crypto/rsa/rsa_gen.c:189: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, 8388607] by call to `BN_sub`.
Showing all 10 steps of the trace


crypto/rsa/rsa_gen.c:189:36: Call
187.                   }
188.               }
189.               if (!BN_sub(r2, prime, BN_value_one()))
                                          ^
190.                   goto err;
191.               ERR_set_mark();

crypto/bn/bn_lib.c:84:9: Assignment
  82.       static const BN_ULONG data_one = 1L;
  83.       static const BIGNUM const_one =
  84.           { (BN_ULONG *)&data_one, 1, 1, 0, BN_FLG_STATIC_DATA };
                ^
  85.   
  86.       return &const_one;

crypto/rsa/rsa_gen.c:189:18: Call
187.                   }
188.               }
189.               if (!BN_sub(r2, prime, BN_value_one()))
                        ^
190.                   goto err;
191.               ERR_set_mark();

crypto/bn/bn_add.c:45:1: Parameter `b->top`
  43.   
  44.   /* signed sub of b from a. */
  45. > int BN_sub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
  46.   {
  47.       int ret, r_neg, cmp_res;

crypto/bn/bn_add.c:59:19: Call
  57.           if (cmp_res > 0) {
  58.               r_neg = a->neg;
  59.               ret = BN_usub(r, a, b);
                          ^
  60.           } else if (cmp_res < 0) {
  61.               r_neg = !b->neg;

crypto/bn/bn_add.c:125:1: <Length trace>
123.   
124.   /* unsigned subtraction of b from a, a must be larger than b. */
125. > int BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
126.   {
127.       int max, min, dif;

crypto/bn/bn_add.c:125:1: Parameter `b->top`
    123.   
    124.   /* unsigned subtraction of b from a, a must be larger than b. */
    125. > int BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
    126.   {
    127.       int max, min, dif;

crypto/bn/bn_add.c:135:5: Assignment
    133.   
    134.       max = a->top;
    135.       min = b->top;
               ^
    136.       dif = max - min;
    137.   

crypto/bn/bn_add.c:152:5: Assignment
    150.       borrow = bn_sub_words(rp, ap, bp, min);
    151.       ap += min;
    152.       rp += min;
               ^
    153.   
    154.       while (dif) {

crypto/bn/bn_add.c:158:9: Array access: Offset: [1, +oo] Size: [0, 8388607] by call to `BN_sub` 
    156.           t1 = *(ap++);
    157.           t2 = (t1 - borrow) & BN_MASK2;
    158.           *(rp++) = t2;
                   ^
    159.           borrow &= (t1 == 0);
    160.       }

int BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
{
    int max, min, dif;
    BN_ULONG t1, t2, borrow, *rp;
    const BN_ULONG *ap, *bp;
    bn_check_top(a);
    bn_check_top(b);
    max = a->top;
    min = b->top;
    dif = max - min;
    if (dif < 0) {
        BNerr(BN_F_BN_USUB, BN_R_ARG2_LT_ARG3);
        return 0;
    }
    if (bn_wexpand(r, max) == NULL)
        return 0;
    ap = a->d;
    bp = b->d;
    rp = r->d;
    borrow = bn_sub_words(rp, ap, bp, min);
    ap += min;
    rp += min;
    while (dif) {
        dif--;
        t1 = *(ap++);
        t2 = (t1 - borrow) & BN_MASK2;
        *(rp++) = t2;
        borrow &= (t1 == 0);
    }
    while (max && *--rp == 0)
        max--;
    r->top = max;
    r->neg = 0;
    bn_pollute(r);
    return 1;
}
['static int rsa_builtin_keygen(RSA *rsa, int bits, int primes, BIGNUM *e_value,\n                              BN_GENCB *cb)\n{\n    BIGNUM *r0 = NULL, *r1 = NULL, *r2 = NULL, *tmp, *prime;\n    int ok = -1, n = 0, bitsr[RSA_MAX_PRIME_NUM], bitse = 0;\n    int i = 0, quo = 0, rmd = 0, adj = 0, retries = 0;\n    RSA_PRIME_INFO *pinfo = NULL;\n    STACK_OF(RSA_PRIME_INFO) *prime_infos = NULL;\n    BN_CTX *ctx = NULL;\n    BN_ULONG bitst = 0;\n    unsigned long error = 0;\n    if (bits < RSA_MIN_MODULUS_BITS) {\n        ok = 0;\n        RSAerr(RSA_F_RSA_BUILTIN_KEYGEN, RSA_R_KEY_SIZE_TOO_SMALL);\n        goto err;\n    }\n    if (primes < RSA_DEFAULT_PRIME_NUM || primes > rsa_multip_cap(bits)) {\n        ok = 0;\n        RSAerr(RSA_F_RSA_BUILTIN_KEYGEN, RSA_R_KEY_PRIME_NUM_INVALID);\n        goto err;\n    }\n    ctx = BN_CTX_new();\n    if (ctx == NULL)\n        goto err;\n    BN_CTX_start(ctx);\n    r0 = BN_CTX_get(ctx);\n    r1 = BN_CTX_get(ctx);\n    r2 = BN_CTX_get(ctx);\n    if (r2 == NULL)\n        goto err;\n    quo = bits / primes;\n    rmd = bits % primes;\n    for (i = 0; i < primes; i++)\n        bitsr[i] = (i < rmd) ? quo + 1 : quo;\n    if (!rsa->n && ((rsa->n = BN_new()) == NULL))\n        goto err;\n    if (!rsa->d && ((rsa->d = BN_secure_new()) == NULL))\n        goto err;\n    if (!rsa->e && ((rsa->e = BN_new()) == NULL))\n        goto err;\n    if (!rsa->p && ((rsa->p = BN_secure_new()) == NULL))\n        goto err;\n    if (!rsa->q && ((rsa->q = BN_secure_new()) == NULL))\n        goto err;\n    if (!rsa->dmp1 && ((rsa->dmp1 = BN_secure_new()) == NULL))\n        goto err;\n    if (!rsa->dmq1 && ((rsa->dmq1 = BN_secure_new()) == NULL))\n        goto err;\n    if (!rsa->iqmp && ((rsa->iqmp = BN_secure_new()) == NULL))\n        goto err;\n    if (primes > RSA_DEFAULT_PRIME_NUM) {\n        rsa->version = RSA_ASN1_VERSION_MULTI;\n        prime_infos = sk_RSA_PRIME_INFO_new_reserve(NULL, primes - 2);\n        if (prime_infos == NULL)\n            goto err;\n        if (rsa->prime_infos != NULL) {\n            sk_RSA_PRIME_INFO_pop_free(rsa->prime_infos, rsa_multip_info_free);\n        }\n        rsa->prime_infos = prime_infos;\n        for (i = 2; i < primes; i++) {\n            pinfo = rsa_multip_info_new();\n            if (pinfo == NULL)\n                goto err;\n            (void)sk_RSA_PRIME_INFO_push(prime_infos, pinfo);\n        }\n    }\n    if (BN_copy(rsa->e, e_value) == NULL)\n        goto err;\n    for (i = 0; i < primes; i++) {\n        adj = 0;\n        retries = 0;\n        if (i == 0) {\n            prime = rsa->p;\n        } else if (i == 1) {\n            prime = rsa->q;\n        } else {\n            pinfo = sk_RSA_PRIME_INFO_value(prime_infos, i - 2);\n            prime = pinfo->r;\n        }\n        BN_set_flags(prime, BN_FLG_CONSTTIME);\n        for (;;) {\n redo:\n            if (!BN_generate_prime_ex(prime, bitsr[i] + adj, 0, NULL, NULL, cb))\n                goto err;\n            {\n                int j;\n                for (j = 0; j < i; j++) {\n                    BIGNUM *prev_prime;\n                    if (j == 0)\n                        prev_prime = rsa->p;\n                    else if (j == 1)\n                        prev_prime = rsa->q;\n                    else\n                        prev_prime = sk_RSA_PRIME_INFO_value(prime_infos,\n                                                             j - 2)->r;\n                    if (!BN_cmp(prime, prev_prime)) {\n                        goto redo;\n                    }\n                }\n            }\n            if (!BN_sub(r2, prime, BN_value_one()))\n                goto err;\n            ERR_set_mark();\n            BN_set_flags(r2, BN_FLG_CONSTTIME);\n            if (BN_mod_inverse(r1, r2, rsa->e, ctx) != NULL) {\n                break;\n            }\n            error = ERR_peek_last_error();\n            if (ERR_GET_LIB(error) == ERR_LIB_BN\n                && ERR_GET_REASON(error) == BN_R_NO_INVERSE) {\n                ERR_pop_to_mark();\n            } else {\n                goto err;\n            }\n            if (!BN_GENCB_call(cb, 2, n++))\n                goto err;\n        }\n        bitse += bitsr[i];\n        if (i == 1) {\n            if (!BN_mul(r1, rsa->p, rsa->q, ctx))\n                goto err;\n        } else if (i != 0) {\n            if (!BN_mul(r1, rsa->n, prime, ctx))\n                goto err;\n        } else {\n            if (!BN_GENCB_call(cb, 3, i))\n                goto err;\n            continue;\n        }\n        if (!BN_rshift(r2, r1, bitse - 4))\n            goto err;\n        bitst = BN_get_word(r2);\n        if (bitst < 0x9 || bitst > 0xF) {\n            bitse -= bitsr[i];\n            if (!BN_GENCB_call(cb, 2, n++))\n                goto err;\n            if (primes > 4) {\n                if (bitst < 0x9)\n                    adj++;\n                else\n                    adj--;\n            } else if (retries == 4) {\n                i = -1;\n                bitse = 0;\n                continue;\n            }\n            retries++;\n            goto redo;\n        }\n        if (i > 1 && BN_copy(pinfo->pp, rsa->n) == NULL)\n            goto err;\n        if (BN_copy(rsa->n, r1) == NULL)\n            goto err;\n        if (!BN_GENCB_call(cb, 3, i))\n            goto err;\n    }\n    if (BN_cmp(rsa->p, rsa->q) < 0) {\n        tmp = rsa->p;\n        rsa->p = rsa->q;\n        rsa->q = tmp;\n    }\n    if (!BN_sub(r1, rsa->p, BN_value_one()))\n        goto err;\n    if (!BN_sub(r2, rsa->q, BN_value_one()))\n        goto err;\n    if (!BN_mul(r0, r1, r2, ctx))\n        goto err;\n    for (i = 2; i < primes; i++) {\n        pinfo = sk_RSA_PRIME_INFO_value(prime_infos, i - 2);\n        if (!BN_sub(pinfo->d, pinfo->r, BN_value_one()))\n            goto err;\n        if (!BN_mul(r0, r0, pinfo->d, ctx))\n            goto err;\n    }\n    {\n        BIGNUM *pr0 = BN_new();\n        if (pr0 == NULL)\n            goto err;\n        BN_with_flags(pr0, r0, BN_FLG_CONSTTIME);\n        if (!BN_mod_inverse(rsa->d, rsa->e, pr0, ctx)) {\n            BN_free(pr0);\n            goto err;\n        }\n        BN_free(pr0);\n    }\n    {\n        BIGNUM *d = BN_new();\n        if (d == NULL)\n            goto err;\n        BN_with_flags(d, rsa->d, BN_FLG_CONSTTIME);\n        if (!BN_mod(rsa->dmp1, d, r1, ctx)\n            || !BN_mod(rsa->dmq1, d, r2, ctx)) {\n            BN_free(d);\n            goto err;\n        }\n        for (i = 2; i < primes; i++) {\n            pinfo = sk_RSA_PRIME_INFO_value(prime_infos, i - 2);\n            if (!BN_mod(pinfo->d, d, pinfo->d, ctx)) {\n                BN_free(d);\n                goto err;\n            }\n        }\n        BN_free(d);\n    }\n    {\n        BIGNUM *p = BN_new();\n        if (p == NULL)\n            goto err;\n        BN_with_flags(p, rsa->p, BN_FLG_CONSTTIME);\n        if (!BN_mod_inverse(rsa->iqmp, rsa->q, p, ctx)) {\n            BN_free(p);\n            goto err;\n        }\n        for (i = 2; i < primes; i++) {\n            pinfo = sk_RSA_PRIME_INFO_value(prime_infos, i - 2);\n            BN_with_flags(p, pinfo->r, BN_FLG_CONSTTIME);\n            if (!BN_mod_inverse(pinfo->t, pinfo->pp, p, ctx)) {\n                BN_free(p);\n                goto err;\n            }\n        }\n        BN_free(p);\n    }\n    ok = 1;\n err:\n    if (ok == -1) {\n        RSAerr(RSA_F_RSA_BUILTIN_KEYGEN, ERR_LIB_BN);\n        ok = 0;\n    }\n    if (ctx != NULL)\n        BN_CTX_end(ctx);\n    BN_CTX_free(ctx);\n    return ok;\n}', 'const BIGNUM *BN_value_one(void)\n{\n    static const BN_ULONG data_one = 1L;\n    static const BIGNUM const_one =\n        { (BN_ULONG *)&data_one, 1, 1, 0, BN_FLG_STATIC_DATA };\n    return &const_one;\n}', 'int BN_sub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)\n{\n    int ret, r_neg, cmp_res;\n    bn_check_top(a);\n    bn_check_top(b);\n    if (a->neg != b->neg) {\n        r_neg = a->neg;\n        ret = BN_uadd(r, a, b);\n    } else {\n        cmp_res = BN_ucmp(a, b);\n        if (cmp_res > 0) {\n            r_neg = a->neg;\n            ret = BN_usub(r, a, b);\n        } else if (cmp_res < 0) {\n            r_neg = !b->neg;\n            ret = BN_usub(r, b, a);\n        } else {\n            r_neg = 0;\n            BN_zero(r);\n            ret = 1;\n        }\n    }\n    r->neg = r_neg;\n    bn_check_top(r);\n    return ret;\n}', 'int BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)\n{\n    int max, min, dif;\n    BN_ULONG t1, t2, borrow, *rp;\n    const BN_ULONG *ap, *bp;\n    bn_check_top(a);\n    bn_check_top(b);\n    max = a->top;\n    min = b->top;\n    dif = max - min;\n    if (dif < 0) {\n        BNerr(BN_F_BN_USUB, BN_R_ARG2_LT_ARG3);\n        return 0;\n    }\n    if (bn_wexpand(r, max) == NULL)\n        return 0;\n    ap = a->d;\n    bp = b->d;\n    rp = r->d;\n    borrow = bn_sub_words(rp, ap, bp, min);\n    ap += min;\n    rp += min;\n    while (dif) {\n        dif--;\n        t1 = *(ap++);\n        t2 = (t1 - borrow) & BN_MASK2;\n        *(rp++) = t2;\n        borrow &= (t1 == 0);\n    }\n    while (max && *--rp == 0)\n        max--;\n    r->top = max;\n    r->neg = 0;\n    bn_pollute(r);\n    return 1;\n}']