test/ecdsatest.c:212: error: BUFFER_OVERRUN_L2
  Offset: [0, 536870912] (⇐ [0, 1] + [0, 536870911]) Size: 57 by call to `x9_62_test_internal`.
Showing all 8 steps of the trace


test/ecdsatest.c:212:10: Call
210.   
211.   # ifndef OPENSSL_NO_EC2M
212.       if (!TEST_true(x9_62_test_internal(NID_X9_62_c2tnb191v1,
                ^
213.                    "87194383164871543355722284926904419997237591535066528048",
214.                    "308992691965804947361541664549085895292153777025772063598")))

test/ecdsatest.c:126:1: Parameter `*r_in`
  124.   
  125.   /* some tests from the X9.62 draft */
  126. > static int x9_62_test_internal(int nid, const char *r_in, const char *s_in)
  127.   {
  128.       int ret = 0;

test/ecdsatest.c:168:10: Call
  166.       if (!TEST_ptr(r = BN_new()) || !TEST_ptr(s = BN_new()))
  167.           goto x962_int_err;
  168.       if (!TEST_true(BN_dec2bn(&r, r_in)) || !TEST_true(BN_dec2bn(&s, s_in)))
                  ^
  169.           goto x962_int_err;
  170.       ECDSA_SIG_get0(signature, &sig_r, &sig_s);

crypto/bn/bn_print.c:213:10: <Offset trace>
211.       }
212.   
213.       for (i = 0; i <= (INT_MAX/4) && isdigit((unsigned char)a[i]); i++)
                ^
214.           continue;
215.   

crypto/bn/bn_print.c:213:10: Assignment
    211.       }
    212.   
    213.       for (i = 0; i <= (INT_MAX/4) && isdigit((unsigned char)a[i]); i++)
                    ^
    214.           continue;
    215.   

crypto/bn/bn_print.c:199:1: <Length trace>
197.   }
198.   
199. > int BN_dec2bn(BIGNUM **bn, const char *a)
200.   {
201.       BIGNUM *ret = NULL;

crypto/bn/bn_print.c:199:1: Parameter `*a`
    197.   }
    198.   
    199. > int BN_dec2bn(BIGNUM **bn, const char *a)
    200.   {
    201.       BIGNUM *ret = NULL;

crypto/bn/bn_print.c:213:37: Array access: Offset: [0, 536870912] (⇐ [0, 1] + [0, 536870911]) Size: 57 by call to `x9_62_test_internal` 
    211.       }
    212.   
    213.       for (i = 0; i <= (INT_MAX/4) && isdigit((unsigned char)a[i]); i++)
                                               ^
    214.           continue;
    215.   

int BN_dec2bn(BIGNUM **bn, const char *a)
{
    BIGNUM *ret = NULL;
    BN_ULONG l = 0;
    int neg = 0, i, j;
    int num;
    if ((a == NULL) || (*a == '\0'))
        return (0);
    if (*a == '-') {
        neg = 1;
        a++;
    }
    for (i = 0; i <= (INT_MAX/4) && isdigit((unsigned char)a[i]); i++)
        continue;
    if (i == 0 || i > INT_MAX/4)
        goto err;
    num = i + neg;
    if (bn == NULL)
        return (num);
    if (*bn == NULL) {
        if ((ret = BN_new()) == NULL)
            return (0);
    } else {
        ret = *bn;
        BN_zero(ret);
    }
    if (bn_expand(ret, i * 4) == NULL)
        goto err;
    j = BN_DEC_NUM - (i % BN_DEC_NUM);
    if (j == BN_DEC_NUM)
        j = 0;
    l = 0;
    while (--i >= 0) {
        l *= 10;
        l += *a - '0';
        a++;
        if (++j == BN_DEC_NUM) {
            if (!BN_mul_word(ret, BN_DEC_CONV)
                || !BN_add_word(ret, l))
                goto err;
            l = 0;
            j = 0;
        }
    }
    bn_correct_top(ret);
    *bn = ret;
    bn_check_top(ret);
    if (ret->top != 0)
        ret->neg = neg;
    return (num);
 err:
    if (*bn == NULL)
        BN_free(ret);
    return (0);
}
['static int x9_62_tests()\n{\n    int ret = 0;\n    if (!change_rand())\n        goto x962_err;\n    if (!TEST_true(x9_62_test_internal(NID_X9_62_prime192v1,\n                 "3342403536405981729393488334694600415596881826869351677613",\n                 "5735822328888155254683894997897571951568553642892029982342")))\n        goto x962_err;\n    if (!TEST_true(x9_62_test_internal(NID_X9_62_prime239v1,\n                 "3086361431751678114926225473006680188549593787585317781474"\n                             "62058306432176",\n                 "3238135532097973577080787768312505059318910517550078427819"\n                             "78505179448783")))\n        goto x962_err;\n# ifndef OPENSSL_NO_EC2M\n    if (!TEST_true(x9_62_test_internal(NID_X9_62_c2tnb191v1,\n                 "87194383164871543355722284926904419997237591535066528048",\n                 "308992691965804947361541664549085895292153777025772063598")))\n        goto x962_err;\n    if (!TEST_true(x9_62_test_internal(NID_X9_62_c2tnb239v1,\n                 "2159633321041961198501834003903461262881815148684178964245"\n                             "5876922391552",\n                 "1970303740007316867383349976549972270528498040721988191026"\n                             "49413465737174")))\n        goto x962_err;\n# endif\n    ret = 1;\n x962_err:\n    if (!TEST_true(restore_rand()))\n        ret = 0;\n    return ret;\n}', 'static int x9_62_test_internal(int nid, const char *r_in, const char *s_in)\n{\n    int ret = 0;\n    const char message[] = "abc";\n    unsigned char digest[20];\n    unsigned int dgst_len = 0;\n    EVP_MD_CTX *md_ctx;\n    EC_KEY *key = NULL;\n    ECDSA_SIG *signature = NULL;\n    BIGNUM *r = NULL, *s = NULL;\n    BIGNUM *kinv = NULL, *rp = NULL;\n    const BIGNUM *sig_r, *sig_s;\n    if (!TEST_ptr(md_ctx = EVP_MD_CTX_new()))\n        goto x962_int_err;\n    if (!TEST_true(EVP_DigestInit(md_ctx, EVP_sha1()))\n        || !TEST_true(EVP_DigestUpdate(md_ctx, (const void *)message, 3))\n        || !TEST_true(EVP_DigestFinal(md_ctx, digest, &dgst_len)))\n        goto x962_int_err;\n    TEST_info("testing %s", OBJ_nid2sn(nid));\n    if (!TEST_ptr(key = EC_KEY_new_by_curve_name(nid)))\n        goto x962_int_err;\n    use_fake = 1;\n    if (!TEST_true(EC_KEY_generate_key(key)))\n        goto x962_int_err;\n    use_fake = 1;\n    if (!TEST_true(ECDSA_sign_setup(key, NULL, &kinv, &rp)))\n        goto x962_int_err;\n    if (!TEST_ptr(signature = ECDSA_do_sign_ex(digest, 20, kinv, rp, key)))\n        goto x962_int_err;\n    if (!TEST_ptr(r = BN_new()) || !TEST_ptr(s = BN_new()))\n        goto x962_int_err;\n    if (!TEST_true(BN_dec2bn(&r, r_in)) || !TEST_true(BN_dec2bn(&s, s_in)))\n        goto x962_int_err;\n    ECDSA_SIG_get0(signature, &sig_r, &sig_s);\n    if (!TEST_int_eq(BN_cmp(sig_r, r), 0)\n            || !TEST_int_eq(BN_cmp(sig_s, s), 0))\n        goto x962_int_err;\n    if (!TEST_int_eq(ECDSA_do_verify(digest, 20, signature, key), 1))\n        goto x962_int_err;\n    ret = 1;\n x962_int_err:\n    EC_KEY_free(key);\n    ECDSA_SIG_free(signature);\n    BN_free(r);\n    BN_free(s);\n    EVP_MD_CTX_free(md_ctx);\n    BN_clear_free(kinv);\n    BN_clear_free(rp);\n    return ret;\n}', "int BN_dec2bn(BIGNUM **bn, const char *a)\n{\n    BIGNUM *ret = NULL;\n    BN_ULONG l = 0;\n    int neg = 0, i, j;\n    int num;\n    if ((a == NULL) || (*a == '\\0'))\n        return (0);\n    if (*a == '-') {\n        neg = 1;\n        a++;\n    }\n    for (i = 0; i <= (INT_MAX/4) && isdigit((unsigned char)a[i]); i++)\n        continue;\n    if (i == 0 || i > INT_MAX/4)\n        goto err;\n    num = i + neg;\n    if (bn == NULL)\n        return (num);\n    if (*bn == NULL) {\n        if ((ret = BN_new()) == NULL)\n            return (0);\n    } else {\n        ret = *bn;\n        BN_zero(ret);\n    }\n    if (bn_expand(ret, i * 4) == NULL)\n        goto err;\n    j = BN_DEC_NUM - (i % BN_DEC_NUM);\n    if (j == BN_DEC_NUM)\n        j = 0;\n    l = 0;\n    while (--i >= 0) {\n        l *= 10;\n        l += *a - '0';\n        a++;\n        if (++j == BN_DEC_NUM) {\n            if (!BN_mul_word(ret, BN_DEC_CONV)\n                || !BN_add_word(ret, l))\n                goto err;\n            l = 0;\n            j = 0;\n        }\n    }\n    bn_correct_top(ret);\n    *bn = ret;\n    bn_check_top(ret);\n    if (ret->top != 0)\n        ret->neg = neg;\n    return (num);\n err:\n    if (*bn == NULL)\n        BN_free(ret);\n    return (0);\n}"]