crypto/srp/srp_vfy.c:314: error: INTEGER_OVERFLOW_L2
  ([0, 2147483646] + 4):signed32 by call to `SRP_user_pwd_set_sv`.
Showing all 13 steps of the trace


crypto/srp/srp_vfy.c:309:22: Call
307.   
308.                   SRP_user_pwd_set_gN(user_pwd, lgN->g, lgN->N);
309.                   if (!SRP_user_pwd_set_ids
                            ^
310.                       (user_pwd, pp[DB_srpid], pp[DB_srpinfo]))
311.                       goto err;

crypto/srp/srp_vfy.c:76:1: Parameter `id->strlen`
  74.   }
  75.   
  76. > static int SRP_user_pwd_set_ids(SRP_user_pwd *vinfo, const char *id,
  77.                                   const char *info)
  78.   {

crypto/srp/srp_vfy.c:79:44: Call
  77.                                   const char *info)
  78.   {
  79.       if (id != NULL && NULL == (vinfo->id = OPENSSL_strdup(id)))
                                                   ^
  80.           return 0;
  81.       return (info == NULL || NULL != (vinfo->info = OPENSSL_strdup(info)));

crypto/o_str.c:27:1: Parameter `str->strlen`
    25.   }
    26.   
    27. > char *CRYPTO_strdup(const char *str, const char* file, int line)
    28.   {
    29.       char *ret;

crypto/srp/srp_vfy.c:314:22: Call
312.   
313.                   error_code = SRP_ERR_VBASE_BN_LIB;
314.                   if (!SRP_user_pwd_set_sv
                            ^
315.                       (user_pwd, pp[DB_srpsalt], pp[DB_srpverifier]))
316.                       goto err;

crypto/srp/srp_vfy.c:84:1: Parameter `v->strlen`
  82.   }
  83.   
  84. > static int SRP_user_pwd_set_sv(SRP_user_pwd *vinfo, const char *s,
  85.                                  const char *v)
  86.   {

crypto/srp/srp_vfy.c:93:11: Call
  91.       vinfo->s = NULL;
  92.   
  93.       len = t_fromb64(tmp, sizeof(tmp), v);
                  ^
  94.       if (len < 0)
  95.           return 0;

crypto/srp/srp_vfy.c:25:1: Parameter `src->strlen`
    23.    * Convert a base64 string into raw byte array representation.
    24.    */
    25. > static int t_fromb64(unsigned char *a, size_t alen, const char *src)
    26.   {
    27.       size_t size = strlen(src);

crypto/srp/srp_vfy.c:27:5: Assignment
    25.   static int t_fromb64(unsigned char *a, size_t alen, const char *src)
    26.   {
    27.       size_t size = strlen(src);
              ^
    28.   
    29.       /* Four bytes in src become three bytes output. */

crypto/srp/srp_vfy.c:33:12: Call
    31.           return -1;
    32.   
    33.       return EVP_DecodeBlock(a, (unsigned char *)src, (int)size);
                     ^
    34.   }
    35.   

crypto/evp/encode.c:351:1: <LHS trace>
349.   }
350.   
351. > int EVP_DecodeBlock(unsigned char *t, const unsigned char *f, int n)
352.   {
353.       int i, ret = 0, a, b, c, d;

crypto/evp/encode.c:351:1: Parameter `n`
      349.   }
      350.   
      351. > int EVP_DecodeBlock(unsigned char *t, const unsigned char *f, int n)
      352.   {
      353.       int i, ret = 0, a, b, c, d;

crypto/evp/encode.c:372:24: Binary operation: ([0, 2147483646] + 4):signed32 by call to `SRP_user_pwd_set_sv` 
      370.           return (-1);
      371.   
      372.       for (i = 0; i < n; i += 4) {
                                    ^
      373.           a = conv_ascii2bin(*(f++));
      374.           b = conv_ascii2bin(*(f++));

int EVP_DecodeBlock(unsigned char *t, const unsigned char *f, int n)
{
    int i, ret = 0, a, b, c, d;
    unsigned long l;
    while ((conv_ascii2bin(*f) == B64_WS) && (n > 0)) {
        f++;
        n--;
    }
    while ((n > 3) && (B64_NOT_BASE64(conv_ascii2bin(f[n - 1]))))
        n--;
    if (n % 4 != 0)
        return (-1);
    for (i = 0; i < n; i += 4) {
        a = conv_ascii2bin(*(f++));
        b = conv_ascii2bin(*(f++));
        c = conv_ascii2bin(*(f++));
        d = conv_ascii2bin(*(f++));
        if ((a & 0x80) || (b & 0x80) || (c & 0x80) || (d & 0x80))
            return (-1);
        l = ((((unsigned long)a) << 18L) |
             (((unsigned long)b) << 12L) |
             (((unsigned long)c) << 6L) | (((unsigned long)d)));
        *(t++) = (unsigned char)(l >> 16L) & 0xff;
        *(t++) = (unsigned char)(l >> 8L) & 0xff;
        *(t++) = (unsigned char)(l) & 0xff;
        ret += 3;
    }
    return (ret);
}
['int SRP_VBASE_init(SRP_VBASE *vb, char *verifier_file)\n{\n    int error_code;\n    STACK_OF(SRP_gN) *SRP_gN_tab = sk_SRP_gN_new_null();\n    char *last_index = NULL;\n    int i;\n    char **pp;\n    SRP_gN *gN = NULL;\n    SRP_user_pwd *user_pwd = NULL;\n    TXT_DB *tmpdb = NULL;\n    BIO *in = BIO_new(BIO_s_file());\n    error_code = SRP_ERR_OPEN_FILE;\n    if (in == NULL || BIO_read_filename(in, verifier_file) <= 0)\n        goto err;\n    error_code = SRP_ERR_VBASE_INCOMPLETE_FILE;\n    if ((tmpdb = TXT_DB_read(in, DB_NUMBER)) == NULL)\n        goto err;\n    error_code = SRP_ERR_MEMORY;\n    if (vb->seed_key) {\n        last_index = SRP_get_default_gN(NULL)->id;\n    }\n    for (i = 0; i < sk_OPENSSL_PSTRING_num(tmpdb->data); i++) {\n        pp = sk_OPENSSL_PSTRING_value(tmpdb->data, i);\n        if (pp[DB_srptype][0] == DB_SRP_INDEX) {\n            if ((gN = OPENSSL_malloc(sizeof(*gN))) == NULL)\n                goto err;\n            if ((gN->id = OPENSSL_strdup(pp[DB_srpid])) == NULL\n                || (gN->N = SRP_gN_place_bn(vb->gN_cache, pp[DB_srpverifier]))\n                        == NULL\n                || (gN->g = SRP_gN_place_bn(vb->gN_cache, pp[DB_srpsalt]))\n                        == NULL\n                || sk_SRP_gN_insert(SRP_gN_tab, gN, 0) == 0)\n                goto err;\n            gN = NULL;\n            if (vb->seed_key != NULL) {\n                last_index = pp[DB_srpid];\n            }\n        } else if (pp[DB_srptype][0] == DB_SRP_VALID) {\n            const SRP_gN *lgN;\n            if ((lgN = SRP_get_gN_by_id(pp[DB_srpgN], SRP_gN_tab)) != NULL) {\n                error_code = SRP_ERR_MEMORY;\n                if ((user_pwd = SRP_user_pwd_new()) == NULL)\n                    goto err;\n                SRP_user_pwd_set_gN(user_pwd, lgN->g, lgN->N);\n                if (!SRP_user_pwd_set_ids\n                    (user_pwd, pp[DB_srpid], pp[DB_srpinfo]))\n                    goto err;\n                error_code = SRP_ERR_VBASE_BN_LIB;\n                if (!SRP_user_pwd_set_sv\n                    (user_pwd, pp[DB_srpsalt], pp[DB_srpverifier]))\n                    goto err;\n                if (sk_SRP_user_pwd_insert(vb->users_pwd, user_pwd, 0) == 0)\n                    goto err;\n                user_pwd = NULL;\n            }\n        }\n    }\n    if (last_index != NULL) {\n        if (((gN = SRP_get_gN_by_id(last_index, SRP_gN_tab)) == NULL)) {\n            error_code = SRP_ERR_VBASE_BN_LIB;\n            goto err;\n        }\n        vb->default_g = gN->g;\n        vb->default_N = gN->N;\n        gN = NULL;\n    }\n    error_code = SRP_NO_ERROR;\n err:\n    if (gN != NULL) {\n        OPENSSL_free(gN->id);\n        OPENSSL_free(gN);\n    }\n    SRP_user_pwd_free(user_pwd);\n    TXT_DB_free(tmpdb);\n    BIO_free_all(in);\n    sk_SRP_gN_free(SRP_gN_tab);\n    return error_code;\n}', 'static int SRP_user_pwd_set_ids(SRP_user_pwd *vinfo, const char *id,\n                                const char *info)\n{\n    if (id != NULL && NULL == (vinfo->id = OPENSSL_strdup(id)))\n        return 0;\n    return (info == NULL || NULL != (vinfo->info = OPENSSL_strdup(info)));\n}', 'char *CRYPTO_strdup(const char *str, const char* file, int line)\n{\n    char *ret;\n    if (str == NULL)\n        return NULL;\n    ret = CRYPTO_malloc(strlen(str) + 1, file, line);\n    if (ret != NULL)\n        strcpy(ret, str);\n    return ret;\n}', 'static int SRP_user_pwd_set_sv(SRP_user_pwd *vinfo, const char *s,\n                               const char *v)\n{\n    unsigned char tmp[MAX_LEN];\n    int len;\n    vinfo->v = NULL;\n    vinfo->s = NULL;\n    len = t_fromb64(tmp, sizeof(tmp), v);\n    if (len < 0)\n        return 0;\n    if (NULL == (vinfo->v = BN_bin2bn(tmp, len, NULL)))\n        return 0;\n    len = t_fromb64(tmp, sizeof(tmp), s);\n    if (len < 0)\n        goto err;\n    vinfo->s = BN_bin2bn(tmp, len, NULL);\n    if (vinfo->s == NULL)\n        goto err;\n    return 1;\n err:\n    BN_free(vinfo->v);\n    vinfo->v = NULL;\n    return 0;\n}', 'static int t_fromb64(unsigned char *a, size_t alen, const char *src)\n{\n    size_t size = strlen(src);\n    if (size > INT_MAX || (size / 4) * 3 > alen)\n        return -1;\n    return EVP_DecodeBlock(a, (unsigned char *)src, (int)size);\n}', 'int EVP_DecodeBlock(unsigned char *t, const unsigned char *f, int n)\n{\n    int i, ret = 0, a, b, c, d;\n    unsigned long l;\n    while ((conv_ascii2bin(*f) == B64_WS) && (n > 0)) {\n        f++;\n        n--;\n    }\n    while ((n > 3) && (B64_NOT_BASE64(conv_ascii2bin(f[n - 1]))))\n        n--;\n    if (n % 4 != 0)\n        return (-1);\n    for (i = 0; i < n; i += 4) {\n        a = conv_ascii2bin(*(f++));\n        b = conv_ascii2bin(*(f++));\n        c = conv_ascii2bin(*(f++));\n        d = conv_ascii2bin(*(f++));\n        if ((a & 0x80) || (b & 0x80) || (c & 0x80) || (d & 0x80))\n            return (-1);\n        l = ((((unsigned long)a) << 18L) |\n             (((unsigned long)b) << 12L) |\n             (((unsigned long)c) << 6L) | (((unsigned long)d)));\n        *(t++) = (unsigned char)(l >> 16L) & 0xff;\n        *(t++) = (unsigned char)(l >> 8L) & 0xff;\n        *(t++) = (unsigned char)(l) & 0xff;\n        ret += 3;\n    }\n    return (ret);\n}']