apps/ecparam.c:276: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned32 by call to `EC_GROUP_check_named_curve`.
Showing all 12 steps of the trace


apps/ecparam.c:276:13: Call
274.       if (check_named) {
275.           BIO_printf(bio_err, "validating named elliptic curve parameters: ");
276.           if (EC_GROUP_check_named_curve(group, 0, NULL) <= 0) {
                   ^
277.               BIO_printf(bio_err, "failed\n");
278.               ERR_print_errors(bio_err);

crypto/ec/ec_check.c:13:1: Parameter `ctx->stack.depth`
  11.   #include <openssl/err.h>
  12.   
  13. > int EC_GROUP_check_named_curve(const EC_GROUP *group, int nist_only,
  14.                                  BN_CTX *ctx)
  15.   {

crypto/ec/ec_check.c:29:11: Call
  27.   #endif
  28.   
  29.       nid = ec_curve_nid_from_params(group, ctx);
                  ^
  30.       if (nid > 0 && nist_only && EC_curve_nid2nist(nid) == NULL)
  31.           nid = NID_undef;

crypto/ec/ec_curve.c:3312:1: Parameter `ctx->stack.depth`
    3310.    *          if not found. If there was an error it returns -1.
    3311.    */
    3312. > int ec_curve_nid_from_params(const EC_GROUP *group, BN_CTX *ctx)
    3313.   {
    3314.       int ret = -1, nid, len, field_type, param_len;

crypto/ec/ec_curve.c:3335:5: Call
    3333.       cofactor = EC_GROUP_get0_cofactor(group);
    3334.   
    3335.       BN_CTX_start(ctx);
                ^
    3336.   
    3337.       /*

crypto/bn/bn_ctx.c:194:1: Parameter `ctx->stack.depth`
      192.   }
      193.   
      194. > void BN_CTX_start(BN_CTX *ctx)
      195.   {
      196.       CTXDBG("ENTER BN_CTX_start()", ctx);

crypto/ec/ec_curve.c:3411:5: Call
    3409.   end:
    3410.       OPENSSL_free(param_bytes);
    3411.       BN_CTX_end(ctx);
                ^
    3412.       return ret;
    3413.   }

crypto/bn/bn_ctx.c:208:1: Parameter `ctx->stack.depth`
      206.   }
      207.   
      208. > void BN_CTX_end(BN_CTX *ctx)
      209.   {
      210.       if (ctx == NULL)

crypto/bn/bn_ctx.c:216:27: Call
      214.           ctx->err_stack--;
      215.       else {
      216.           unsigned int fp = BN_STACK_pop(&ctx->stack);
                                       ^
      217.           /* Does this stack frame have anything to release? */
      218.           if (fp < ctx->used)

crypto/bn/bn_ctx.c:298:1: <LHS trace>
296.   }
297.   
298. > static unsigned int BN_STACK_pop(BN_STACK *st)
299.   {
300.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:298:1: Parameter `st->depth`
        296.   }
        297.   
        298. > static unsigned int BN_STACK_pop(BN_STACK *st)
        299.   {
        300.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:300:12: Binary operation: ([0, +oo] - 1):unsigned32 by call to `EC_GROUP_check_named_curve` 
        298.   static unsigned int BN_STACK_pop(BN_STACK *st)
        299.   {
        300.       return st->indexes[--(st->depth)];
                          ^
        301.   }
        302.   

static unsigned int BN_STACK_pop(BN_STACK *st)
{
    return st->indexes[--(st->depth)];
}
['int ecparam_main(int argc, char **argv)\n{\n    ENGINE *e = NULL;\n    BIGNUM *ec_gen = NULL, *ec_order = NULL, *ec_cofactor = NULL;\n    BIGNUM *ec_p = NULL, *ec_a = NULL, *ec_b = NULL;\n    BIO *in = NULL, *out = NULL;\n    EC_GROUP *group = NULL;\n    point_conversion_form_t form = POINT_CONVERSION_UNCOMPRESSED;\n    char *curve_name = NULL;\n    char *infile = NULL, *outfile = NULL, *prog;\n    unsigned char *buffer = NULL;\n    OPTION_CHOICE o;\n    int asn1_flag = OPENSSL_EC_NAMED_CURVE, new_asn1_flag = 0;\n    int informat = FORMAT_PEM, outformat = FORMAT_PEM, noout = 0, C = 0;\n    int ret = 1, private = 0;\n    int list_curves = 0, no_seed = 0, check = 0, new_form = 0;\n    int text = 0, i, genkey = 0, check_named = 0;\n    prog = opt_init(argc, argv, ecparam_options);\n    while ((o = opt_next()) != OPT_EOF) {\n        switch (o) {\n        case OPT_EOF:\n        case OPT_ERR:\n opthelp:\n            BIO_printf(bio_err, "%s: Use -help for summary.\\n", prog);\n            goto end;\n        case OPT_HELP:\n            opt_help(ecparam_options);\n            ret = 0;\n            goto end;\n        case OPT_INFORM:\n            if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &informat))\n                goto opthelp;\n            break;\n        case OPT_IN:\n            infile = opt_arg();\n            break;\n        case OPT_OUTFORM:\n            if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &outformat))\n                goto opthelp;\n            break;\n        case OPT_OUT:\n            outfile = opt_arg();\n            break;\n        case OPT_TEXT:\n            text = 1;\n            break;\n        case OPT_C:\n            C = 1;\n            break;\n        case OPT_CHECK:\n            check = 1;\n            break;\n        case OPT_CHECK_NAMED:\n            check_named = 1;\n            break;\n        case OPT_LIST_CURVES:\n            list_curves = 1;\n            break;\n        case OPT_NO_SEED:\n            no_seed = 1;\n            break;\n        case OPT_NOOUT:\n            noout = 1;\n            break;\n        case OPT_NAME:\n            curve_name = opt_arg();\n            break;\n        case OPT_CONV_FORM:\n            if (!opt_pair(opt_arg(), forms, &new_form))\n                goto opthelp;\n            form = new_form;\n            new_form = 1;\n            break;\n        case OPT_PARAM_ENC:\n            if (!opt_pair(opt_arg(), encodings, &asn1_flag))\n                goto opthelp;\n            new_asn1_flag = 1;\n            break;\n        case OPT_GENKEY:\n            genkey = 1;\n            break;\n        case OPT_R_CASES:\n            if (!opt_rand(o))\n                goto end;\n            break;\n        case OPT_ENGINE:\n            e = setup_engine(opt_arg(), 0);\n            break;\n        }\n    }\n    argc = opt_num_rest();\n    if (argc != 0)\n        goto opthelp;\n    private = genkey ? 1 : 0;\n    in = bio_open_default(infile, \'r\', informat);\n    if (in == NULL)\n        goto end;\n    out = bio_open_owner(outfile, outformat, private);\n    if (out == NULL)\n        goto end;\n    if (list_curves) {\n        EC_builtin_curve *curves = NULL;\n        size_t crv_len = EC_get_builtin_curves(NULL, 0);\n        size_t n;\n        curves = app_malloc((int)sizeof(*curves) * crv_len, "list curves");\n        if (!EC_get_builtin_curves(curves, crv_len)) {\n            OPENSSL_free(curves);\n            goto end;\n        }\n        for (n = 0; n < crv_len; n++) {\n            const char *comment;\n            const char *sname;\n            comment = curves[n].comment;\n            sname = OBJ_nid2sn(curves[n].nid);\n            if (comment == NULL)\n                comment = "CURVE DESCRIPTION NOT AVAILABLE";\n            if (sname == NULL)\n                sname = "";\n            BIO_printf(out, "  %-10s: ", sname);\n            BIO_printf(out, "%s\\n", comment);\n        }\n        OPENSSL_free(curves);\n        ret = 0;\n        goto end;\n    }\n    if (curve_name != NULL) {\n        int nid;\n        if (strcmp(curve_name, "secp192r1") == 0) {\n            BIO_printf(bio_err, "using curve name prime192v1 "\n                       "instead of secp192r1\\n");\n            nid = NID_X9_62_prime192v1;\n        } else if (strcmp(curve_name, "secp256r1") == 0) {\n            BIO_printf(bio_err, "using curve name prime256v1 "\n                       "instead of secp256r1\\n");\n            nid = NID_X9_62_prime256v1;\n        } else {\n            nid = OBJ_sn2nid(curve_name);\n        }\n        if (nid == 0)\n            nid = EC_curve_nist2nid(curve_name);\n        if (nid == 0) {\n            BIO_printf(bio_err, "unknown curve name (%s)\\n", curve_name);\n            goto end;\n        }\n        group = EC_GROUP_new_by_curve_name(nid);\n        if (group == NULL) {\n            BIO_printf(bio_err, "unable to create curve (%s)\\n", curve_name);\n            goto end;\n        }\n        EC_GROUP_set_asn1_flag(group, asn1_flag);\n        EC_GROUP_set_point_conversion_form(group, form);\n    } else if (informat == FORMAT_ASN1) {\n        group = d2i_ECPKParameters_bio(in, NULL);\n    } else {\n        group = PEM_read_bio_ECPKParameters(in, NULL, NULL, NULL);\n    }\n    if (group == NULL) {\n        BIO_printf(bio_err, "unable to load elliptic curve parameters\\n");\n        ERR_print_errors(bio_err);\n        goto end;\n    }\n    if (new_form)\n        EC_GROUP_set_point_conversion_form(group, form);\n    if (new_asn1_flag)\n        EC_GROUP_set_asn1_flag(group, asn1_flag);\n    if (no_seed) {\n        EC_GROUP_set_seed(group, NULL, 0);\n    }\n    if (text) {\n        if (!ECPKParameters_print(out, group, 0))\n            goto end;\n    }\n    if (check_named) {\n        BIO_printf(bio_err, "validating named elliptic curve parameters: ");\n        if (EC_GROUP_check_named_curve(group, 0, NULL) <= 0) {\n            BIO_printf(bio_err, "failed\\n");\n            ERR_print_errors(bio_err);\n            goto end;\n        }\n        BIO_printf(bio_err, "ok\\n");\n    }\n    if (check) {\n        BIO_printf(bio_err, "checking elliptic curve parameters: ");\n        if (!EC_GROUP_check(group, NULL)) {\n            BIO_printf(bio_err, "failed\\n");\n            ERR_print_errors(bio_err);\n            goto end;\n        }\n        BIO_printf(bio_err, "ok\\n");\n    }\n    if (C) {\n        size_t buf_len = 0, tmp_len = 0;\n        const EC_POINT *point;\n        int is_prime, len = 0;\n        const EC_METHOD *meth = EC_GROUP_method_of(group);\n        if ((ec_p = BN_new()) == NULL\n                || (ec_a = BN_new()) == NULL\n                || (ec_b = BN_new()) == NULL\n                || (ec_gen = BN_new()) == NULL\n                || (ec_order = BN_new()) == NULL\n                || (ec_cofactor = BN_new()) == NULL) {\n            perror("Can\'t allocate BN");\n            goto end;\n        }\n        is_prime = (EC_METHOD_get_field_type(meth) == NID_X9_62_prime_field);\n        if (!is_prime) {\n            BIO_printf(bio_err, "Can only handle X9.62 prime fields\\n");\n            goto end;\n        }\n        if (!EC_GROUP_get_curve(group, ec_p, ec_a, ec_b, NULL))\n            goto end;\n        if ((point = EC_GROUP_get0_generator(group)) == NULL)\n            goto end;\n        if (!EC_POINT_point2bn(group, point,\n                               EC_GROUP_get_point_conversion_form(group),\n                               ec_gen, NULL))\n            goto end;\n        if (!EC_GROUP_get_order(group, ec_order, NULL))\n            goto end;\n        if (!EC_GROUP_get_cofactor(group, ec_cofactor, NULL))\n            goto end;\n        if (!ec_p || !ec_a || !ec_b || !ec_gen || !ec_order || !ec_cofactor)\n            goto end;\n        len = BN_num_bits(ec_order);\n        if ((tmp_len = (size_t)BN_num_bytes(ec_p)) > buf_len)\n            buf_len = tmp_len;\n        if ((tmp_len = (size_t)BN_num_bytes(ec_a)) > buf_len)\n            buf_len = tmp_len;\n        if ((tmp_len = (size_t)BN_num_bytes(ec_b)) > buf_len)\n            buf_len = tmp_len;\n        if ((tmp_len = (size_t)BN_num_bytes(ec_gen)) > buf_len)\n            buf_len = tmp_len;\n        if ((tmp_len = (size_t)BN_num_bytes(ec_order)) > buf_len)\n            buf_len = tmp_len;\n        if ((tmp_len = (size_t)BN_num_bytes(ec_cofactor)) > buf_len)\n            buf_len = tmp_len;\n        buffer = app_malloc(buf_len, "BN buffer");\n        BIO_printf(out, "EC_GROUP *get_ec_group_%d(void)\\n{\\n", len);\n        print_bignum_var(out, ec_p, "ec_p", len, buffer);\n        print_bignum_var(out, ec_a, "ec_a", len, buffer);\n        print_bignum_var(out, ec_b, "ec_b", len, buffer);\n        print_bignum_var(out, ec_gen, "ec_gen", len, buffer);\n        print_bignum_var(out, ec_order, "ec_order", len, buffer);\n        print_bignum_var(out, ec_cofactor, "ec_cofactor", len, buffer);\n        BIO_printf(out, "    int ok = 0;\\n"\n                        "    EC_GROUP *group = NULL;\\n"\n                        "    EC_POINT *point = NULL;\\n"\n                        "    BIGNUM *tmp_1 = NULL;\\n"\n                        "    BIGNUM *tmp_2 = NULL;\\n"\n                        "    BIGNUM *tmp_3 = NULL;\\n"\n                        "\\n");\n        BIO_printf(out, "    if ((tmp_1 = BN_bin2bn(ec_p_%d, sizeof(ec_p_%d), NULL)) == NULL)\\n"\n                        "        goto err;\\n", len, len);\n        BIO_printf(out, "    if ((tmp_2 = BN_bin2bn(ec_a_%d, sizeof(ec_a_%d), NULL)) == NULL)\\n"\n                        "        goto err;\\n", len, len);\n        BIO_printf(out, "    if ((tmp_3 = BN_bin2bn(ec_b_%d, sizeof(ec_b_%d), NULL)) == NULL)\\n"\n                        "        goto err;\\n", len, len);\n        BIO_printf(out, "    if ((group = EC_GROUP_new_curve_GFp(tmp_1, tmp_2, tmp_3, NULL)) == NULL)\\n"\n                        "        goto err;\\n"\n                        "\\n");\n        BIO_printf(out, "    /* build generator */\\n");\n        BIO_printf(out, "    if ((tmp_1 = BN_bin2bn(ec_gen_%d, sizeof(ec_gen_%d), tmp_1)) == NULL)\\n"\n                        "        goto err;\\n", len, len);\n        BIO_printf(out, "    point = EC_POINT_bn2point(group, tmp_1, NULL, NULL);\\n");\n        BIO_printf(out, "    if (point == NULL)\\n"\n                        "        goto err;\\n");\n        BIO_printf(out, "    if ((tmp_2 = BN_bin2bn(ec_order_%d, sizeof(ec_order_%d), tmp_2)) == NULL)\\n"\n                        "        goto err;\\n", len, len);\n        BIO_printf(out, "    if ((tmp_3 = BN_bin2bn(ec_cofactor_%d, sizeof(ec_cofactor_%d), tmp_3)) == NULL)\\n"\n                        "        goto err;\\n", len, len);\n        BIO_printf(out, "    if (!EC_GROUP_set_generator(group, point, tmp_2, tmp_3))\\n"\n                        "        goto err;\\n"\n                        "ok = 1;"\n                        "\\n");\n        BIO_printf(out, "err:\\n"\n                        "    BN_free(tmp_1);\\n"\n                        "    BN_free(tmp_2);\\n"\n                        "    BN_free(tmp_3);\\n"\n                        "    EC_POINT_free(point);\\n"\n                        "    if (!ok) {\\n"\n                        "        EC_GROUP_free(group);\\n"\n                        "        return NULL;\\n"\n                        "    }\\n"\n                        "    return (group);\\n"\n                        "}\\n");\n    }\n    if (outformat == FORMAT_ASN1 && genkey)\n        noout = 1;\n    if (!noout) {\n        if (outformat == FORMAT_ASN1)\n            i = i2d_ECPKParameters_bio(out, group);\n        else\n            i = PEM_write_bio_ECPKParameters(out, group);\n        if (!i) {\n            BIO_printf(bio_err, "unable to write elliptic "\n                       "curve parameters\\n");\n            ERR_print_errors(bio_err);\n            goto end;\n        }\n    }\n    if (genkey) {\n        EC_KEY *eckey = EC_KEY_new();\n        if (eckey == NULL)\n            goto end;\n        if (EC_KEY_set_group(eckey, group) == 0) {\n            BIO_printf(bio_err, "unable to set group when generating key\\n");\n            EC_KEY_free(eckey);\n            ERR_print_errors(bio_err);\n            goto end;\n        }\n        if (new_form)\n            EC_KEY_set_conv_form(eckey, form);\n        if (!EC_KEY_generate_key(eckey)) {\n            BIO_printf(bio_err, "unable to generate key\\n");\n            EC_KEY_free(eckey);\n            ERR_print_errors(bio_err);\n            goto end;\n        }\n        assert(private);\n        if (outformat == FORMAT_ASN1)\n            i = i2d_ECPrivateKey_bio(out, eckey);\n        else\n            i = PEM_write_bio_ECPrivateKey(out, eckey, NULL,\n                                           NULL, 0, NULL, NULL);\n        EC_KEY_free(eckey);\n    }\n    ret = 0;\n end:\n    BN_free(ec_p);\n    BN_free(ec_a);\n    BN_free(ec_b);\n    BN_free(ec_gen);\n    BN_free(ec_order);\n    BN_free(ec_cofactor);\n    OPENSSL_free(buffer);\n    EC_GROUP_free(group);\n    release_engine(e);\n    BIO_free(in);\n    BIO_free_all(out);\n    return ret;\n}', 'int EC_GROUP_check_named_curve(const EC_GROUP *group, int nist_only,\n                               BN_CTX *ctx)\n{\n    int nid = NID_undef;\n#ifndef FIPS_MODE\n    BN_CTX *new_ctx = NULL;\n    if (ctx == NULL) {\n        ctx = new_ctx = BN_CTX_new();\n        if (ctx == NULL) {\n            ECerr(EC_F_EC_GROUP_CHECK_NAMED_CURVE, ERR_R_MALLOC_FAILURE);\n            goto err;\n        }\n    }\n#endif\n    nid = ec_curve_nid_from_params(group, ctx);\n    if (nid > 0 && nist_only && EC_curve_nid2nist(nid) == NULL)\n        nid = NID_undef;\n#ifndef FIPS_MODE\n err:\n    BN_CTX_free(ctx);\n#endif\n    return nid;\n}', 'int ec_curve_nid_from_params(const EC_GROUP *group, BN_CTX *ctx)\n{\n    int ret = -1, nid, len, field_type, param_len;\n    size_t i, seed_len;\n    const unsigned char *seed, *params_seed, *params;\n    unsigned char *param_bytes = NULL;\n    const EC_CURVE_DATA *data;\n    const EC_POINT *generator = NULL;\n    const EC_METHOD *meth;\n    const BIGNUM *cofactor = NULL;\n    BIGNUM *bn[NUM_BN_FIELDS] = {NULL, NULL, NULL, NULL, NULL, NULL};\n    meth = EC_GROUP_method_of(group);\n    if (meth == NULL)\n        return -1;\n    nid = EC_GROUP_get_curve_name(group);\n    field_type = EC_METHOD_get_field_type(meth);\n    seed_len = EC_GROUP_get_seed_len(group);\n    seed = EC_GROUP_get0_seed(group);\n    cofactor = EC_GROUP_get0_cofactor(group);\n    BN_CTX_start(ctx);\n    param_len = BN_num_bytes(group->order);\n    len = BN_num_bytes(group->field);\n    if (len > param_len)\n        param_len = len;\n    param_bytes = OPENSSL_malloc(param_len * NUM_BN_FIELDS);\n    if (param_bytes == NULL)\n        goto end;\n    for (i = 0; i < NUM_BN_FIELDS; ++i) {\n        if ((bn[i] = BN_CTX_get(ctx)) == NULL)\n            goto end;\n    }\n    if (!(EC_GROUP_get_curve(group, bn[0], bn[1], bn[2], ctx)\n        && ((generator = EC_GROUP_get0_generator(group)) != NULL)\n        && EC_POINT_get_affine_coordinates(group, generator, bn[3], bn[4], ctx)\n        && EC_GROUP_get_order(group, bn[5], ctx)))\n        goto end;\n    for (i = 0; i < NUM_BN_FIELDS; ++i) {\n        if (BN_bn2binpad(bn[i], &param_bytes[i*param_len], param_len) <= 0)\n            goto end;\n    }\n    for (i = 0; i < curve_list_length; i++) {\n        const ec_list_element curve = curve_list[i];\n        data = curve.data;\n        params_seed = (const unsigned char *)(data + 1);\n        params = params_seed + data->seed_len;\n        if (data->field_type == field_type\n            && param_len == data->param_len\n            && (nid <= 0 || nid == curve.nid)\n            && (BN_is_zero(cofactor)\n                || BN_is_word(cofactor, (const BN_ULONG)curve.data->cofactor))\n            && (data->seed_len == 0 || seed_len == 0\n                || ((size_t)data->seed_len == seed_len\n                     && memcmp(params_seed, seed, seed_len) == 0))\n            && memcmp(param_bytes, params, param_len * NUM_BN_FIELDS)\n                             == 0) {\n            ret = curve.nid;\n            goto end;\n        }\n    }\n    ret = NID_undef;\nend:\n    OPENSSL_free(param_bytes);\n    BN_CTX_end(ctx);\n    return ret;\n}', 'void BN_CTX_start(BN_CTX *ctx)\n{\n    CTXDBG("ENTER BN_CTX_start()", ctx);\n    if (ctx->err_stack || ctx->too_many)\n        ctx->err_stack++;\n    else if (!BN_STACK_push(&ctx->stack, ctx->used)) {\n        BNerr(BN_F_BN_CTX_START, BN_R_TOO_MANY_TEMPORARY_VARIABLES);\n        ctx->err_stack++;\n    }\n    CTXDBG("LEAVE BN_CTX_start()", ctx);\n}', 'void BN_CTX_end(BN_CTX *ctx)\n{\n    if (ctx == NULL)\n        return;\n    CTXDBG("ENTER BN_CTX_end()", ctx);\n    if (ctx->err_stack)\n        ctx->err_stack--;\n    else {\n        unsigned int fp = BN_STACK_pop(&ctx->stack);\n        if (fp < ctx->used)\n            BN_POOL_release(&ctx->pool, ctx->used - fp);\n        ctx->used = fp;\n        ctx->too_many = 0;\n    }\n    CTXDBG("LEAVE BN_CTX_end()", ctx);\n}', 'static unsigned int BN_STACK_pop(BN_STACK *st)\n{\n    return st->indexes[--(st->depth)];\n}']