ssl/s3_srvr.c:2826: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 2):unsigned64 by call to `PACKET_get_bytes`.
Showing all 10 steps of the trace


ssl/s3_srvr.c:2810:10: Call
2808.   
2809.       /* we now have a signature that we need to verify */
2810.       if (!PACKET_buf_init(&pkt, s->init_msg, n)) {
                 ^
2811.           SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, ERR_R_INTERNAL_ERROR);
2812.           al = SSL_AD_INTERNAL_ERROR;

ssl/packet_locl.h:110:8: Parameter `pkt->remaining`
  108.    * is being used.
  109.    */
  110.   __owur static inline int PACKET_buf_init(PACKET *pkt, unsigned char *buf,
                ^
  111.                                            size_t len)
  112.   {

ssl/s3_srvr.c:2826:18: Call
2824.               int rv;
2825.   
2826.               if (!PACKET_get_bytes(&pkt, &sig, 2)) {
                         ^
2827.                   al = SSL_AD_DECODE_ERROR;
2828.                   goto f_err;

ssl/packet_locl.h:332:8: Parameter `len`
  330.    * freed
  331.    */
  332.   __owur static inline int PACKET_get_bytes(PACKET *pkt, unsigned char **data,
                ^
  333.                                             size_t len)
  334.   {

ssl/packet_locl.h:338:5: Call
  336.           return 0;
  337.   
  338.       packet_forward(pkt, len);
             ^
  339.   
  340.       return 1;

ssl/packet_locl.h:80:1: <LHS trace>
78.   
79.   /* Internal unchecked shorthand; don't use outside this file. */
80. > static inline void packet_forward(PACKET *pkt, size_t len)
81.   {
82.       pkt->curr += len;

ssl/packet_locl.h:80:1: Parameter `pkt->remaining`
    78.   
    79.   /* Internal unchecked shorthand; don't use outside this file. */
    80. > static inline void packet_forward(PACKET *pkt, size_t len)
    81.   {
    82.       pkt->curr += len;

ssl/packet_locl.h:80:1: <RHS trace>
78.   
79.   /* Internal unchecked shorthand; don't use outside this file. */
80. > static inline void packet_forward(PACKET *pkt, size_t len)
81.   {
82.       pkt->curr += len;

ssl/packet_locl.h:80:1: Parameter `len`
    78.   
    79.   /* Internal unchecked shorthand; don't use outside this file. */
    80. > static inline void packet_forward(PACKET *pkt, size_t len)
    81.   {
    82.       pkt->curr += len;

ssl/packet_locl.h:83:5: Binary operation: ([0, +oo] - 2):unsigned64 by call to `PACKET_get_bytes` 
    81.   {
    82.       pkt->curr += len;
    83.       pkt->remaining -= len;
              ^
    84.   }
    85.   

static inline void packet_forward(PACKET *pkt, size_t len)
{
    pkt->curr += len;
    pkt->remaining -= len;
}
['int ssl3_get_cert_verify(SSL *s)\n{\n    EVP_PKEY *pkey = NULL;\n    unsigned char *sig, *data;\n    int al, ok, ret = 0;\n    long n;\n    int type = 0, i, j;\n    unsigned int len;\n    X509 *peer;\n    const EVP_MD *md = NULL;\n    EVP_MD_CTX mctx;\n    PACKET pkt;\n    EVP_MD_CTX_init(&mctx);\n    if (s->session->peer == NULL) {\n        ret = 1;\n        goto end;\n    }\n    n = s->method->ssl_get_message(s,\n                                   SSL3_ST_SR_CERT_VRFY_A,\n                                   SSL3_ST_SR_CERT_VRFY_B,\n                                   SSL3_MT_CERTIFICATE_VERIFY,\n                                   SSL3_RT_MAX_PLAIN_LENGTH, &ok);\n    if (!ok)\n        return ((int)n);\n    peer = s->session->peer;\n    pkey = X509_get_pubkey(peer);\n    type = X509_certificate_type(peer, pkey);\n    if (!(type & EVP_PKT_SIGN)) {\n        SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,\n               SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE);\n        al = SSL_AD_ILLEGAL_PARAMETER;\n        goto f_err;\n    }\n    if (!PACKET_buf_init(&pkt, s->init_msg, n)) {\n        SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, ERR_R_INTERNAL_ERROR);\n        al = SSL_AD_INTERNAL_ERROR;\n        goto f_err;\n    }\n    if (n == 64 && pkey->type == NID_id_GostR3410_2001) {\n        len = 64;\n    } else {\n        if (SSL_USE_SIGALGS(s)) {\n            int rv;\n            if (!PACKET_get_bytes(&pkt, &sig, 2)) {\n                al = SSL_AD_DECODE_ERROR;\n                goto f_err;\n            }\n            rv = tls12_check_peer_sigalg(&md, s, sig, pkey);\n            if (rv == -1) {\n                al = SSL_AD_INTERNAL_ERROR;\n                goto f_err;\n            } else if (rv == 0) {\n                al = SSL_AD_DECODE_ERROR;\n                goto f_err;\n            }\n#ifdef SSL_DEBUG\n            fprintf(stderr, "USING TLSv1.2 HASH %s\\n", EVP_MD_name(md));\n#endif\n        }\n        if (!PACKET_get_net_2(&pkt, &len)) {\n            SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, SSL_R_LENGTH_MISMATCH);\n            al = SSL_AD_DECODE_ERROR;\n            goto f_err;\n        }\n    }\n    j = EVP_PKEY_size(pkey);\n    if (((int)len > j) || ((int)PACKET_remaining(&pkt) > j) || (n <= 0)) {\n        SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, SSL_R_WRONG_SIGNATURE_SIZE);\n        al = SSL_AD_DECODE_ERROR;\n        goto f_err;\n    }\n    if (!PACKET_get_bytes(&pkt, &data, len)) {\n        SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, SSL_R_LENGTH_MISMATCH);\n        al = SSL_AD_DECODE_ERROR;\n        goto f_err;\n    }\n    if (SSL_USE_SIGALGS(s)) {\n        long hdatalen = 0;\n        void *hdata;\n        hdatalen = BIO_get_mem_data(s->s3->handshake_buffer, &hdata);\n        if (hdatalen <= 0) {\n            SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, ERR_R_INTERNAL_ERROR);\n            al = SSL_AD_INTERNAL_ERROR;\n            goto f_err;\n        }\n#ifdef SSL_DEBUG\n        fprintf(stderr, "Using TLS 1.2 with client verify alg %s\\n",\n                EVP_MD_name(md));\n#endif\n        if (!EVP_VerifyInit_ex(&mctx, md, NULL)\n            || !EVP_VerifyUpdate(&mctx, hdata, hdatalen)) {\n            SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, ERR_R_EVP_LIB);\n            al = SSL_AD_INTERNAL_ERROR;\n            goto f_err;\n        }\n        if (EVP_VerifyFinal(&mctx, data, len, pkey) <= 0) {\n            al = SSL_AD_DECRYPT_ERROR;\n            SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, SSL_R_BAD_SIGNATURE);\n            goto f_err;\n        }\n    } else\n#ifndef OPENSSL_NO_RSA\n    if (pkey->type == EVP_PKEY_RSA) {\n        i = RSA_verify(NID_md5_sha1, s->s3->tmp.cert_verify_md,\n                       MD5_DIGEST_LENGTH + SHA_DIGEST_LENGTH, data, len,\n                       pkey->pkey.rsa);\n        if (i < 0) {\n            al = SSL_AD_DECRYPT_ERROR;\n            SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, SSL_R_BAD_RSA_DECRYPT);\n            goto f_err;\n        }\n        if (i == 0) {\n            al = SSL_AD_DECRYPT_ERROR;\n            SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, SSL_R_BAD_RSA_SIGNATURE);\n            goto f_err;\n        }\n    } else\n#endif\n#ifndef OPENSSL_NO_DSA\n    if (pkey->type == EVP_PKEY_DSA) {\n        j = DSA_verify(pkey->save_type,\n                       &(s->s3->tmp.cert_verify_md[MD5_DIGEST_LENGTH]),\n                       SHA_DIGEST_LENGTH, data, len, pkey->pkey.dsa);\n        if (j <= 0) {\n            al = SSL_AD_DECRYPT_ERROR;\n            SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, SSL_R_BAD_DSA_SIGNATURE);\n            goto f_err;\n        }\n    } else\n#endif\n#ifndef OPENSSL_NO_EC\n    if (pkey->type == EVP_PKEY_EC) {\n        j = ECDSA_verify(pkey->save_type,\n                         &(s->s3->tmp.cert_verify_md[MD5_DIGEST_LENGTH]),\n                         SHA_DIGEST_LENGTH, data, len, pkey->pkey.ec);\n        if (j <= 0) {\n            al = SSL_AD_DECRYPT_ERROR;\n            SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, SSL_R_BAD_ECDSA_SIGNATURE);\n            goto f_err;\n        }\n    } else\n#endif\n    if (pkey->type == NID_id_GostR3410_2001) {\n        unsigned char signature[64];\n        int idx;\n        EVP_PKEY_CTX *pctx = EVP_PKEY_CTX_new(pkey, NULL);\n        EVP_PKEY_verify_init(pctx);\n        if (len != 64) {\n            fprintf(stderr, "GOST signature length is %d", len);\n        }\n        for (idx = 0; idx < 64; idx++) {\n            signature[63 - idx] = data[idx];\n        }\n        j = EVP_PKEY_verify(pctx, signature, 64, s->s3->tmp.cert_verify_md,\n                            32);\n        EVP_PKEY_CTX_free(pctx);\n        if (j <= 0) {\n            al = SSL_AD_DECRYPT_ERROR;\n            SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, SSL_R_BAD_ECDSA_SIGNATURE);\n            goto f_err;\n        }\n    } else {\n        SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, ERR_R_INTERNAL_ERROR);\n        al = SSL_AD_UNSUPPORTED_CERTIFICATE;\n        goto f_err;\n    }\n    ret = 1;\n    if (0) {\n f_err:\n        ssl3_send_alert(s, SSL3_AL_FATAL, al);\n        s->state = SSL_ST_ERR;\n    }\n end:\n    BIO_free(s->s3->handshake_buffer);\n    s->s3->handshake_buffer = NULL;\n    EVP_MD_CTX_cleanup(&mctx);\n    EVP_PKEY_free(pkey);\n    return (ret);\n}', '__owur static inline int PACKET_buf_init(PACKET *pkt, unsigned char *buf,\n                                         size_t len)\n{\n    if (len > (size_t)(SIZE_MAX / 2))\n        return 0;\n    pkt->curr = buf;\n    pkt->remaining = len;\n    return 1;\n}', '__owur static inline int PACKET_get_bytes(PACKET *pkt, unsigned char **data,\n                                          size_t len)\n{\n    if (!PACKET_peek_bytes(pkt, data, len))\n        return 0;\n    packet_forward(pkt, len);\n    return 1;\n}', 'static inline void packet_forward(PACKET *pkt, size_t len)\n{\n    pkt->curr += len;\n    pkt->remaining -= len;\n}']