test/bntest.c:1347: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_div`.
Showing all 18 steps of the trace


test/bntest.c:1341:17: Call
1339.               || !TEST_ptr(b = getBN(s, "B"))
1340.               || !TEST_ptr(quotient = getBN(s, "Quotient"))
1341.               || !TEST_ptr(remainder = getBN(s, "Remainder"))
                        ^
1342.               || !TEST_ptr(ret = BN_new())
1343.               || !TEST_ptr(ret2 = BN_new())

test/bntest.c:107:9: Call
  105.       }
  106.   
  107.       if (parseBN(&ret, hex) != (int)strlen(hex)) {
                 ^
  108.           TEST_error("Could not decode '%s'", hex);
  109.           return NULL;

test/bntest.c:88:12: Call
    86.   {
    87.       *out = NULL;
    88.       return BN_hex2bn(out, in);
                     ^
    89.   }
    90.   

crypto/bn/bn_print.c:126:1: Parameter `(*bn)->top`
      124.   }
      125.   
      126. > int BN_hex2bn(BIGNUM **bn, const char *a)
      127.   {
      128.       BIGNUM *ret = NULL;

test/bntest.c:1347:10: Call
1345.           goto err;
1346.   
1347.       if (!TEST_true(BN_div(ret, ret2, a, b, ctx))
                 ^
1348.               || !equalBN("A / B", quotient, ret)
1349.               || !equalBN("A % B", remainder, ret2)

crypto/bn/bn_div.c:209:1: Parameter `divisor->top`
  207.    * If 'dv' or 'rm' is NULL, the respective value is not returned.
  208.    */
  209. > int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
  210.              BN_CTX *ctx)
  211.   {

crypto/bn/bn_div.c:214:9: Call
  212.       int ret;
  213.   
  214.       if (BN_is_zero(divisor)) {
                 ^
  215.           BNerr(BN_F_BN_DIV, BN_R_DIV_BY_ZERO);
  216.           return 0;

crypto/bn/bn_lib.c:843:1: Parameter `a->top`
    841.   }
    842.   
    843. > int BN_is_zero(const BIGNUM *a)
    844.   {
    845.       return a->top == 0;

crypto/bn/bn_div.c:229:11: Call
  227.       }
  228.   
  229.       ret = bn_div_fixed_top(dv, rm, num, divisor, ctx);
                   ^
  230.   
  231.       if (ret) {

crypto/bn/bn_div.c:264:1: Parameter `divisor->top`
    262.    *       divisor's length is considered public;
    263.    */
    264. > int bn_div_fixed_top(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num,
    265.                        const BIGNUM *divisor, BN_CTX *ctx)
    266.   {

crypto/bn/bn_div.c:289:10: Call
    287.   
    288.       /* First we normalise the numbers */
    289.       if (!BN_copy(sdiv, divisor))
                    ^
    290.           goto err;
    291.       norm_shift = bn_left_align(sdiv);

crypto/bn/bn_lib.c:281:1: <Offset trace>
279.   }
280.   
281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
282.   {
283.       bn_check_top(b);

crypto/bn/bn_lib.c:281:1: Parameter `b->top`
      279.   }
      280.   
      281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      282.   {
      283.       bn_check_top(b);

crypto/bn/bn_lib.c:281:1: <Length trace>
279.   }
280.   
281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
282.   {
283.       bn_check_top(b);

crypto/bn/bn_lib.c:281:1: Parameter `*a->d`
      279.   }
      280.   
      281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      282.   {
      283.       bn_check_top(b);

crypto/bn/bn_lib.c:287:9: Call
      285.       if (a == b)
      286.           return a;
      287.       if (bn_wexpand(a, b->top) == NULL)
                     ^
      288.           return NULL;
      289.   

crypto/bn/bn_lib.c:939:1: Parameter `*a->d`
        937.   }
        938.   
        939. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
        940.   {
        941.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:291:9: Array access: Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_div` 
      289.   
      290.       if (b->top > 0)
      291.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                     ^
      292.   
      293.       a->neg = b->neg;

BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
{
    bn_check_top(b);
    if (a == b)
        return a;
    if (bn_wexpand(a, b->top) == NULL)
        return NULL;
    if (b->top > 0)
        memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
    a->neg = b->neg;
    a->top = b->top;
    a->flags |= b->flags & BN_FLG_FIXED_TOP;
    bn_check_top(a);
    return a;
}
['static int file_quotient(STANZA *s)\n{\n    BIGNUM *a = NULL, *b = NULL, *quotient = NULL, *remainder = NULL;\n    BIGNUM *ret = NULL, *ret2 = NULL, *nnmod = NULL;\n    BN_ULONG b_word, ret_word;\n    int st = 0;\n    if (!TEST_ptr(a = getBN(s, "A"))\n            || !TEST_ptr(b = getBN(s, "B"))\n            || !TEST_ptr(quotient = getBN(s, "Quotient"))\n            || !TEST_ptr(remainder = getBN(s, "Remainder"))\n            || !TEST_ptr(ret = BN_new())\n            || !TEST_ptr(ret2 = BN_new())\n            || !TEST_ptr(nnmod = BN_new()))\n        goto err;\n    if (!TEST_true(BN_div(ret, ret2, a, b, ctx))\n            || !equalBN("A / B", quotient, ret)\n            || !equalBN("A % B", remainder, ret2)\n            || !TEST_true(BN_mul(ret, quotient, b, ctx))\n            || !TEST_true(BN_add(ret, ret, remainder))\n            || !equalBN("Quotient * B + Remainder", a, ret))\n        goto err;\n    b_word = BN_get_word(b);\n    if (!BN_is_negative(b) && b_word != (BN_ULONG)-1) {\n        BN_ULONG remainder_word = BN_get_word(remainder);\n        assert(remainder_word != (BN_ULONG)-1);\n        if (!TEST_ptr(BN_copy(ret, a)))\n            goto err;\n        ret_word = BN_div_word(ret, b_word);\n        if (ret_word != remainder_word) {\n#ifdef BN_DEC_FMT1\n            TEST_error(\n                    "Got A %% B (word) = " BN_DEC_FMT1 ", wanted " BN_DEC_FMT1,\n                    ret_word, remainder_word);\n#else\n            TEST_error("Got A %% B (word) mismatch");\n#endif\n            goto err;\n        }\n        if (!equalBN ("A / B (word)", quotient, ret))\n            goto err;\n        ret_word = BN_mod_word(a, b_word);\n        if (ret_word != remainder_word) {\n#ifdef BN_DEC_FMT1\n            TEST_error(\n                    "Got A %% B (word) = " BN_DEC_FMT1 ", wanted " BN_DEC_FMT1 "",\n                    ret_word, remainder_word);\n#else\n            TEST_error("Got A %% B (word) mismatch");\n#endif\n            goto err;\n        }\n    }\n    if (!BN_is_negative(b)) {\n        if (!TEST_true(BN_copy(nnmod, remainder))\n                || (BN_is_negative(nnmod)\n                        && !TEST_true(BN_add(nnmod, nnmod, b)))\n                || !TEST_true(BN_nnmod(ret, a, b, ctx))\n                || !equalBN("A % B (non-negative)", nnmod, ret))\n            goto err;\n    }\n    st = 1;\nerr:\n    BN_free(a);\n    BN_free(b);\n    BN_free(quotient);\n    BN_free(remainder);\n    BN_free(ret);\n    BN_free(ret2);\n    BN_free(nnmod);\n    return st;\n}', 'static BIGNUM *getBN(STANZA *s, const char *attribute)\n{\n    const char *hex;\n    BIGNUM *ret = NULL;\n    if ((hex = findattr(s, attribute)) == NULL) {\n        TEST_error("%s:%d: Can\'t find %s", s->test_file, s->start, attribute);\n        return NULL;\n    }\n    if (parseBN(&ret, hex) != (int)strlen(hex)) {\n        TEST_error("Could not decode \'%s\'", hex);\n        return NULL;\n    }\n    return ret;\n}', 'static int parseBN(BIGNUM **out, const char *in)\n{\n    *out = NULL;\n    return BN_hex2bn(out, in);\n}', "int BN_hex2bn(BIGNUM **bn, const char *a)\n{\n    BIGNUM *ret = NULL;\n    BN_ULONG l = 0;\n    int neg = 0, h, m, i, j, k, c;\n    int num;\n    if (a == NULL || *a == '\\0')\n        return 0;\n    if (*a == '-') {\n        neg = 1;\n        a++;\n    }\n    for (i = 0; i <= INT_MAX / 4 && ossl_isxdigit(a[i]); i++)\n        continue;\n    if (i == 0 || i > INT_MAX / 4)\n        goto err;\n    num = i + neg;\n    if (bn == NULL)\n        return num;\n    if (*bn == NULL) {\n        if ((ret = BN_new()) == NULL)\n            return 0;\n    } else {\n        ret = *bn;\n        BN_zero(ret);\n    }\n    if (bn_expand(ret, i * 4) == NULL)\n        goto err;\n    j = i;\n    m = 0;\n    h = 0;\n    while (j > 0) {\n        m = (BN_BYTES * 2 <= j) ? BN_BYTES * 2 : j;\n        l = 0;\n        for (;;) {\n            c = a[j - m];\n            k = OPENSSL_hexchar2int(c);\n            if (k < 0)\n                k = 0;\n            l = (l << 4) | k;\n            if (--m <= 0) {\n                ret->d[h++] = l;\n                break;\n            }\n        }\n        j -= BN_BYTES * 2;\n    }\n    ret->top = h;\n    bn_correct_top(ret);\n    *bn = ret;\n    bn_check_top(ret);\n    if (ret->top != 0)\n        ret->neg = neg;\n    return num;\n err:\n    if (*bn == NULL)\n        BN_free(ret);\n    return 0;\n}", 'int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,\n           BN_CTX *ctx)\n{\n    int ret;\n    if (BN_is_zero(divisor)) {\n        BNerr(BN_F_BN_DIV, BN_R_DIV_BY_ZERO);\n        return 0;\n    }\n    if (divisor->d[divisor->top - 1] == 0) {\n        BNerr(BN_F_BN_DIV, BN_R_NOT_INITIALIZED);\n        return 0;\n    }\n    ret = bn_div_fixed_top(dv, rm, num, divisor, ctx);\n    if (ret) {\n        if (dv != NULL)\n            bn_correct_top(dv);\n        if (rm != NULL)\n            bn_correct_top(rm);\n    }\n    return ret;\n}', 'int BN_is_zero(const BIGNUM *a)\n{\n    return a->top == 0;\n}', 'int bn_div_fixed_top(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num,\n                     const BIGNUM *divisor, BN_CTX *ctx)\n{\n    int norm_shift, i, j, loop;\n    BIGNUM *tmp, *snum, *sdiv, *res;\n    BN_ULONG *resp, *wnum, *wnumtop;\n    BN_ULONG d0, d1;\n    int num_n, div_n;\n    assert(divisor->top > 0 && divisor->d[divisor->top - 1] != 0);\n    bn_check_top(num);\n    bn_check_top(divisor);\n    bn_check_top(dv);\n    bn_check_top(rm);\n    BN_CTX_start(ctx);\n    res = (dv == NULL) ? BN_CTX_get(ctx) : dv;\n    tmp = BN_CTX_get(ctx);\n    snum = BN_CTX_get(ctx);\n    sdiv = BN_CTX_get(ctx);\n    if (sdiv == NULL)\n        goto err;\n    if (!BN_copy(sdiv, divisor))\n        goto err;\n    norm_shift = bn_left_align(sdiv);\n    sdiv->neg = 0;\n    if (!(bn_lshift_fixed_top(snum, num, norm_shift)))\n        goto err;\n    div_n = sdiv->top;\n    num_n = snum->top;\n    if (num_n <= div_n) {\n        if (bn_wexpand(snum, div_n + 1) == NULL)\n            goto err;\n        memset(&(snum->d[num_n]), 0, (div_n - num_n + 1) * sizeof(BN_ULONG));\n        snum->top = num_n = div_n + 1;\n    }\n    loop = num_n - div_n;\n    wnum = &(snum->d[loop]);\n    wnumtop = &(snum->d[num_n - 1]);\n    d0 = sdiv->d[div_n - 1];\n    d1 = (div_n == 1) ? 0 : sdiv->d[div_n - 2];\n    if (!bn_wexpand(res, loop))\n        goto err;\n    res->neg = (num->neg ^ divisor->neg);\n    res->top = loop;\n    res->flags |= BN_FLG_FIXED_TOP;\n    resp = &(res->d[loop]);\n    if (!bn_wexpand(tmp, (div_n + 1)))\n        goto err;\n    for (i = 0; i < loop; i++, wnumtop--) {\n        BN_ULONG q, l0;\n# if defined(BN_DIV3W)\n        q = bn_div_3_words(wnumtop, d1, d0);\n# else\n        BN_ULONG n0, n1, rem = 0;\n        n0 = wnumtop[0];\n        n1 = wnumtop[-1];\n        if (n0 == d0)\n            q = BN_MASK2;\n        else {\n            BN_ULONG n2 = (wnumtop == wnum) ? 0 : wnumtop[-2];\n#  ifdef BN_LLONG\n            BN_ULLONG t2;\n#   if defined(BN_LLONG) && defined(BN_DIV2W) && !defined(bn_div_words)\n            q = (BN_ULONG)(((((BN_ULLONG) n0) << BN_BITS2) | n1) / d0);\n#   else\n            q = bn_div_words(n0, n1, d0);\n#   endif\n#   ifndef REMAINDER_IS_ALREADY_CALCULATED\n            rem = (n1 - q * d0) & BN_MASK2;\n#   endif\n            t2 = (BN_ULLONG) d1 *q;\n            for (;;) {\n                if (t2 <= ((((BN_ULLONG) rem) << BN_BITS2) | n2))\n                    break;\n                q--;\n                rem += d0;\n                if (rem < d0)\n                    break;\n                t2 -= d1;\n            }\n#  else\n            BN_ULONG t2l, t2h;\n            q = bn_div_words(n0, n1, d0);\n#   ifndef REMAINDER_IS_ALREADY_CALCULATED\n            rem = (n1 - q * d0) & BN_MASK2;\n#   endif\n#   if defined(BN_UMULT_LOHI)\n            BN_UMULT_LOHI(t2l, t2h, d1, q);\n#   elif defined(BN_UMULT_HIGH)\n            t2l = d1 * q;\n            t2h = BN_UMULT_HIGH(d1, q);\n#   else\n            {\n                BN_ULONG ql, qh;\n                t2l = LBITS(d1);\n                t2h = HBITS(d1);\n                ql = LBITS(q);\n                qh = HBITS(q);\n                mul64(t2l, t2h, ql, qh);\n            }\n#   endif\n            for (;;) {\n                if ((t2h < rem) || ((t2h == rem) && (t2l <= n2)))\n                    break;\n                q--;\n                rem += d0;\n                if (rem < d0)\n                    break;\n                if (t2l < d1)\n                    t2h--;\n                t2l -= d1;\n            }\n#  endif\n        }\n# endif\n        l0 = bn_mul_words(tmp->d, sdiv->d, div_n, q);\n        tmp->d[div_n] = l0;\n        wnum--;\n        l0 = bn_sub_words(wnum, wnum, tmp->d, div_n + 1);\n        q -= l0;\n        for (l0 = 0 - l0, j = 0; j < div_n; j++)\n            tmp->d[j] = sdiv->d[j] & l0;\n        l0 = bn_add_words(wnum, wnum, tmp->d, div_n);\n        (*wnumtop) += l0;\n        assert((*wnumtop) == 0);\n        *--resp = q;\n    }\n    snum->neg = num->neg;\n    snum->top = div_n;\n    snum->flags |= BN_FLG_FIXED_TOP;\n    if (rm != NULL)\n        bn_rshift_fixed_top(rm, snum, norm_shift);\n    BN_CTX_end(ctx);\n    return 1;\n err:\n    bn_check_top(rm);\n    BN_CTX_end(ctx);\n    return 0;\n}', 'BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)\n{\n    bn_check_top(b);\n    if (a == b)\n        return a;\n    if (bn_wexpand(a, b->top) == NULL)\n        return NULL;\n    if (b->top > 0)\n        memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);\n    a->neg = b->neg;\n    a->top = b->top;\n    a->flags |= b->flags & BN_FLG_FIXED_TOP;\n    bn_check_top(a);\n    return a;\n}', 'BIGNUM *bn_wexpand(BIGNUM *a, int words)\n{\n    return (words <= a->dmax) ? a : bn_expand2(a, words);\n}']