crypto/srp/srp_vfy.c:571: error: BUFFER_OVERRUN_L3
  Offset: [-2, +oo] Size: 2500 by call to `t_tob64`.
Showing all 7 steps of the trace


crypto/srp/srp_vfy.c:521:1: Array declaration
519.    * create a verifier (*salt,*verifier,g and N are in base64)
520.    */
521. > char *SRP_create_verifier(const char *user, const char *pass, char **salt,
522.                             char **verifier, const char *N, const char *g)
523.   {

crypto/srp/srp_vfy.c:571:5: Call
569.       if (((vf = OPENSSL_malloc(vfsize)) == NULL))
570.           goto err;
571.       t_tob64(vf, tmp, BN_num_bytes(v));
           ^
572.   
573.       if (*salt == NULL) {

crypto/srp/srp_vfy.c:138:1: <Offset trace>
136.    * Convert a raw byte string into a null-terminated base64 ASCII string.
137.    */
138. > static char *t_tob64(char *dst, const unsigned char *src, int size)
139.   {
140.       int c, pos = size % 3;

crypto/srp/srp_vfy.c:138:1: Parameter `size`
  136.    * Convert a raw byte string into a null-terminated base64 ASCII string.
  137.    */
  138. > static char *t_tob64(char *dst, const unsigned char *src, int size)
  139.   {
  140.       int c, pos = size % 3;

crypto/srp/srp_vfy.c:138:1: <Length trace>
136.    * Convert a raw byte string into a null-terminated base64 ASCII string.
137.    */
138. > static char *t_tob64(char *dst, const unsigned char *src, int size)
139.   {
140.       int c, pos = size % 3;

crypto/srp/srp_vfy.c:138:1: Parameter `*src`
  136.    * Convert a raw byte string into a null-terminated base64 ASCII string.
  137.    */
  138. > static char *t_tob64(char *dst, const unsigned char *src, int size)
  139.   {
  140.       int c, pos = size % 3;

crypto/srp/srp_vfy.c:178:18: Array access: Offset: [-2, +oo] Size: 2500 by call to `t_tob64` 
  176.               break;
  177.           else {
  178.               b0 = src[pos++];
                          ^
  179.               b1 = src[pos++];
  180.               b2 = src[pos++];

static char *t_tob64(char *dst, const unsigned char *src, int size)
{
    int c, pos = size % 3;
    unsigned char b0 = 0, b1 = 0, b2 = 0, notleading = 0;
    char *olddst = dst;
    switch (pos) {
    case 1:
        b2 = src[0];
        break;
    case 2:
        b1 = src[0];
        b2 = src[1];
        break;
    }
    while (1) {
        c = (b0 & 0xfc) >> 2;
        if (notleading || c != 0) {
            *dst++ = b64table[c];
            notleading = 1;
        }
        c = ((b0 & 3) << 4) | ((b1 & 0xf0) >> 4);
        if (notleading || c != 0) {
            *dst++ = b64table[c];
            notleading = 1;
        }
        c = ((b1 & 0xf) << 2) | ((b2 & 0xc0) >> 6);
        if (notleading || c != 0) {
            *dst++ = b64table[c];
            notleading = 1;
        }
        c = b2 & 0x3f;
        if (notleading || c != 0) {
            *dst++ = b64table[c];
            notleading = 1;
        }
        if (pos >= size)
            break;
        else {
            b0 = src[pos++];
            b1 = src[pos++];
            b2 = src[pos++];
        }
    }
    *dst++ = '\0';
    return olddst;
}
['char *SRP_create_verifier(const char *user, const char *pass, char **salt,\n                          char **verifier, const char *N, const char *g)\n{\n    int len;\n    char *result = NULL, *vf = NULL;\n    BIGNUM *N_bn = NULL, *g_bn = NULL, *s = NULL, *v = NULL;\n    unsigned char tmp[MAX_LEN];\n    unsigned char tmp2[MAX_LEN];\n    char *defgNid = NULL;\n    int vfsize = 0;\n    if ((user == NULL) ||\n        (pass == NULL) || (salt == NULL) || (verifier == NULL))\n        goto err;\n    if (N) {\n        if ((len = t_fromb64(tmp, N)) == 0)\n            goto err;\n        N_bn = BN_bin2bn(tmp, len, NULL);\n        if ((len = t_fromb64(tmp, g)) == 0)\n            goto err;\n        g_bn = BN_bin2bn(tmp, len, NULL);\n        defgNid = "*";\n    } else {\n        SRP_gN *gN = SRP_get_gN_by_id(g, NULL);\n        if (gN == NULL)\n            goto err;\n        N_bn = gN->N;\n        g_bn = gN->g;\n        defgNid = gN->id;\n    }\n    if (*salt == NULL) {\n        if (RAND_bytes(tmp2, SRP_RANDOM_SALT_LEN) <= 0)\n            goto err;\n        s = BN_bin2bn(tmp2, SRP_RANDOM_SALT_LEN, NULL);\n    } else {\n        if ((len = t_fromb64(tmp2, *salt)) == 0)\n            goto err;\n        s = BN_bin2bn(tmp2, len, NULL);\n    }\n    if (!SRP_create_verifier_BN(user, pass, &s, &v, N_bn, g_bn))\n        goto err;\n    BN_bn2bin(v, tmp);\n    vfsize = BN_num_bytes(v) * 2;\n    if (((vf = OPENSSL_malloc(vfsize)) == NULL))\n        goto err;\n    t_tob64(vf, tmp, BN_num_bytes(v));\n    if (*salt == NULL) {\n        char *tmp_salt;\n        if ((tmp_salt = OPENSSL_malloc(SRP_RANDOM_SALT_LEN * 2)) == NULL) {\n            goto err;\n        }\n        t_tob64(tmp_salt, tmp2, SRP_RANDOM_SALT_LEN);\n        *salt = tmp_salt;\n    }\n    *verifier = vf;\n    vf = NULL;\n    result = defgNid;\n err:\n    if (N) {\n        BN_free(N_bn);\n        BN_free(g_bn);\n    }\n    OPENSSL_clear_free(vf, vfsize);\n    BN_clear_free(s);\n    BN_clear_free(v);\n    return result;\n}', "static char *t_tob64(char *dst, const unsigned char *src, int size)\n{\n    int c, pos = size % 3;\n    unsigned char b0 = 0, b1 = 0, b2 = 0, notleading = 0;\n    char *olddst = dst;\n    switch (pos) {\n    case 1:\n        b2 = src[0];\n        break;\n    case 2:\n        b1 = src[0];\n        b2 = src[1];\n        break;\n    }\n    while (1) {\n        c = (b0 & 0xfc) >> 2;\n        if (notleading || c != 0) {\n            *dst++ = b64table[c];\n            notleading = 1;\n        }\n        c = ((b0 & 3) << 4) | ((b1 & 0xf0) >> 4);\n        if (notleading || c != 0) {\n            *dst++ = b64table[c];\n            notleading = 1;\n        }\n        c = ((b1 & 0xf) << 2) | ((b2 & 0xc0) >> 6);\n        if (notleading || c != 0) {\n            *dst++ = b64table[c];\n            notleading = 1;\n        }\n        c = b2 & 0x3f;\n        if (notleading || c != 0) {\n            *dst++ = b64table[c];\n            notleading = 1;\n        }\n        if (pos >= size)\n            break;\n        else {\n            b0 = src[pos++];\n            b1 = src[pos++];\n            b2 = src[pos++];\n        }\n    }\n    *dst++ = '\\0';\n    return olddst;\n}"]