (flen > emlen - 2 * SHA_DIGEST_LENGTH - 1)\n\t{\n\tRSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_OAEP,\n\t       RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE);\n\treturn (0);\n\t}\n    if (emlen < 2 * SHA_DIGEST_LENGTH + 1)\n\t{\n\tRSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_OAEP, RSA_R_KEY_SIZE_TOO_SMALL);\n\treturn (0);\n\t}\n    dbmask = Malloc(emlen - SHA_DIGEST_LENGTH);\n    if (dbmask == NULL)\n\t{\n\tRSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_OAEP, ERR_R_MALLOC_FAILURE);\n\treturn (0);\n\t}\n    to[0] = 0;\n    seed = to + 1;\n    db = to + SHA_DIGEST_LENGTH + 1;\n    SHA1(param, plen, db);\n    memset(db + SHA_DIGEST_LENGTH, 0,\n\t   emlen - flen - 2 * SHA_DIGEST_LENGTH - 1);\n    db[emlen - flen - SHA_DIGEST_LENGTH - 1] = 0x01;\n    memcpy(db + emlen - flen - SHA_DIGEST_LENGTH, from, (unsigned int) flen);\n    RAND_bytes(seed, SHA_DIGEST_LENGTH);\n#ifdef PKCS_TESTVECT\n    memcpy(seed,\n\t   "\\xaa\\xfd\\x12\\xf6\\x59\\xca\\xe6\\x34\\x89\\xb4\\x79\\xe5\\x07\\x6d\\xde\\xc2\\xf0\\x6c\\xb5\\x8f",\n\t   20);\n#endif\n    MGF1(dbmask, emlen - SHA_DIGEST_LENGTH, seed, SHA_DIGEST_LENGTH);\n    for (i = 0; i < emlen - SHA_DIGEST_LENGTH; i++)\n\tdb[i] ^= dbmask[i];\n    MGF1(seedmask, SHA_DIGEST_LENGTH, db, emlen - SHA_DIGEST_LENGTH);\n    for (i = 0; i < SHA_DIGEST_LENGTH; i++)\n\tseed[i] ^= seedmask[i];\n    Free(dbmask);\n    return (1);\n    }']