ssl/statem/statem_srvr.c:2519: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] Size: [1, +oo].
Showing all 11 steps of the trace


ssl/statem/statem_srvr.c:2518:10: <Offset trace>
2516.       decrypt_good = constant_time_eq_int_8(rsa_decrypt[0], 0) &
2517.           constant_time_eq_int_8(rsa_decrypt[1], 2);
2518.       for (j = 2; j < padding_len - 1; j++) {
                 ^
2519.           decrypt_good &= ~constant_time_is_zero_8(rsa_decrypt[j]);
2520.       }

ssl/statem/statem_srvr.c:2518:10: Assignment
2516.       decrypt_good = constant_time_eq_int_8(rsa_decrypt[0], 0) &
2517.           constant_time_eq_int_8(rsa_decrypt[1], 2);
2518.       for (j = 2; j < padding_len - 1; j++) {
                 ^
2519.           decrypt_good &= ~constant_time_is_zero_8(rsa_decrypt[j]);
2520.       }

ssl/statem/statem_srvr.c:2473:19: <Length trace>
2471.       }
2472.   
2473.       rsa_decrypt = OPENSSL_malloc(RSA_size(rsa));
                          ^
2474.       if (rsa_decrypt == NULL) {
2475.           *al = SSL_AD_INTERNAL_ERROR;

ssl/statem/statem_srvr.c:2473:19: Call
2471.       }
2472.   
2473.       rsa_decrypt = OPENSSL_malloc(RSA_size(rsa));
                          ^
2474.       if (rsa_decrypt == NULL) {
2475.           *al = SSL_AD_INTERNAL_ERROR;

crypto/rsa/rsa_crpt.c:25:13: Call
  23.   int RSA_size(const RSA *r)
  24.   {
  25.       return (BN_num_bytes(r->n));
                    ^
  26.   }
  27.   

crypto/bn/bn_lib.c:167:9: Assignment
    165.   
    166.       if (BN_is_zero(a))
    167.           return 0;
                   ^
    168.       return ((i * BN_BITS2) + BN_num_bits_word(a->d[i]));
    169.   }

crypto/rsa/rsa_crpt.c:25:5: Assignment
  23.   int RSA_size(const RSA *r)
  24.   {
  25.       return (BN_num_bytes(r->n));
            ^
  26.   }
  27.   

ssl/statem/statem_srvr.c:2473:19: Call
2471.       }
2472.   
2473.       rsa_decrypt = OPENSSL_malloc(RSA_size(rsa));
                          ^
2474.       if (rsa_decrypt == NULL) {
2475.           *al = SSL_AD_INTERNAL_ERROR;

crypto/mem.c:165:9: Assignment
  163.   
  164.       if (num <= 0)
  165.           return NULL;
                 ^
  166.   
  167.       FAILTEST();

ssl/statem/statem_srvr.c:2473:5: Assignment
2471.       }
2472.   
2473.       rsa_decrypt = OPENSSL_malloc(RSA_size(rsa));
            ^
2474.       if (rsa_decrypt == NULL) {
2475.           *al = SSL_AD_INTERNAL_ERROR;

ssl/statem/statem_srvr.c:2519:50: Array access: Offset: [2, +oo] Size: [1, +oo]
2517.           constant_time_eq_int_8(rsa_decrypt[1], 2);
2518.       for (j = 2; j < padding_len - 1; j++) {
2519.           decrypt_good &= ~constant_time_is_zero_8(rsa_decrypt[j]);
                                                         ^
2520.       }
2521.       decrypt_good &= constant_time_is_zero_8(rsa_decrypt[padding_len - 1]);

static int tls_process_cke_rsa(SSL *s, PACKET *pkt, int *al)
{
#ifndef OPENSSL_NO_RSA
    unsigned char rand_premaster_secret[SSL_MAX_MASTER_KEY_LENGTH];
    int decrypt_len;
    unsigned char decrypt_good, version_good;
    size_t j, padding_len;
    PACKET enc_premaster;
    RSA *rsa = NULL;
    unsigned char *rsa_decrypt = NULL;
    int ret = 0;
    rsa = EVP_PKEY_get0_RSA(s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey);
    if (rsa == NULL) {
        *al = SSL_AD_HANDSHAKE_FAILURE;
        SSLerr(SSL_F_TLS_PROCESS_CKE_RSA, SSL_R_MISSING_RSA_CERTIFICATE);
        return 0;
    }
    if (s->version == SSL3_VERSION || s->version == DTLS1_BAD_VER) {
        enc_premaster = *pkt;
    } else {
        if (!PACKET_get_length_prefixed_2(pkt, &enc_premaster)
            || PACKET_remaining(pkt) != 0) {
            *al = SSL_AD_DECODE_ERROR;
            SSLerr(SSL_F_TLS_PROCESS_CKE_RSA, SSL_R_LENGTH_MISMATCH);
            return 0;
        }
    }
    if (RSA_size(rsa) < SSL_MAX_MASTER_KEY_LENGTH) {
        *al = SSL_AD_INTERNAL_ERROR;
        SSLerr(SSL_F_TLS_PROCESS_CKE_RSA, RSA_R_KEY_SIZE_TOO_SMALL);
        return 0;
    }
    rsa_decrypt = OPENSSL_malloc(RSA_size(rsa));
    if (rsa_decrypt == NULL) {
        *al = SSL_AD_INTERNAL_ERROR;
        SSLerr(SSL_F_TLS_PROCESS_CKE_RSA, ERR_R_MALLOC_FAILURE);
        return 0;
    }
    if (RAND_bytes(rand_premaster_secret, sizeof(rand_premaster_secret)) <= 0)
        goto err;
    decrypt_len = (int)RSA_private_decrypt((int)PACKET_remaining(&enc_premaster),
                                           PACKET_data(&enc_premaster),
                                           rsa_decrypt, rsa, RSA_NO_PADDING);
    if (decrypt_len < 0)
        goto err;
    if (decrypt_len < 11 + SSL_MAX_MASTER_KEY_LENGTH) {
        *al = SSL_AD_DECRYPT_ERROR;
        SSLerr(SSL_F_TLS_PROCESS_CKE_RSA, SSL_R_DECRYPTION_FAILED);
        goto err;
    }
    padding_len = decrypt_len - SSL_MAX_MASTER_KEY_LENGTH;
    decrypt_good = constant_time_eq_int_8(rsa_decrypt[0], 0) &
        constant_time_eq_int_8(rsa_decrypt[1], 2);
    for (j = 2; j < padding_len - 1; j++) {
        decrypt_good &= ~constant_time_is_zero_8(rsa_decrypt[j]);
    }
    decrypt_good &= constant_time_is_zero_8(rsa_decrypt[padding_len - 1]);
    version_good =
        constant_time_eq_8(rsa_decrypt[padding_len],
                           (unsigned)(s->client_version >> 8));
    version_good &=
        constant_time_eq_8(rsa_decrypt[padding_len + 1],
                           (unsigned)(s->client_version & 0xff));
    if (s->options & SSL_OP_TLS_ROLLBACK_BUG) {
        unsigned char workaround_good;
        workaround_good = constant_time_eq_8(rsa_decrypt[padding_len],
                                             (unsigned)(s->version >> 8));
        workaround_good &=
            constant_time_eq_8(rsa_decrypt[padding_len + 1],
                               (unsigned)(s->version & 0xff));
        version_good |= workaround_good;
    }
    decrypt_good &= version_good;
    for (j = 0; j < sizeof(rand_premaster_secret); j++) {
        rsa_decrypt[padding_len + j] =
            constant_time_select_8(decrypt_good,
                                   rsa_decrypt[padding_len + j],
                                   rand_premaster_secret[j]);
    }
    if (!ssl_generate_master_secret(s, rsa_decrypt + padding_len,
                                    sizeof(rand_premaster_secret), 0)) {
        *al = SSL_AD_INTERNAL_ERROR;
        SSLerr(SSL_F_TLS_PROCESS_CKE_RSA, ERR_R_INTERNAL_ERROR);
        goto err;
    }
    ret = 1;
 err:
    OPENSSL_free(rsa_decrypt);
    return ret;
#else
    *al = SSL_AD_INTERNAL_ERROR;
    SSLerr(SSL_F_TLS_PROCESS_CKE_RSA, ERR_R_INTERNAL_ERROR);
    return 0;
#endif
}
['static int tls_process_cke_rsa(SSL *s, PACKET *pkt, int *al)\n{\n#ifndef OPENSSL_NO_RSA\n    unsigned char rand_premaster_secret[SSL_MAX_MASTER_KEY_LENGTH];\n    int decrypt_len;\n    unsigned char decrypt_good, version_good;\n    size_t j, padding_len;\n    PACKET enc_premaster;\n    RSA *rsa = NULL;\n    unsigned char *rsa_decrypt = NULL;\n    int ret = 0;\n    rsa = EVP_PKEY_get0_RSA(s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey);\n    if (rsa == NULL) {\n        *al = SSL_AD_HANDSHAKE_FAILURE;\n        SSLerr(SSL_F_TLS_PROCESS_CKE_RSA, SSL_R_MISSING_RSA_CERTIFICATE);\n        return 0;\n    }\n    if (s->version == SSL3_VERSION || s->version == DTLS1_BAD_VER) {\n        enc_premaster = *pkt;\n    } else {\n        if (!PACKET_get_length_prefixed_2(pkt, &enc_premaster)\n            || PACKET_remaining(pkt) != 0) {\n            *al = SSL_AD_DECODE_ERROR;\n            SSLerr(SSL_F_TLS_PROCESS_CKE_RSA, SSL_R_LENGTH_MISMATCH);\n            return 0;\n        }\n    }\n    if (RSA_size(rsa) < SSL_MAX_MASTER_KEY_LENGTH) {\n        *al = SSL_AD_INTERNAL_ERROR;\n        SSLerr(SSL_F_TLS_PROCESS_CKE_RSA, RSA_R_KEY_SIZE_TOO_SMALL);\n        return 0;\n    }\n    rsa_decrypt = OPENSSL_malloc(RSA_size(rsa));\n    if (rsa_decrypt == NULL) {\n        *al = SSL_AD_INTERNAL_ERROR;\n        SSLerr(SSL_F_TLS_PROCESS_CKE_RSA, ERR_R_MALLOC_FAILURE);\n        return 0;\n    }\n    if (RAND_bytes(rand_premaster_secret, sizeof(rand_premaster_secret)) <= 0)\n        goto err;\n    decrypt_len = (int)RSA_private_decrypt((int)PACKET_remaining(&enc_premaster),\n                                           PACKET_data(&enc_premaster),\n                                           rsa_decrypt, rsa, RSA_NO_PADDING);\n    if (decrypt_len < 0)\n        goto err;\n    if (decrypt_len < 11 + SSL_MAX_MASTER_KEY_LENGTH) {\n        *al = SSL_AD_DECRYPT_ERROR;\n        SSLerr(SSL_F_TLS_PROCESS_CKE_RSA, SSL_R_DECRYPTION_FAILED);\n        goto err;\n    }\n    padding_len = decrypt_len - SSL_MAX_MASTER_KEY_LENGTH;\n    decrypt_good = constant_time_eq_int_8(rsa_decrypt[0], 0) &\n        constant_time_eq_int_8(rsa_decrypt[1], 2);\n    for (j = 2; j < padding_len - 1; j++) {\n        decrypt_good &= ~constant_time_is_zero_8(rsa_decrypt[j]);\n    }\n    decrypt_good &= constant_time_is_zero_8(rsa_decrypt[padding_len - 1]);\n    version_good =\n        constant_time_eq_8(rsa_decrypt[padding_len],\n                           (unsigned)(s->client_version >> 8));\n    version_good &=\n        constant_time_eq_8(rsa_decrypt[padding_len + 1],\n                           (unsigned)(s->client_version & 0xff));\n    if (s->options & SSL_OP_TLS_ROLLBACK_BUG) {\n        unsigned char workaround_good;\n        workaround_good = constant_time_eq_8(rsa_decrypt[padding_len],\n                                             (unsigned)(s->version >> 8));\n        workaround_good &=\n            constant_time_eq_8(rsa_decrypt[padding_len + 1],\n                               (unsigned)(s->version & 0xff));\n        version_good |= workaround_good;\n    }\n    decrypt_good &= version_good;\n    for (j = 0; j < sizeof(rand_premaster_secret); j++) {\n        rsa_decrypt[padding_len + j] =\n            constant_time_select_8(decrypt_good,\n                                   rsa_decrypt[padding_len + j],\n                                   rand_premaster_secret[j]);\n    }\n    if (!ssl_generate_master_secret(s, rsa_decrypt + padding_len,\n                                    sizeof(rand_premaster_secret), 0)) {\n        *al = SSL_AD_INTERNAL_ERROR;\n        SSLerr(SSL_F_TLS_PROCESS_CKE_RSA, ERR_R_INTERNAL_ERROR);\n        goto err;\n    }\n    ret = 1;\n err:\n    OPENSSL_free(rsa_decrypt);\n    return ret;\n#else\n    *al = SSL_AD_INTERNAL_ERROR;\n    SSLerr(SSL_F_TLS_PROCESS_CKE_RSA, ERR_R_INTERNAL_ERROR);\n    return 0;\n#endif\n}', 'int RSA_size(const RSA *r)\n{\n    return (BN_num_bytes(r->n));\n}', 'int BN_num_bits(const BIGNUM *a)\n{\n    int i = a->top - 1;\n    bn_check_top(a);\n    if (BN_is_zero(a))\n        return 0;\n    return ((i * BN_BITS2) + BN_num_bits_word(a->d[i]));\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)\n        return malloc_impl(num, file, line);\n    if (num <= 0)\n        return NULL;\n    FAILTEST();\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    osslargused(file); osslargused(line);\n    ret = malloc(num);\n#endif\n    return ret;\n}']