crypto/rsa/rsa_chk.c:138: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, 8388607] by call to `BN_sub`.
Showing all 10 steps of the trace


crypto/rsa/rsa_chk.c:138:34: Call
136.       for (idx = 0; idx < ex_primes; idx++) {
137.           pinfo = sk_RSA_PRIME_INFO_value(key->prime_infos, idx);
138.           if (!BN_sub(k, pinfo->r, BN_value_one())) {
                                        ^
139.               ret = -1;
140.               goto err;

crypto/bn/bn_lib.c:85:9: Assignment
  83.       static const BN_ULONG data_one = 1L;
  84.       static const BIGNUM const_one =
  85.           { (BN_ULONG *)&data_one, 1, 1, 0, BN_FLG_STATIC_DATA };
                ^
  86.   
  87.       return &const_one;

crypto/rsa/rsa_chk.c:138:14: Call
136.       for (idx = 0; idx < ex_primes; idx++) {
137.           pinfo = sk_RSA_PRIME_INFO_value(key->prime_infos, idx);
138.           if (!BN_sub(k, pinfo->r, BN_value_one())) {
                    ^
139.               ret = -1;
140.               goto err;

crypto/bn/bn_add.c:45:1: Parameter `*a->d`
  43.   
  44.   /* signed sub of b from a. */
  45. > int BN_sub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
  46.   {
  47.       int ret, r_neg, cmp_res;

crypto/bn/bn_add.c:59:19: Call
  57.           if (cmp_res > 0) {
  58.               r_neg = a->neg;
  59.               ret = BN_usub(r, a, b);
                          ^
  60.           } else if (cmp_res < 0) {
  61.               r_neg = !b->neg;

crypto/bn/bn_add.c:125:1: <Length trace>
123.   
124.   /* unsigned subtraction of b from a, a must be larger than b. */
125. > int BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
126.   {
127.       int max, min, dif;

crypto/bn/bn_add.c:125:1: Parameter `b->top`
    123.   
    124.   /* unsigned subtraction of b from a, a must be larger than b. */
    125. > int BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
    126.   {
    127.       int max, min, dif;

crypto/bn/bn_add.c:135:5: Assignment
    133.   
    134.       max = a->top;
    135.       min = b->top;
               ^
    136.       dif = max - min;
    137.   

crypto/bn/bn_add.c:151:5: Assignment
    149.   
    150.       borrow = bn_sub_words(rp, ap, bp, min);
    151.       ap += min;
               ^
    152.       rp += min;
    153.   

crypto/bn/bn_add.c:156:14: Array access: Offset: [1, +oo] Size: [0, 8388607] by call to `BN_sub` 
    154.       while (dif) {
    155.           dif--;
    156.           t1 = *(ap++);
                        ^
    157.           t2 = (t1 - borrow) & BN_MASK2;
    158.           *(rp++) = t2;

int BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
{
    int max, min, dif;
    BN_ULONG t1, t2, borrow, *rp;
    const BN_ULONG *ap, *bp;
    bn_check_top(a);
    bn_check_top(b);
    max = a->top;
    min = b->top;
    dif = max - min;
    if (dif < 0) {
        BNerr(BN_F_BN_USUB, BN_R_ARG2_LT_ARG3);
        return 0;
    }
    if (bn_wexpand(r, max) == NULL)
        return 0;
    ap = a->d;
    bp = b->d;
    rp = r->d;
    borrow = bn_sub_words(rp, ap, bp, min);
    ap += min;
    rp += min;
    while (dif) {
        dif--;
        t1 = *(ap++);
        t2 = (t1 - borrow) & BN_MASK2;
        *(rp++) = t2;
        borrow &= (t1 == 0);
    }
    while (max && *--rp == 0)
        max--;
    r->top = max;
    r->neg = 0;
    bn_pollute(r);
    return 1;
}
['int RSA_check_key_ex(const RSA *key, BN_GENCB *cb)\n{\n#ifdef FIPS_MODE\n    return rsa_sp800_56b_check_public(key)\n               && rsa_sp800_56b_check_private(key)\n               && rsa_sp800_56b_check_keypair(key, NULL, -1, RSA_bits(key));\n#else\n    BIGNUM *i, *j, *k, *l, *m;\n    BN_CTX *ctx;\n    int ret = 1, ex_primes = 0, idx;\n    RSA_PRIME_INFO *pinfo;\n    if (key->p == NULL || key->q == NULL || key->n == NULL\n            || key->e == NULL || key->d == NULL) {\n        RSAerr(RSA_F_RSA_CHECK_KEY_EX, RSA_R_VALUE_MISSING);\n        return 0;\n    }\n    if (key->version == RSA_ASN1_VERSION_MULTI) {\n        ex_primes = sk_RSA_PRIME_INFO_num(key->prime_infos);\n        if (ex_primes <= 0\n                || (ex_primes + 2) > rsa_multip_cap(BN_num_bits(key->n))) {\n            RSAerr(RSA_F_RSA_CHECK_KEY_EX, RSA_R_INVALID_MULTI_PRIME_KEY);\n            return 0;\n        }\n    }\n    i = BN_new();\n    j = BN_new();\n    k = BN_new();\n    l = BN_new();\n    m = BN_new();\n    ctx = BN_CTX_new();\n    if (i == NULL || j == NULL || k == NULL || l == NULL\n            || m == NULL || ctx == NULL) {\n        ret = -1;\n        RSAerr(RSA_F_RSA_CHECK_KEY_EX, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    if (BN_is_one(key->e)) {\n        ret = 0;\n        RSAerr(RSA_F_RSA_CHECK_KEY_EX, RSA_R_BAD_E_VALUE);\n    }\n    if (!BN_is_odd(key->e)) {\n        ret = 0;\n        RSAerr(RSA_F_RSA_CHECK_KEY_EX, RSA_R_BAD_E_VALUE);\n    }\n    if (BN_is_prime_ex(key->p, BN_prime_checks, NULL, cb) != 1) {\n        ret = 0;\n        RSAerr(RSA_F_RSA_CHECK_KEY_EX, RSA_R_P_NOT_PRIME);\n    }\n    if (BN_is_prime_ex(key->q, BN_prime_checks, NULL, cb) != 1) {\n        ret = 0;\n        RSAerr(RSA_F_RSA_CHECK_KEY_EX, RSA_R_Q_NOT_PRIME);\n    }\n    for (idx = 0; idx < ex_primes; idx++) {\n        pinfo = sk_RSA_PRIME_INFO_value(key->prime_infos, idx);\n        if (BN_is_prime_ex(pinfo->r, BN_prime_checks, NULL, cb) != 1) {\n            ret = 0;\n            RSAerr(RSA_F_RSA_CHECK_KEY_EX, RSA_R_MP_R_NOT_PRIME);\n        }\n    }\n    if (!BN_mul(i, key->p, key->q, ctx)) {\n        ret = -1;\n        goto err;\n    }\n    for (idx = 0; idx < ex_primes; idx++) {\n        pinfo = sk_RSA_PRIME_INFO_value(key->prime_infos, idx);\n        if (!BN_mul(i, i, pinfo->r, ctx)) {\n            ret = -1;\n            goto err;\n        }\n    }\n    if (BN_cmp(i, key->n) != 0) {\n        ret = 0;\n        if (ex_primes)\n            RSAerr(RSA_F_RSA_CHECK_KEY_EX,\n                   RSA_R_N_DOES_NOT_EQUAL_PRODUCT_OF_PRIMES);\n        else\n            RSAerr(RSA_F_RSA_CHECK_KEY_EX, RSA_R_N_DOES_NOT_EQUAL_P_Q);\n    }\n    if (!BN_sub(i, key->p, BN_value_one())) {\n        ret = -1;\n        goto err;\n    }\n    if (!BN_sub(j, key->q, BN_value_one())) {\n        ret = -1;\n        goto err;\n    }\n    if (!BN_mul(l, i, j, ctx)) {\n        ret = -1;\n        goto err;\n    }\n    if (!BN_gcd(m, i, j, ctx)) {\n        ret = -1;\n        goto err;\n    }\n    for (idx = 0; idx < ex_primes; idx++) {\n        pinfo = sk_RSA_PRIME_INFO_value(key->prime_infos, idx);\n        if (!BN_sub(k, pinfo->r, BN_value_one())) {\n            ret = -1;\n            goto err;\n        }\n        if (!BN_mul(l, l, k, ctx)) {\n            ret = -1;\n            goto err;\n        }\n        if (!BN_gcd(m, m, k, ctx)) {\n            ret = -1;\n            goto err;\n        }\n    }\n    if (!BN_div(k, NULL, l, m, ctx)) {\n        ret = -1;\n        goto err;\n    }\n    if (!BN_mod_mul(i, key->d, key->e, k, ctx)) {\n        ret = -1;\n        goto err;\n    }\n    if (!BN_is_one(i)) {\n        ret = 0;\n        RSAerr(RSA_F_RSA_CHECK_KEY_EX, RSA_R_D_E_NOT_CONGRUENT_TO_1);\n    }\n    if (key->dmp1 != NULL && key->dmq1 != NULL && key->iqmp != NULL) {\n        if (!BN_sub(i, key->p, BN_value_one())) {\n            ret = -1;\n            goto err;\n        }\n        if (!BN_mod(j, key->d, i, ctx)) {\n            ret = -1;\n            goto err;\n        }\n        if (BN_cmp(j, key->dmp1) != 0) {\n            ret = 0;\n            RSAerr(RSA_F_RSA_CHECK_KEY_EX, RSA_R_DMP1_NOT_CONGRUENT_TO_D);\n        }\n        if (!BN_sub(i, key->q, BN_value_one())) {\n            ret = -1;\n            goto err;\n        }\n        if (!BN_mod(j, key->d, i, ctx)) {\n            ret = -1;\n            goto err;\n        }\n        if (BN_cmp(j, key->dmq1) != 0) {\n            ret = 0;\n            RSAerr(RSA_F_RSA_CHECK_KEY_EX, RSA_R_DMQ1_NOT_CONGRUENT_TO_D);\n        }\n        if (!BN_mod_inverse(i, key->q, key->p, ctx)) {\n            ret = -1;\n            goto err;\n        }\n        if (BN_cmp(i, key->iqmp) != 0) {\n            ret = 0;\n            RSAerr(RSA_F_RSA_CHECK_KEY_EX, RSA_R_IQMP_NOT_INVERSE_OF_Q);\n        }\n    }\n    for (idx = 0; idx < ex_primes; idx++) {\n        pinfo = sk_RSA_PRIME_INFO_value(key->prime_infos, idx);\n        if (!BN_sub(i, pinfo->r, BN_value_one())) {\n            ret = -1;\n            goto err;\n        }\n        if (!BN_mod(j, key->d, i, ctx)) {\n            ret = -1;\n            goto err;\n        }\n        if (BN_cmp(j, pinfo->d) != 0) {\n            ret = 0;\n            RSAerr(RSA_F_RSA_CHECK_KEY_EX, RSA_R_MP_EXPONENT_NOT_CONGRUENT_TO_D);\n        }\n        if (!BN_mod_inverse(i, pinfo->pp, pinfo->r, ctx)) {\n            ret = -1;\n            goto err;\n        }\n        if (BN_cmp(i, pinfo->t) != 0) {\n            ret = 0;\n            RSAerr(RSA_F_RSA_CHECK_KEY_EX, RSA_R_MP_COEFFICIENT_NOT_INVERSE_OF_R);\n        }\n    }\n err:\n    BN_free(i);\n    BN_free(j);\n    BN_free(k);\n    BN_free(l);\n    BN_free(m);\n    BN_CTX_free(ctx);\n    return ret;\n#endif\n}', 'const BIGNUM *BN_value_one(void)\n{\n    static const BN_ULONG data_one = 1L;\n    static const BIGNUM const_one =\n        { (BN_ULONG *)&data_one, 1, 1, 0, BN_FLG_STATIC_DATA };\n    return &const_one;\n}', 'int BN_sub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)\n{\n    int ret, r_neg, cmp_res;\n    bn_check_top(a);\n    bn_check_top(b);\n    if (a->neg != b->neg) {\n        r_neg = a->neg;\n        ret = BN_uadd(r, a, b);\n    } else {\n        cmp_res = BN_ucmp(a, b);\n        if (cmp_res > 0) {\n            r_neg = a->neg;\n            ret = BN_usub(r, a, b);\n        } else if (cmp_res < 0) {\n            r_neg = !b->neg;\n            ret = BN_usub(r, b, a);\n        } else {\n            r_neg = 0;\n            BN_zero(r);\n            ret = 1;\n        }\n    }\n    r->neg = r_neg;\n    bn_check_top(r);\n    return ret;\n}', 'int BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)\n{\n    int max, min, dif;\n    BN_ULONG t1, t2, borrow, *rp;\n    const BN_ULONG *ap, *bp;\n    bn_check_top(a);\n    bn_check_top(b);\n    max = a->top;\n    min = b->top;\n    dif = max - min;\n    if (dif < 0) {\n        BNerr(BN_F_BN_USUB, BN_R_ARG2_LT_ARG3);\n        return 0;\n    }\n    if (bn_wexpand(r, max) == NULL)\n        return 0;\n    ap = a->d;\n    bp = b->d;\n    rp = r->d;\n    borrow = bn_sub_words(rp, ap, bp, min);\n    ap += min;\n    rp += min;\n    while (dif) {\n        dif--;\n        t1 = *(ap++);\n        t2 = (t1 - borrow) & BN_MASK2;\n        *(rp++) = t2;\n        borrow &= (t1 == 0);\n    }\n    while (max && *--rp == 0)\n        max--;\n    r->top = max;\n    r->neg = 0;\n    bn_pollute(r);\n    return 1;\n}']