test/bntest.c:922: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_mod_exp_recp`.
Showing all 12 steps of the trace


test/bntest.c:902:10: Call
900.        */
901.   
902.       if (!BN_generate_prime_ex(b, 512, 0, NULL, NULL, NULL))
                ^
903.           goto err;
904.       b->neg = rand_neg();

crypto/bn/bn_prime.c:54:1: Parameter `ret->top`
  52.   }
  53.   
  54. > int BN_generate_prime_ex(BIGNUM *ret, int bits, int safe,
  55.                            const BIGNUM *add, const BIGNUM *rem, BN_GENCB *cb)
  56.   {

test/bntest.c:922:14: Call
920.           b->neg = 0;
921.   
922.           if (!BN_mod_exp_recp(r, a, t, b, ctx))
                    ^
923.               goto err;
924.           b->neg = 1;

crypto/bn/bn_exp.c:161:1: Parameter `m->top`
  159.   }
  160.   
  161. > int BN_mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
  162.                       const BIGNUM *m, BN_CTX *ctx)
  163.   {

crypto/bn/bn_exp.c:198:14: Call
  196.       if (m->neg) {
  197.           /* ignore sign of 'm' */
  198.           if (!BN_copy(aa, m))
                      ^
  199.               goto err;
  200.           aa->neg = 0;

crypto/bn/bn_lib.c:323:1: <Offset trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `b->top`
    321.   }
    322.   
    323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
    324.   {
    325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: <Length trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `*a->d`
    321.   }
    322.   
    323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
    324.   {
    325.       bn_check_top(b);

crypto/bn/bn_lib.c:329:9: Call
    327.       if (a == b)
    328.           return a;
    329.       if (bn_wexpand(a, b->top) == NULL)
                   ^
    330.           return NULL;
    331.   

crypto/bn/bn_lib.c:948:1: Parameter `*a->d`
      946.   }
      947.   
      948. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
      949.   {
      950.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:333:9: Array access: Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_mod_exp_recp` 
    331.   
    332.       if (b->top > 0)
    333.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                   ^
    334.   
    335.       a->top = b->top;

BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
{
    bn_check_top(b);
    if (a == b)
        return a;
    if (bn_wexpand(a, b->top) == NULL)
        return NULL;
    if (b->top > 0)
        memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
    a->top = b->top;
    a->neg = b->neg;
    bn_check_top(a);
    return a;
}
['static int test_kronecker()\n{\n    BIGNUM *a, *b, *r, *t;\n    int i;\n    int legendre, kronecker;\n    int st = 0;\n    a = BN_new();\n    b = BN_new();\n    r = BN_new();\n    t = BN_new();\n    if (a == NULL || b == NULL || r == NULL || t == NULL)\n        goto err;\n    if (!BN_generate_prime_ex(b, 512, 0, NULL, NULL, NULL))\n        goto err;\n    b->neg = rand_neg();\n    for (i = 0; i < NUM0; i++) {\n        if (!BN_bntest_rand(a, 512, 0, 0))\n            goto err;\n        a->neg = rand_neg();\n        if (!BN_copy(t, b))\n            goto err;\n        t->neg = 0;\n        if (!BN_sub_word(t, 1))\n            goto err;\n        if (!BN_rshift1(t, t))\n            goto err;\n        b->neg = 0;\n        if (!BN_mod_exp_recp(r, a, t, b, ctx))\n            goto err;\n        b->neg = 1;\n        if (BN_is_word(r, 1))\n            legendre = 1;\n        else if (BN_is_zero(r))\n            legendre = 0;\n        else {\n            if (!BN_add_word(r, 1))\n                goto err;\n            if (0 != BN_ucmp(r, b)) {\n                printf("Legendre symbol computation failed\\n");\n                goto err;\n            }\n            legendre = -1;\n        }\n        kronecker = BN_kronecker(a, b, ctx);\n        if (kronecker < -1)\n            goto err;\n        if (a->neg && b->neg)\n            kronecker = -kronecker;\n        if (legendre != kronecker) {\n            printf("legendre != kronecker; a = ");\n            BN_print_fp(stdout, a);\n            printf(", b = ");\n            BN_print_fp(stdout, b);\n            printf("\\n");\n            goto err;\n        }\n    }\n    st = 1;\n err:\n    BN_free(a);\n    BN_free(b);\n    BN_free(r);\n    BN_free(t);\n    return st;\n}', 'int BN_generate_prime_ex(BIGNUM *ret, int bits, int safe,\n                         const BIGNUM *add, const BIGNUM *rem, BN_GENCB *cb)\n{\n    BIGNUM *t;\n    int found = 0;\n    int i, j, c1 = 0;\n    BN_CTX *ctx = NULL;\n    prime_t *mods = NULL;\n    int checks = BN_prime_checks_for_size(bits);\n    if (bits < 2) {\n        BNerr(BN_F_BN_GENERATE_PRIME_EX, BN_R_BITS_TOO_SMALL);\n        return 0;\n    } else if (bits == 2 && safe) {\n        BNerr(BN_F_BN_GENERATE_PRIME_EX, BN_R_BITS_TOO_SMALL);\n        return 0;\n    }\n    mods = OPENSSL_zalloc(sizeof(*mods) * NUMPRIMES);\n    if (mods == NULL)\n        goto err;\n    ctx = BN_CTX_new();\n    if (ctx == NULL)\n        goto err;\n    BN_CTX_start(ctx);\n    t = BN_CTX_get(ctx);\n    if (!t)\n        goto err;\n loop:\n    if (add == NULL) {\n        if (!probable_prime(ret, bits, mods))\n            goto err;\n    } else {\n        if (safe) {\n            if (!probable_prime_dh_safe(ret, bits, add, rem, ctx))\n                goto err;\n        } else {\n            if (!bn_probable_prime_dh(ret, bits, add, rem, ctx))\n                goto err;\n        }\n    }\n    if (!BN_GENCB_call(cb, 0, c1++))\n        goto err;\n    if (!safe) {\n        i = BN_is_prime_fasttest_ex(ret, checks, ctx, 0, cb);\n        if (i == -1)\n            goto err;\n        if (i == 0)\n            goto loop;\n    } else {\n        if (!BN_rshift1(t, ret))\n            goto err;\n        for (i = 0; i < checks; i++) {\n            j = BN_is_prime_fasttest_ex(ret, 1, ctx, 0, cb);\n            if (j == -1)\n                goto err;\n            if (j == 0)\n                goto loop;\n            j = BN_is_prime_fasttest_ex(t, 1, ctx, 0, cb);\n            if (j == -1)\n                goto err;\n            if (j == 0)\n                goto loop;\n            if (!BN_GENCB_call(cb, 2, c1 - 1))\n                goto err;\n        }\n    }\n    found = 1;\n err:\n    OPENSSL_free(mods);\n    if (ctx != NULL)\n        BN_CTX_end(ctx);\n    BN_CTX_free(ctx);\n    bn_check_top(ret);\n    return found;\n}', 'int BN_mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,\n                    const BIGNUM *m, BN_CTX *ctx)\n{\n    int i, j, bits, ret = 0, wstart, wend, window, wvalue;\n    int start = 1;\n    BIGNUM *aa;\n    BIGNUM *val[TABLE_SIZE];\n    BN_RECP_CTX recp;\n    if (BN_get_flags(p, BN_FLG_CONSTTIME) != 0) {\n        BNerr(BN_F_BN_MOD_EXP_RECP, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);\n        return 0;\n    }\n    bits = BN_num_bits(p);\n    if (bits == 0) {\n        if (BN_is_one(m)) {\n            ret = 1;\n            BN_zero(r);\n        } else {\n            ret = BN_one(r);\n        }\n        return ret;\n    }\n    BN_CTX_start(ctx);\n    aa = BN_CTX_get(ctx);\n    val[0] = BN_CTX_get(ctx);\n    if (!aa || !val[0])\n        goto err;\n    BN_RECP_CTX_init(&recp);\n    if (m->neg) {\n        if (!BN_copy(aa, m))\n            goto err;\n        aa->neg = 0;\n        if (BN_RECP_CTX_set(&recp, aa, ctx) <= 0)\n            goto err;\n    } else {\n        if (BN_RECP_CTX_set(&recp, m, ctx) <= 0)\n            goto err;\n    }\n    if (!BN_nnmod(val[0], a, m, ctx))\n        goto err;\n    if (BN_is_zero(val[0])) {\n        BN_zero(r);\n        ret = 1;\n        goto err;\n    }\n    window = BN_window_bits_for_exponent_size(bits);\n    if (window > 1) {\n        if (!BN_mod_mul_reciprocal(aa, val[0], val[0], &recp, ctx))\n            goto err;\n        j = 1 << (window - 1);\n        for (i = 1; i < j; i++) {\n            if (((val[i] = BN_CTX_get(ctx)) == NULL) ||\n                !BN_mod_mul_reciprocal(val[i], val[i - 1], aa, &recp, ctx))\n                goto err;\n        }\n    }\n    start = 1;\n    wvalue = 0;\n    wstart = bits - 1;\n    wend = 0;\n    if (!BN_one(r))\n        goto err;\n    for (;;) {\n        if (BN_is_bit_set(p, wstart) == 0) {\n            if (!start)\n                if (!BN_mod_mul_reciprocal(r, r, r, &recp, ctx))\n                    goto err;\n            if (wstart == 0)\n                break;\n            wstart--;\n            continue;\n        }\n        j = wstart;\n        wvalue = 1;\n        wend = 0;\n        for (i = 1; i < window; i++) {\n            if (wstart - i < 0)\n                break;\n            if (BN_is_bit_set(p, wstart - i)) {\n                wvalue <<= (i - wend);\n                wvalue |= 1;\n                wend = i;\n            }\n        }\n        j = wend + 1;\n        if (!start)\n            for (i = 0; i < j; i++) {\n                if (!BN_mod_mul_reciprocal(r, r, r, &recp, ctx))\n                    goto err;\n            }\n        if (!BN_mod_mul_reciprocal(r, r, val[wvalue >> 1], &recp, ctx))\n            goto err;\n        wstart -= wend + 1;\n        wvalue = 0;\n        start = 0;\n        if (wstart < 0)\n            break;\n    }\n    ret = 1;\n err:\n    BN_CTX_end(ctx);\n    BN_RECP_CTX_free(&recp);\n    bn_check_top(r);\n    return (ret);\n}', 'BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)\n{\n    bn_check_top(b);\n    if (a == b)\n        return a;\n    if (bn_wexpand(a, b->top) == NULL)\n        return NULL;\n    if (b->top > 0)\n        memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);\n    a->top = b->top;\n    a->neg = b->neg;\n    bn_check_top(a);\n    return a;\n}', 'BIGNUM *bn_wexpand(BIGNUM *a, int words)\n{\n    return (words <= a->dmax) ? a : bn_expand2(a, words);\n}']