crypto/ec/ec_ameth.c:727: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 67108856] by call to `ecdh_cms_set_peerkey`.
Showing all 18 steps of the trace


crypto/ec/ec_ameth.c:727:14: Call
725.           if (!alg || !pubkey)
726.               return 0;
727.           if (!ecdh_cms_set_peerkey(pctx, alg, pubkey)) {
                    ^
728.               ECerr(EC_F_ECDH_CMS_DECRYPT, EC_R_PEER_KEY_ERROR);
729.               return 0;

crypto/ec/ec_ameth.c:568:1: Parameter `pctx->pkey->pkey.ec->group->mont_data->N.top`
  566.   #ifndef OPENSSL_NO_CMS
  567.   
  568. > static int ecdh_cms_set_peerkey(EVP_PKEY_CTX *pctx,
  569.                                   X509_ALGOR *alg, ASN1_BIT_STRING *pubkey)
  570.   {

crypto/ec/ec_ameth.c:593:14: Call
  591.           if (ecpeer == NULL)
  592.               goto err;
  593.           if (!EC_KEY_set_group(ecpeer, grp))
                      ^
  594.               goto err;
  595.       } else {

crypto/ec/ec_key.c:424:1: Parameter `group->mont_data->N.top`
    422.   }
    423.   
    424. > int EC_KEY_set_group(EC_KEY *key, const EC_GROUP *group)
    425.   {
    426.       if (key->meth->set_group != NULL && key->meth->set_group(key, group) == 0)

crypto/ec/ec_key.c:429:18: Call
    427.           return 0;
    428.       EC_GROUP_free(key->group);
    429.       key->group = EC_GROUP_dup(group);
                            ^
    430.       return (key->group == NULL) ? 0 : 1;
    431.   }

crypto/ec/ec_lib.c:236:1: Parameter `a->mont_data->N.top`
      234.   }
      235.   
      236. > EC_GROUP *EC_GROUP_dup(const EC_GROUP *a)
      237.   {
      238.       EC_GROUP *t = NULL;

crypto/ec/ec_lib.c:246:10: Call
      244.       if ((t = EC_GROUP_new(a->meth)) == NULL)
      245.           return (NULL);
      246.       if (!EC_GROUP_copy(t, a))
                      ^
      247.           goto err;
      248.   

crypto/ec/ec_lib.c:135:1: Parameter `src->mont_data->N.top`
        133.   }
        134.   
        135. > int EC_GROUP_copy(EC_GROUP *dest, const EC_GROUP *src)
        136.   {
        137.       if (dest->meth->group_copy == 0) {

crypto/ec/ec_lib.c:186:14: Call
        184.                   return 0;
        185.           }
        186.           if (!BN_MONT_CTX_copy(dest->mont_data, src->mont_data))
                            ^
        187.               return 0;
        188.       } else {

crypto/bn/bn_mont.c:381:1: Parameter `from->N.top`
          379.   }
          380.   
          381. > BN_MONT_CTX *BN_MONT_CTX_copy(BN_MONT_CTX *to, BN_MONT_CTX *from)
          382.   {
          383.       if (to == from)

crypto/bn/bn_mont.c:388:10: Call
          386.       if (!BN_copy(&(to->RR), &(from->RR)))
          387.           return NULL;
          388.       if (!BN_copy(&(to->N), &(from->N)))
                          ^
          389.           return NULL;
          390.       if (!BN_copy(&(to->Ni), &(from->Ni)))

crypto/bn/bn_lib.c:323:1: <Offset trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `b->top`
            321.   }
            322.   
            323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
            324.   {
            325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: <Length trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `*a->d`
            321.   }
            322.   
            323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
            324.   {
            325.       bn_check_top(b);

crypto/bn/bn_lib.c:329:9: Call
            327.       if (a == b)
            328.           return a;
            329.       if (bn_wexpand(a, b->top) == NULL)
                           ^
            330.           return NULL;
            331.   

crypto/bn/bn_lib.c:948:1: Parameter `*a->d`
              946.   }
              947.   
              948. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
              949.   {
              950.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:333:9: Array access: Offset added: [8, +oo] Size: [0, 67108856] by call to `ecdh_cms_set_peerkey` 
            331.   
            332.       if (b->top > 0)
            333.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                           ^
            334.   
            335.       a->top = b->top;

BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
{
    bn_check_top(b);
    if (a == b)
        return a;
    if (bn_wexpand(a, b->top) == NULL)
        return NULL;
    if (b->top > 0)
        memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
    a->top = b->top;
    a->neg = b->neg;
    bn_check_top(a);
    return a;
}
['static int ecdh_cms_decrypt(CMS_RecipientInfo *ri)\n{\n    EVP_PKEY_CTX *pctx;\n    pctx = CMS_RecipientInfo_get0_pkey_ctx(ri);\n    if (!pctx)\n        return 0;\n    if (!EVP_PKEY_CTX_get0_peerkey(pctx)) {\n        X509_ALGOR *alg;\n        ASN1_BIT_STRING *pubkey;\n        if (!CMS_RecipientInfo_kari_get0_orig_id(ri, &alg, &pubkey,\n                                                 NULL, NULL, NULL))\n            return 0;\n        if (!alg || !pubkey)\n            return 0;\n        if (!ecdh_cms_set_peerkey(pctx, alg, pubkey)) {\n            ECerr(EC_F_ECDH_CMS_DECRYPT, EC_R_PEER_KEY_ERROR);\n            return 0;\n        }\n    }\n    if (!ecdh_cms_set_shared_info(pctx, ri)) {\n        ECerr(EC_F_ECDH_CMS_DECRYPT, EC_R_SHARED_INFO_ERROR);\n        return 0;\n    }\n    return 1;\n}', 'static int ecdh_cms_set_peerkey(EVP_PKEY_CTX *pctx,\n                                X509_ALGOR *alg, ASN1_BIT_STRING *pubkey)\n{\n    const ASN1_OBJECT *aoid;\n    int atype;\n    const void *aval;\n    int rv = 0;\n    EVP_PKEY *pkpeer = NULL;\n    EC_KEY *ecpeer = NULL;\n    const unsigned char *p;\n    int plen;\n    X509_ALGOR_get0(&aoid, &atype, &aval, alg);\n    if (OBJ_obj2nid(aoid) != NID_X9_62_id_ecPublicKey)\n        goto err;\n    if (atype == V_ASN1_UNDEF || atype == V_ASN1_NULL) {\n        const EC_GROUP *grp;\n        EVP_PKEY *pk;\n        pk = EVP_PKEY_CTX_get0_pkey(pctx);\n        if (!pk)\n            goto err;\n        grp = EC_KEY_get0_group(pk->pkey.ec);\n        ecpeer = EC_KEY_new();\n        if (ecpeer == NULL)\n            goto err;\n        if (!EC_KEY_set_group(ecpeer, grp))\n            goto err;\n    } else {\n        ecpeer = eckey_type2param(atype, aval);\n        if (!ecpeer)\n            goto err;\n    }\n    plen = ASN1_STRING_length(pubkey);\n    p = ASN1_STRING_get0_data(pubkey);\n    if (!p || !plen)\n        goto err;\n    if (!o2i_ECPublicKey(&ecpeer, &p, plen))\n        goto err;\n    pkpeer = EVP_PKEY_new();\n    if (pkpeer == NULL)\n        goto err;\n    EVP_PKEY_set1_EC_KEY(pkpeer, ecpeer);\n    if (EVP_PKEY_derive_set_peer(pctx, pkpeer) > 0)\n        rv = 1;\n err:\n    EC_KEY_free(ecpeer);\n    EVP_PKEY_free(pkpeer);\n    return rv;\n}', 'int EC_KEY_set_group(EC_KEY *key, const EC_GROUP *group)\n{\n    if (key->meth->set_group != NULL && key->meth->set_group(key, group) == 0)\n        return 0;\n    EC_GROUP_free(key->group);\n    key->group = EC_GROUP_dup(group);\n    return (key->group == NULL) ? 0 : 1;\n}', 'EC_GROUP *EC_GROUP_dup(const EC_GROUP *a)\n{\n    EC_GROUP *t = NULL;\n    int ok = 0;\n    if (a == NULL)\n        return NULL;\n    if ((t = EC_GROUP_new(a->meth)) == NULL)\n        return (NULL);\n    if (!EC_GROUP_copy(t, a))\n        goto err;\n    ok = 1;\n err:\n    if (!ok) {\n        EC_GROUP_free(t);\n        return NULL;\n    }\n        return t;\n}', 'int EC_GROUP_copy(EC_GROUP *dest, const EC_GROUP *src)\n{\n    if (dest->meth->group_copy == 0) {\n        ECerr(EC_F_EC_GROUP_COPY, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);\n        return 0;\n    }\n    if (dest->meth != src->meth) {\n        ECerr(EC_F_EC_GROUP_COPY, EC_R_INCOMPATIBLE_OBJECTS);\n        return 0;\n    }\n    if (dest == src)\n        return 1;\n    dest->pre_comp_type = src->pre_comp_type;\n    switch (src->pre_comp_type) {\n    case PCT_none:\n        dest->pre_comp.ec = NULL;\n        break;\n    case PCT_nistz256:\n#ifdef ECP_NISTZ256_ASM\n        dest->pre_comp.nistz256 = EC_nistz256_pre_comp_dup(src->pre_comp.nistz256);\n#endif\n        break;\n#ifndef OPENSSL_NO_EC_NISTP_64_GCC_128\n    case PCT_nistp224:\n        dest->pre_comp.nistp224 = EC_nistp224_pre_comp_dup(src->pre_comp.nistp224);\n        break;\n    case PCT_nistp256:\n        dest->pre_comp.nistp256 = EC_nistp256_pre_comp_dup(src->pre_comp.nistp256);\n        break;\n    case PCT_nistp521:\n        dest->pre_comp.nistp521 = EC_nistp521_pre_comp_dup(src->pre_comp.nistp521);\n        break;\n#else\n    case PCT_nistp224:\n    case PCT_nistp256:\n    case PCT_nistp521:\n        break;\n#endif\n    case PCT_ec:\n        dest->pre_comp.ec = EC_ec_pre_comp_dup(src->pre_comp.ec);\n        break;\n    }\n    if (src->mont_data != NULL) {\n        if (dest->mont_data == NULL) {\n            dest->mont_data = BN_MONT_CTX_new();\n            if (dest->mont_data == NULL)\n                return 0;\n        }\n        if (!BN_MONT_CTX_copy(dest->mont_data, src->mont_data))\n            return 0;\n    } else {\n        BN_MONT_CTX_free(dest->mont_data);\n        dest->mont_data = NULL;\n    }\n    if (src->generator != NULL) {\n        if (dest->generator == NULL) {\n            dest->generator = EC_POINT_new(dest);\n            if (dest->generator == NULL)\n                return 0;\n        }\n        if (!EC_POINT_copy(dest->generator, src->generator))\n            return 0;\n    } else {\n        EC_POINT_clear_free(dest->generator);\n        dest->generator = NULL;\n    }\n    if ((src->meth->flags & EC_FLAGS_CUSTOM_CURVE) == 0) {\n        if (!BN_copy(dest->order, src->order))\n            return 0;\n        if (!BN_copy(dest->cofactor, src->cofactor))\n            return 0;\n    }\n    dest->curve_name = src->curve_name;\n    dest->asn1_flag = src->asn1_flag;\n    dest->asn1_form = src->asn1_form;\n    if (src->seed) {\n        OPENSSL_free(dest->seed);\n        dest->seed = OPENSSL_malloc(src->seed_len);\n        if (dest->seed == NULL)\n            return 0;\n        if (!memcpy(dest->seed, src->seed, src->seed_len))\n            return 0;\n        dest->seed_len = src->seed_len;\n    } else {\n        OPENSSL_free(dest->seed);\n        dest->seed = NULL;\n        dest->seed_len = 0;\n    }\n    return dest->meth->group_copy(dest, src);\n}', 'BN_MONT_CTX *BN_MONT_CTX_copy(BN_MONT_CTX *to, BN_MONT_CTX *from)\n{\n    if (to == from)\n        return (to);\n    if (!BN_copy(&(to->RR), &(from->RR)))\n        return NULL;\n    if (!BN_copy(&(to->N), &(from->N)))\n        return NULL;\n    if (!BN_copy(&(to->Ni), &(from->Ni)))\n        return NULL;\n    to->ri = from->ri;\n    to->n0[0] = from->n0[0];\n    to->n0[1] = from->n0[1];\n    return (to);\n}', 'BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)\n{\n    bn_check_top(b);\n    if (a == b)\n        return a;\n    if (bn_wexpand(a, b->top) == NULL)\n        return NULL;\n    if (b->top > 0)\n        memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);\n    a->top = b->top;\n    a->neg = b->neg;\n    bn_check_top(a);\n    return a;\n}', 'BIGNUM *bn_wexpand(BIGNUM *a, int words)\n{\n    return (words <= a->dmax) ? a : bn_expand2(a, words);\n}']