crypto/srp/srp_vfy.c:237: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned32 by call to `BN_bin2bn`.
Showing all 8 steps of the trace


crypto/srp/srp_vfy.c:236:11: Call
234.       if (strlen(s) > MAX_LEN || strlen(v) > MAX_LEN)
235.           return 0;
236.       len = t_fromb64(tmp, v);
                 ^
237.       if (NULL == (vinfo->v = BN_bin2bn(tmp, len, NULL)))
238.           return 0;

crypto/srp/srp_vfy.c:103:9: Assignment
  101.       /* if nothing valid to process we have a zero length response */
  102.       if (i == 0)
  103.           return 0;
                 ^
  104.       size = i;
  105.       i = size - 1;

crypto/srp/srp_vfy.c:236:5: Assignment
234.       if (strlen(s) > MAX_LEN || strlen(v) > MAX_LEN)
235.           return 0;
236.       len = t_fromb64(tmp, v);
           ^
237.       if (NULL == (vinfo->v = BN_bin2bn(tmp, len, NULL)))
238.           return 0;

crypto/srp/srp_vfy.c:237:29: Call
235.           return 0;
236.       len = t_fromb64(tmp, v);
237.       if (NULL == (vinfo->v = BN_bin2bn(tmp, len, NULL)))
                                   ^
238.           return 0;
239.       len = t_fromb64(tmp, s);

crypto/bn/bn_lib.c:546:1: <LHS trace>
544.   }
545.   
546. > BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)
547.   {
548.       unsigned int i, m;

crypto/bn/bn_lib.c:546:1: Parameter `len`
  544.   }
  545.   
  546. > BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)
  547.   {
  548.       unsigned int i, m;

crypto/bn/bn_lib.c:559:5: Assignment
  557.       bn_check_top(ret);
  558.       l = 0;
  559.       n = len;
             ^
  560.       if (n == 0) {
  561.           ret->top = 0;

crypto/bn/bn_lib.c:564:5: Binary operation: ([0, +oo] - 1):unsigned32 by call to `BN_bin2bn` 
  562.           return (ret);
  563.       }
  564.       i = ((n - 1) / BN_BYTES) + 1;
             ^
  565.       m = ((n - 1) % (BN_BYTES));
  566.       if (bn_wexpand(ret, (int)i) == NULL) {

BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)
{
    unsigned int i, m;
    unsigned int n;
    BN_ULONG l;
    BIGNUM *bn = NULL;
    if (ret == NULL)
        ret = bn = BN_new();
    if (ret == NULL)
        return (NULL);
    bn_check_top(ret);
    l = 0;
    n = len;
    if (n == 0) {
        ret->top = 0;
        return (ret);
    }
    i = ((n - 1) / BN_BYTES) + 1;
    m = ((n - 1) % (BN_BYTES));
    if (bn_wexpand(ret, (int)i) == NULL) {
        if (bn)
            BN_free(bn);
        return NULL;
    }
    ret->top = i;
    ret->neg = 0;
    while (n--) {
        l = (l << 8L) | *(s++);
        if (m-- == 0) {
            ret->d[--i] = l;
            l = 0;
            m = BN_BYTES - 1;
        }
    }
    bn_correct_top(ret);
    return (ret);
}
['static int SRP_user_pwd_set_sv(SRP_user_pwd *vinfo, const char *s,\n                               const char *v)\n{\n    unsigned char tmp[MAX_LEN];\n    int len;\n    if (strlen(s) > MAX_LEN || strlen(v) > MAX_LEN)\n        return 0;\n    len = t_fromb64(tmp, v);\n    if (NULL == (vinfo->v = BN_bin2bn(tmp, len, NULL)))\n        return 0;\n    len = t_fromb64(tmp, s);\n    return ((vinfo->s = BN_bin2bn(tmp, len, NULL)) != NULL);\n}', "static int t_fromb64(unsigned char *a, const char *src)\n{\n    char *loc;\n    int i, j;\n    int size;\n    while (*src && (*src == ' ' || *src == '\\t' || *src == '\\n'))\n        ++src;\n    size = strlen(src);\n    i = 0;\n    while (i < size) {\n        loc = strchr(b64table, src[i]);\n        if (loc == (char *)0)\n            break;\n        else\n            a[i] = loc - b64table;\n        ++i;\n    }\n    if (i == 0)\n        return 0;\n    size = i;\n    i = size - 1;\n    j = size;\n    while (1) {\n        a[j] = a[i];\n        if (--i < 0)\n            break;\n        a[j] |= (a[i] & 3) << 6;\n        --j;\n        a[j] = (unsigned char)((a[i] & 0x3c) >> 2);\n        if (--i < 0)\n            break;\n        a[j] |= (a[i] & 0xf) << 4;\n        --j;\n        a[j] = (unsigned char)((a[i] & 0x30) >> 4);\n        if (--i < 0)\n            break;\n        a[j] |= (a[i] << 2);\n        a[--j] = 0;\n        if (--i < 0)\n            break;\n    }\n    while (a[j] == 0 && j <= size)\n        ++j;\n    i = 0;\n    while (j <= size)\n        a[i++] = a[j++];\n    return i;\n}", 'BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)\n{\n    unsigned int i, m;\n    unsigned int n;\n    BN_ULONG l;\n    BIGNUM *bn = NULL;\n    if (ret == NULL)\n        ret = bn = BN_new();\n    if (ret == NULL)\n        return (NULL);\n    bn_check_top(ret);\n    l = 0;\n    n = len;\n    if (n == 0) {\n        ret->top = 0;\n        return (ret);\n    }\n    i = ((n - 1) / BN_BYTES) + 1;\n    m = ((n - 1) % (BN_BYTES));\n    if (bn_wexpand(ret, (int)i) == NULL) {\n        if (bn)\n            BN_free(bn);\n        return NULL;\n    }\n    ret->top = i;\n    ret->neg = 0;\n    while (n--) {\n        l = (l << 8L) | *(s++);\n        if (m-- == 0) {\n            ret->d[--i] = l;\n            l = 0;\n            m = BN_BYTES - 1;\n        }\n    }\n    bn_correct_top(ret);\n    return (ret);\n}']