test/bntest.c:417: error: BUFFER_OVERRUN_L3
  Offset: [54, +oo] (⇐ [0, +oo] + [54, 64]) Size: [1, +oo] by call to `parse_bigBN`.
Showing all 10 steps of the trace


test/bntest.c:386:37: Array declaration
384.       /* Regression test for carry bug in bn_sqrx8x_internal */
385.       {
386.           static const char *ahex[] = {
                                           ^
387.                         "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
388.               "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",

test/bntest.c:417:9: Call
415.           };
416.   
417.           parse_bigBN(&a, ahex);
               ^
418.           parse_bigBN(&n, nhex);
419.       }

test/bntest.c:85:1: Parameter `(*bn_strings)->strlen`
  83.    * Parse BIGNUM from sparse hex-strings, return |BN_hex2bn| result.
  84.    */
  85. > static int parse_bigBN(BIGNUM **out, const char *bn_strings[])
  86.   {
  87.       char *bigstring = glue_strings(bn_strings, NULL);

test/bntest.c:87:23: Call
  85.   static int parse_bigBN(BIGNUM **out, const char *bn_strings[])
  86.   {
  87.       char *bigstring = glue_strings(bn_strings, NULL);
                              ^
  88.       int ret = BN_hex2bn(out, bigstring);
  89.   

test/testutil/driver.c:279:1: <Offset trace>
277.    * Optionally return the whole length of this string in |out_len|
278.    */
279. > char *glue_strings(const char *list[], size_t *out_len)
280.   {
281.       size_t len = 0;

test/testutil/driver.c:279:1: Parameter `(*list)->strlen`
    277.    * Optionally return the whole length of this string in |out_len|
    278.    */
    279. > char *glue_strings(const char *list[], size_t *out_len)
    280.   {
    281.       size_t len = 0;

test/testutil/driver.c:279:1: <Length trace>
277.    * Optionally return the whole length of this string in |out_len|
278.    */
279. > char *glue_strings(const char *list[], size_t *out_len)
280.   {
281.       size_t len = 0;

test/testutil/driver.c:279:1: Parameter `(*list)->strlen`
    277.    * Optionally return the whole length of this string in |out_len|
    278.    */
    279. > char *glue_strings(const char *list[], size_t *out_len)
    280.   {
    281.       size_t len = 0;

test/testutil/driver.c:295:9: Assignment
    293.   
    294.       for (i = 0; list[i] != NULL; i++)
    295.           p += strlen(strcpy(p, list[i]));
                   ^
    296.   
    297.       return ret;

test/testutil/driver.c:295:21: Array access: Offset: [54, +oo] (⇐ [0, +oo] + [54, 64]) Size: [1, +oo] by call to `parse_bigBN` 
    293.   
    294.       for (i = 0; list[i] != NULL; i++)
    295.           p += strlen(strcpy(p, list[i]));
                               ^
    296.   
    297.       return ret;

char *glue_strings(const char *list[], size_t *out_len)
{
    size_t len = 0;
    char *p, *ret;
    int i;
    for (i = 0; list[i] != NULL; i++)
        len += strlen(list[i]);
    if (out_len != NULL)
        *out_len = len;
    if (!TEST_ptr(ret = p = OPENSSL_malloc(len + 1)))
        return NULL;
    for (i = 0; list[i] != NULL; i++)
        p += strlen(strcpy(p, list[i]));
    return ret;
}
['static int test_modexp_mont5(void)\n{\n    BIGNUM *a = NULL, *p = NULL, *m = NULL, *d = NULL, *e = NULL;\n    BIGNUM *b = NULL, *n = NULL, *c = NULL;\n    BN_MONT_CTX *mont = NULL;\n    int st = 0;\n    if (!TEST_ptr(a = BN_new())\n            || !TEST_ptr(p = BN_new())\n            || !TEST_ptr(m = BN_new())\n            || !TEST_ptr(d = BN_new())\n            || !TEST_ptr(e = BN_new())\n            || !TEST_ptr(b = BN_new())\n            || !TEST_ptr(n = BN_new())\n            || !TEST_ptr(c = BN_new())\n            || !TEST_ptr(mont = BN_MONT_CTX_new()))\n        goto err;\n    BN_bntest_rand(m, 1024, 0, 1);\n    BN_bntest_rand(a, 1024, 0, 0);\n    BN_zero(p);\n    if (!TEST_true(BN_mod_exp_mont_consttime(d, a, p, m, ctx, NULL)))\n        goto err;\n    if (!TEST_BN_eq_one(d))\n        goto err;\n    BN_hex2bn(&a,\n        "7878787878787878787878787878787878787878787878787878787878787878"\n        "7878787878787878787878787878787878787878787878787878787878787878"\n        "7878787878787878787878787878787878787878787878787878787878787878"\n        "7878787878787878787878787878787878787878787878787878787878787878");\n    BN_hex2bn(&b,\n        "095D72C08C097BA488C5E439C655A192EAFB6380073D8C2664668EDDB4060744"\n        "E16E57FB4EDB9AE10A0CEFCDC28A894F689A128379DB279D48A2E20849D68593"\n        "9B7803BCF46CEBF5C533FB0DD35B080593DE5472E3FE5DB951B8BFF9B4CB8F03"\n        "9CC638A5EE8CDD703719F8000E6A9F63BEED5F2FCD52FF293EA05A251BB4AB81");\n    BN_hex2bn(&n,\n        "D78AF684E71DB0C39CFF4E64FB9DB567132CB9C50CC98009FEB820B26F2DED9B"\n        "91B9B5E2B83AE0AE4EB4E0523CA726BFBE969B89FD754F674CE99118C3F2D1C5"\n        "D81FDC7C54E02B60262B241D53C040E99E45826ECA37A804668E690E1AFC1CA4"\n        "2C9A15D84D4954425F0B7642FC0BD9D7B24E2618D2DCC9B729D944BADACFDDAF");\n    BN_MONT_CTX_set(mont, n, ctx);\n    BN_mod_mul_montgomery(c, a, b, mont, ctx);\n    BN_mod_mul_montgomery(d, b, a, mont, ctx);\n    if (!TEST_BN_eq(c, d))\n        goto err;\n    parse_bigBN(&n, bn1strings);\n    parse_bigBN(&a, bn2strings);\n    BN_free(b);\n    b = BN_dup(a);\n    BN_MONT_CTX_set(mont, n, ctx);\n    BN_mod_mul_montgomery(c, a, a, mont, ctx);\n    BN_mod_mul_montgomery(d, a, b, mont, ctx);\n    if (!TEST_BN_eq(c, d))\n        goto err;\n    {\n        static const char *ahex[] = {\n                      "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",\n            "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",\n            "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",\n            "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",\n            "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF8FFEADBCFC4DAE7FFF908E92820306B",\n            "9544D954000000006C0000000000000000000000000000000000000000000000",\n            "00000000000000000000FF030202FFFFF8FFEBDBCFC4DAE7FFF908E92820306B",\n            "9544D954000000006C000000FF0302030000000000FFFFFFFFFFFFFFFFFFFFFF",\n            "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF01FC00FF02FFFFFFFF",\n            "00FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00FCFD",\n            "FCFFFFFFFFFF000000000000000000FF0302030000000000FFFFFFFFFFFFFFFF",\n            "FF00FCFDFDFF030202FF00000000FFFFFFFFFFFFFFFFFF00FCFDFCFFFFFFFFFF",\n            NULL\n        };\n        static const char *nhex[] = {\n                      "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",\n            "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",\n            "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",\n            "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",\n            "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF8F8F8F8000000",\n            "00000010000000006C0000000000000000000000000000000000000000000000",\n            "00000000000000000000000000000000000000FFFFFFFFFFFFF8F8F8F8000000",\n            "00000010000000006C000000000000000000000000FFFFFFFFFFFFFFFFFFFFFF",\n            "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",\n            "00FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",\n            "FFFFFFFFFFFF000000000000000000000000000000000000FFFFFFFFFFFFFFFF",\n            "FFFFFFFFFFFFFFFFFFFF00000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",\n            NULL\n        };\n        parse_bigBN(&a, ahex);\n        parse_bigBN(&n, nhex);\n    }\n    BN_free(b);\n    b = BN_dup(a);\n    BN_MONT_CTX_set(mont, n, ctx);\n    BN_mod_mul_montgomery(c, a, a, mont, ctx);\n    BN_mod_mul_montgomery(d, a, b, mont, ctx);\n    if (!TEST_BN_eq(c, d))\n        goto err;\n    BN_bntest_rand(p, 1024, 0, 0);\n    BN_zero(a);\n    if (!TEST_true(BN_mod_exp_mont_consttime(d, a, p, m, ctx, NULL))\n            || !TEST_BN_eq_zero(d))\n        goto err;\n    BN_one(a);\n    BN_MONT_CTX_set(mont, m, ctx);\n    if (!TEST_true(BN_from_montgomery(e, a, mont, ctx))\n            || !TEST_true(BN_mod_exp_mont_consttime(d, e, p, m, ctx, NULL))\n            || !TEST_true(BN_mod_exp_simple(a, e, p, m, ctx))\n            || !TEST_BN_eq(a, d))\n        goto err;\n    BN_bntest_rand(e, 1024, 0, 0);\n    if (!TEST_true(BN_mod_exp_mont_consttime(d, e, p, m, ctx, NULL))\n            || !TEST_true(BN_mod_exp_simple(a, e, p, m, ctx))\n            || !TEST_BN_eq(a, d))\n        goto err;\n    st = 1;\nerr:\n    BN_MONT_CTX_free(mont);\n    BN_free(a);\n    BN_free(p);\n    BN_free(m);\n    BN_free(d);\n    BN_free(e);\n    BN_free(b);\n    BN_free(n);\n    BN_free(c);\n    return st;\n}', 'static int parse_bigBN(BIGNUM **out, const char *bn_strings[])\n{\n    char *bigstring = glue_strings(bn_strings, NULL);\n    int ret = BN_hex2bn(out, bigstring);\n    OPENSSL_free(bigstring);\n    return ret;\n}', 'char *glue_strings(const char *list[], size_t *out_len)\n{\n    size_t len = 0;\n    char *p, *ret;\n    int i;\n    for (i = 0; list[i] != NULL; i++)\n        len += strlen(list[i]);\n    if (out_len != NULL)\n        *out_len = len;\n    if (!TEST_ptr(ret = p = OPENSSL_malloc(len + 1)))\n        return NULL;\n    for (i = 0; list[i] != NULL; i++)\n        p += strlen(strcpy(p, list[i]));\n    return ret;\n}']