crypto/bn/bn_nist.c:448: error: BUFFER_OVERRUN_L3
  Offset: 5 Size: [0, 16777214].
Showing all 6 steps of the trace


crypto/bn/bn_nist.c:367:1: <Length trace>
365.           }
366.   
367. > int BN_nist_mod_192(BIGNUM *r, const BIGNUM *a, const BIGNUM *field,
368.                       BN_CTX *ctx)
369.   {

crypto/bn/bn_nist.c:367:1: Parameter `*a->d`
365.           }
366.   
367. > int BN_nist_mod_192(BIGNUM *r, const BIGNUM *a, const BIGNUM *field,
368.                       BN_CTX *ctx)
369.   {

crypto/bn/bn_nist.c:372:5: Assignment
370.       int top = a->top, i;
371.       int carry;
372.       register BN_ULONG *r_d, *a_d = a->d;
           ^
373.       union {
374.           BN_ULONG bn[BN_NIST_192_TOP];

crypto/bn/bn_nist.c:405:9: Assignment
403.           nist_cp_bn(r_d, a_d, BN_NIST_192_TOP);
404.       } else
405.           r_d = a_d;
               ^
406.   
407.       nist_cp_bn_0(buf.bn, a_d + BN_NIST_192_TOP, top - BN_NIST_192_TOP,

crypto/bn/bn_nist.c:413:9: Assignment
411.       {
412.           NIST_INT64 acc;         /* accumulator */
413.           unsigned int *rp = (unsigned int *)r_d;
               ^
414.           const unsigned int *bp = (const unsigned int *)buf.ui;
415.   

crypto/bn/bn_nist.c:448:16: Array access: Offset: 5 Size: [0, 16777214]
446.           acc >>= 32;
447.   
448.           acc += rp[5];
                      ^
449.           acc += bp[4 * 2 - 5];
450.           acc += bp[5 * 2 - 5];

int BN_nist_mod_192(BIGNUM *r, const BIGNUM *a, const BIGNUM *field,
                    BN_CTX *ctx)
{
    int top = a->top, i;
    int carry;
    register BN_ULONG *r_d, *a_d = a->d;
    union {
        BN_ULONG bn[BN_NIST_192_TOP];
        unsigned int ui[BN_NIST_192_TOP * sizeof(BN_ULONG) /
                        sizeof(unsigned int)];
    } buf;
    BN_ULONG c_d[BN_NIST_192_TOP], *res;
    PTR_SIZE_INT mask;
    static const BIGNUM _bignum_nist_p_192_sqr = {
        (BN_ULONG *)_nist_p_192_sqr,
        OSSL_NELEM(_nist_p_192_sqr),
        OSSL_NELEM(_nist_p_192_sqr),
        0, BN_FLG_STATIC_DATA
    };
    field = &_bignum_nist_p_192;
    if (BN_is_negative(a) || BN_ucmp(a, &_bignum_nist_p_192_sqr) >= 0)
        return BN_nnmod(r, a, field, ctx);
    i = BN_ucmp(field, a);
    if (i == 0) {
        BN_zero(r);
        return 1;
    } else if (i > 0)
        return (r == a) ? 1 : (BN_copy(r, a) != NULL);
    if (r != a) {
        if (!bn_wexpand(r, BN_NIST_192_TOP))
            return 0;
        r_d = r->d;
        nist_cp_bn(r_d, a_d, BN_NIST_192_TOP);
    } else
        r_d = a_d;
    nist_cp_bn_0(buf.bn, a_d + BN_NIST_192_TOP, top - BN_NIST_192_TOP,
                 BN_NIST_192_TOP);
#if defined(NIST_INT64)
    {
        NIST_INT64 acc;
        unsigned int *rp = (unsigned int *)r_d;
        const unsigned int *bp = (const unsigned int *)buf.ui;
        acc = rp[0];
        acc += bp[3 * 2 - 6];
        acc += bp[5 * 2 - 6];
        rp[0] = (unsigned int)acc;
        acc >>= 32;
        acc += rp[1];
        acc += bp[3 * 2 - 5];
        acc += bp[5 * 2 - 5];
        rp[1] = (unsigned int)acc;
        acc >>= 32;
        acc += rp[2];
        acc += bp[3 * 2 - 6];
        acc += bp[4 * 2 - 6];
        acc += bp[5 * 2 - 6];
        rp[2] = (unsigned int)acc;
        acc >>= 32;
        acc += rp[3];
        acc += bp[3 * 2 - 5];
        acc += bp[4 * 2 - 5];
        acc += bp[5 * 2 - 5];
        rp[3] = (unsigned int)acc;
        acc >>= 32;
        acc += rp[4];
        acc += bp[4 * 2 - 6];
        acc += bp[5 * 2 - 6];
        rp[4] = (unsigned int)acc;
        acc >>= 32;
        acc += rp[5];
        acc += bp[4 * 2 - 5];
        acc += bp[5 * 2 - 5];
        rp[5] = (unsigned int)acc;
        carry = (int)(acc >> 32);
    }
#else
    {
        BN_ULONG t_d[BN_NIST_192_TOP];
        nist_set_192(t_d, buf.bn, 0, 3, 3);
        carry = (int)bn_add_words(r_d, r_d, t_d, BN_NIST_192_TOP);
        nist_set_192(t_d, buf.bn, 4, 4, 0);
        carry += (int)bn_add_words(r_d, r_d, t_d, BN_NIST_192_TOP);
        nist_set_192(t_d, buf.bn, 5, 5, 5)
            carry += (int)bn_add_words(r_d, r_d, t_d, BN_NIST_192_TOP);
    }
#endif
    if (carry > 0)
        carry =
            (int)bn_sub_words(r_d, r_d, _nist_p_192[carry - 1],
                              BN_NIST_192_TOP);
    else
        carry = 1;
    mask =
        0 - (PTR_SIZE_INT) bn_sub_words(c_d, r_d, _nist_p_192[0],
                                        BN_NIST_192_TOP);
    mask &= 0 - (PTR_SIZE_INT) carry;
    res = c_d;
    res = (BN_ULONG *)
        (((PTR_SIZE_INT) res & ~mask) | ((PTR_SIZE_INT) r_d & mask));
    nist_cp_bn(r_d, res, BN_NIST_192_TOP);
    r->top = BN_NIST_192_TOP;
    bn_correct_top(r);
    return 1;
}
['int BN_nist_mod_192(BIGNUM *r, const BIGNUM *a, const BIGNUM *field,\n                    BN_CTX *ctx)\n{\n    int top = a->top, i;\n    int carry;\n    register BN_ULONG *r_d, *a_d = a->d;\n    union {\n        BN_ULONG bn[BN_NIST_192_TOP];\n        unsigned int ui[BN_NIST_192_TOP * sizeof(BN_ULONG) /\n                        sizeof(unsigned int)];\n    } buf;\n    BN_ULONG c_d[BN_NIST_192_TOP], *res;\n    PTR_SIZE_INT mask;\n    static const BIGNUM _bignum_nist_p_192_sqr = {\n        (BN_ULONG *)_nist_p_192_sqr,\n        OSSL_NELEM(_nist_p_192_sqr),\n        OSSL_NELEM(_nist_p_192_sqr),\n        0, BN_FLG_STATIC_DATA\n    };\n    field = &_bignum_nist_p_192;\n    if (BN_is_negative(a) || BN_ucmp(a, &_bignum_nist_p_192_sqr) >= 0)\n        return BN_nnmod(r, a, field, ctx);\n    i = BN_ucmp(field, a);\n    if (i == 0) {\n        BN_zero(r);\n        return 1;\n    } else if (i > 0)\n        return (r == a) ? 1 : (BN_copy(r, a) != NULL);\n    if (r != a) {\n        if (!bn_wexpand(r, BN_NIST_192_TOP))\n            return 0;\n        r_d = r->d;\n        nist_cp_bn(r_d, a_d, BN_NIST_192_TOP);\n    } else\n        r_d = a_d;\n    nist_cp_bn_0(buf.bn, a_d + BN_NIST_192_TOP, top - BN_NIST_192_TOP,\n                 BN_NIST_192_TOP);\n#if defined(NIST_INT64)\n    {\n        NIST_INT64 acc;\n        unsigned int *rp = (unsigned int *)r_d;\n        const unsigned int *bp = (const unsigned int *)buf.ui;\n        acc = rp[0];\n        acc += bp[3 * 2 - 6];\n        acc += bp[5 * 2 - 6];\n        rp[0] = (unsigned int)acc;\n        acc >>= 32;\n        acc += rp[1];\n        acc += bp[3 * 2 - 5];\n        acc += bp[5 * 2 - 5];\n        rp[1] = (unsigned int)acc;\n        acc >>= 32;\n        acc += rp[2];\n        acc += bp[3 * 2 - 6];\n        acc += bp[4 * 2 - 6];\n        acc += bp[5 * 2 - 6];\n        rp[2] = (unsigned int)acc;\n        acc >>= 32;\n        acc += rp[3];\n        acc += bp[3 * 2 - 5];\n        acc += bp[4 * 2 - 5];\n        acc += bp[5 * 2 - 5];\n        rp[3] = (unsigned int)acc;\n        acc >>= 32;\n        acc += rp[4];\n        acc += bp[4 * 2 - 6];\n        acc += bp[5 * 2 - 6];\n        rp[4] = (unsigned int)acc;\n        acc >>= 32;\n        acc += rp[5];\n        acc += bp[4 * 2 - 5];\n        acc += bp[5 * 2 - 5];\n        rp[5] = (unsigned int)acc;\n        carry = (int)(acc >> 32);\n    }\n#else\n    {\n        BN_ULONG t_d[BN_NIST_192_TOP];\n        nist_set_192(t_d, buf.bn, 0, 3, 3);\n        carry = (int)bn_add_words(r_d, r_d, t_d, BN_NIST_192_TOP);\n        nist_set_192(t_d, buf.bn, 4, 4, 0);\n        carry += (int)bn_add_words(r_d, r_d, t_d, BN_NIST_192_TOP);\n        nist_set_192(t_d, buf.bn, 5, 5, 5)\n            carry += (int)bn_add_words(r_d, r_d, t_d, BN_NIST_192_TOP);\n    }\n#endif\n    if (carry > 0)\n        carry =\n            (int)bn_sub_words(r_d, r_d, _nist_p_192[carry - 1],\n                              BN_NIST_192_TOP);\n    else\n        carry = 1;\n    mask =\n        0 - (PTR_SIZE_INT) bn_sub_words(c_d, r_d, _nist_p_192[0],\n                                        BN_NIST_192_TOP);\n    mask &= 0 - (PTR_SIZE_INT) carry;\n    res = c_d;\n    res = (BN_ULONG *)\n        (((PTR_SIZE_INT) res & ~mask) | ((PTR_SIZE_INT) r_d & mask));\n    nist_cp_bn(r_d, res, BN_NIST_192_TOP);\n    r->top = BN_NIST_192_TOP;\n    bn_correct_top(r);\n    return 1;\n}']