crypto/rsa/rsa_ossl.c:583: error: BUFFER_OVERRUN_L3
  Offset: [31, +oo] Size: [0, 8388607] by call to `rsa_blinding_invert`.
Showing all 19 steps of the trace


crypto/rsa/rsa_ossl.c:520:9: Call
518.   
519.       /* make data into a big number */
520.       if (BN_bin2bn(from, (int)flen, f) == NULL)
               ^
521.           goto err;
522.   

crypto/bn/bn_lib.c:542:1: Parameter `ret->top`
  540.   }
  541.   
  542. > BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)
  543.   {
  544.       unsigned int i, m;

crypto/rsa/rsa_ossl.c:583:14: Call
581.   
582.       if (blinding)
583.           if (!rsa_blinding_invert(blinding, ret, unblind, ctx))
                    ^
584.               goto err;
585.   

crypto/rsa/rsa_ossl.c:325:1: Parameter `f->top`
  323.   }
  324.   
  325. > static int rsa_blinding_invert(BN_BLINDING *b, BIGNUM *f, BIGNUM *unblind,
  326.                                  BN_CTX *ctx)
  327.   {

crypto/rsa/rsa_ossl.c:336:12: Call
  334.        * to access the blinding without a lock.
  335.        */
  336.       return BN_BLINDING_invert_ex(f, unblind, b, ctx);
                    ^
  337.   }
  338.   

crypto/bn/bn_blind.c:254:1: Parameter `n->top`
    252.   }
    253.   
    254. > int BN_BLINDING_invert_ex(BIGNUM *n, const BIGNUM *r, BN_BLINDING *b,
    255.                             BN_CTX *ctx)
    256.   {

crypto/bn/bn_blind.c:262:15: Call
    260.   
    261.       if (r != NULL)
    262.           ret = BN_mod_mul(n, n, r, b->mod, ctx);
                         ^
    263.       else {
    264.           if (b->Ai == NULL) {

crypto/bn/bn_mod.c:179:1: Parameter `a->top`
      177.   
      178.   /* slow but works */
      179. > int BN_mod_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *m,
      180.                  BN_CTX *ctx)
      181.   {

crypto/bn/bn_mod.c:193:14: Call
      191.           goto err;
      192.       if (a == b) {
      193.           if (!BN_sqr(t, a, ctx))
                          ^
      194.               goto err;
      195.       } else {

crypto/bn/bn_sqr.c:66:1: Parameter `a->top`
        64.    * I've just gone over this and it is now %20 faster on x86 - eay - 27 Jun 96
        65.    */
        66. > int BN_sqr(BIGNUM *r, const BIGNUM *a, BN_CTX *ctx)
        67.   {
        68.       int max, al;

crypto/bn/bn_sqr.c:74:5: Assignment
        72.       bn_check_top(a);
        73.   
        74.       al = a->top;
                  ^
        75.       if (al <= 0) {
        76.           r->top = 0;

crypto/bn/bn_sqr.c:123:17: Call
        121.                   if (bn_wexpand(tmp, max) == NULL)
        122.                       goto err;
        123.                   bn_sqr_normal(rr->d, a->d, al, tmp->d);
                               ^
        124.               }
        125.           }

crypto/bn/bn_sqr.c:153:1: <Offset trace>
151.   
152.   /* tmp must have 2*n words */
153. > void bn_sqr_normal(BN_ULONG *r, const BN_ULONG *a, int n, BN_ULONG *tmp)
154.   {
155.       int i, j, max;

crypto/bn/bn_sqr.c:153:1: Parameter `n`
          151.   
          152.   /* tmp must have 2*n words */
          153. > void bn_sqr_normal(BN_ULONG *r, const BN_ULONG *a, int n, BN_ULONG *tmp)
          154.   {
          155.       int i, j, max;

crypto/bn/bn_sqr.c:159:5: Assignment
          157.       BN_ULONG *rp;
          158.   
          159.       max = n * 2;
                     ^
          160.       ap = a;
          161.       rp = r;

crypto/bn/bn_sqr.c:153:1: <Length trace>
151.   
152.   /* tmp must have 2*n words */
153. > void bn_sqr_normal(BN_ULONG *r, const BN_ULONG *a, int n, BN_ULONG *tmp)
154.   {
155.       int i, j, max;

crypto/bn/bn_sqr.c:153:1: Parameter `*r`
          151.   
          152.   /* tmp must have 2*n words */
          153. > void bn_sqr_normal(BN_ULONG *r, const BN_ULONG *a, int n, BN_ULONG *tmp)
          154.   {
          155.       int i, j, max;

crypto/bn/bn_sqr.c:161:5: Assignment
          159.       max = n * 2;
          160.       ap = a;
          161.       rp = r;
                     ^
          162.       rp[0] = rp[max - 1] = 0;
          163.       rp++;

crypto/bn/bn_sqr.c:162:13: Array access: Offset: [31, +oo] Size: [0, 8388607] by call to `rsa_blinding_invert` 
          160.       ap = a;
          161.       rp = r;
          162.       rp[0] = rp[max - 1] = 0;
                             ^
          163.       rp++;
          164.       j = n;

void bn_sqr_normal(BN_ULONG *r, const BN_ULONG *a, int n, BN_ULONG *tmp)
{
    int i, j, max;
    const BN_ULONG *ap;
    BN_ULONG *rp;
    max = n * 2;
    ap = a;
    rp = r;
    rp[0] = rp[max - 1] = 0;
    rp++;
    j = n;
    if (--j > 0) {
        ap++;
        rp[j] = bn_mul_words(rp, ap, j, ap[-1]);
        rp += 2;
    }
    for (i = n - 2; i > 0; i--) {
        j--;
        ap++;
        rp[j] = bn_mul_add_words(rp, ap, j, ap[-1]);
        rp += 2;
    }
    bn_add_words(r, r, r, max);
    bn_sqr_words(tmp, a, n);
    bn_add_words(r, r, tmp, max);
}
['static int rsa_ossl_private_decrypt(int flen, const unsigned char *from,\n                                   unsigned char *to, RSA *rsa, int padding)\n{\n    BIGNUM *f, *ret;\n    int j, num = 0, r = -1;\n    unsigned char *p;\n    unsigned char *buf = NULL;\n    BN_CTX *ctx = NULL;\n    int local_blinding = 0;\n    BIGNUM *unblind = NULL;\n    BN_BLINDING *blinding = NULL;\n    if ((ctx = BN_CTX_new()) == NULL)\n        goto err;\n    BN_CTX_start(ctx);\n    f = BN_CTX_get(ctx);\n    ret = BN_CTX_get(ctx);\n    num = BN_num_bytes(rsa->n);\n    buf = OPENSSL_malloc(num);\n    if (f == NULL || ret == NULL || buf == NULL) {\n        RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    if (flen > num) {\n        RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT,\n               RSA_R_DATA_GREATER_THAN_MOD_LEN);\n        goto err;\n    }\n    if (BN_bin2bn(from, (int)flen, f) == NULL)\n        goto err;\n    if (BN_ucmp(f, rsa->n) >= 0) {\n        RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT,\n               RSA_R_DATA_TOO_LARGE_FOR_MODULUS);\n        goto err;\n    }\n    if (!(rsa->flags & RSA_FLAG_NO_BLINDING)) {\n        blinding = rsa_get_blinding(rsa, &local_blinding, ctx);\n        if (blinding == NULL) {\n            RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT, ERR_R_INTERNAL_ERROR);\n            goto err;\n        }\n    }\n    if (blinding != NULL) {\n        if (!local_blinding && ((unblind = BN_CTX_get(ctx)) == NULL)) {\n            RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT, ERR_R_MALLOC_FAILURE);\n            goto err;\n        }\n        if (!rsa_blinding_convert(blinding, f, unblind, ctx))\n            goto err;\n    }\n    if ((rsa->flags & RSA_FLAG_EXT_PKEY) ||\n        ((rsa->p != NULL) &&\n         (rsa->q != NULL) &&\n         (rsa->dmp1 != NULL) && (rsa->dmq1 != NULL) && (rsa->iqmp != NULL))) {\n        if (!rsa->meth->rsa_mod_exp(ret, f, rsa, ctx))\n            goto err;\n    } else {\n        BIGNUM *d = NULL, *local_d = NULL;\n        if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME)) {\n            local_d = d = BN_new();\n            if (d == NULL) {\n                RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT, ERR_R_MALLOC_FAILURE);\n                goto err;\n            }\n            BN_with_flags(d, rsa->d, BN_FLG_CONSTTIME);\n        } else {\n            d = rsa->d;\n        }\n        if (rsa->flags & RSA_FLAG_CACHE_PUBLIC)\n            if (!BN_MONT_CTX_set_locked\n                (&rsa->_method_mod_n, CRYPTO_LOCK_RSA, rsa->n, ctx)) {\n                BN_free(local_d);\n                goto err;\n            }\n        if (!rsa->meth->bn_mod_exp(ret, f, d, rsa->n, ctx,\n                                   rsa->_method_mod_n)) {\n            BN_free(local_d);\n            goto err;\n        }\n        BN_free(local_d);\n    }\n    if (blinding)\n        if (!rsa_blinding_invert(blinding, ret, unblind, ctx))\n            goto err;\n    p = buf;\n    j = BN_bn2bin(ret, p);\n    switch (padding) {\n    case RSA_PKCS1_PADDING:\n        r = RSA_padding_check_PKCS1_type_2(to, num, buf, j, num);\n        break;\n    case RSA_PKCS1_OAEP_PADDING:\n        r = RSA_padding_check_PKCS1_OAEP(to, num, buf, j, num, NULL, 0);\n        break;\n    case RSA_SSLV23_PADDING:\n        r = RSA_padding_check_SSLv23(to, num, buf, j, num);\n        break;\n    case RSA_NO_PADDING:\n        r = RSA_padding_check_none(to, num, buf, j, num);\n        break;\n    default:\n        RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT, RSA_R_UNKNOWN_PADDING_TYPE);\n        goto err;\n    }\n    if (r < 0)\n        RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT, RSA_R_PADDING_CHECK_FAILED);\n err:\n    if (ctx != NULL)\n        BN_CTX_end(ctx);\n    BN_CTX_free(ctx);\n    OPENSSL_clear_free(buf, num);\n    return (r);\n}', 'BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)\n{\n    unsigned int i, m;\n    unsigned int n;\n    BN_ULONG l;\n    BIGNUM *bn = NULL;\n    if (ret == NULL)\n        ret = bn = BN_new();\n    if (ret == NULL)\n        return (NULL);\n    bn_check_top(ret);\n    for ( ; len > 0 && *s == 0; s++, len--)\n        continue;\n    n = len;\n    if (n == 0) {\n        ret->top = 0;\n        return (ret);\n    }\n    i = ((n - 1) / BN_BYTES) + 1;\n    m = ((n - 1) % (BN_BYTES));\n    if (bn_wexpand(ret, (int)i) == NULL) {\n        BN_free(bn);\n        return NULL;\n    }\n    ret->top = i;\n    ret->neg = 0;\n    l = 0;\n    while (n--) {\n        l = (l << 8L) | *(s++);\n        if (m-- == 0) {\n            ret->d[--i] = l;\n            l = 0;\n            m = BN_BYTES - 1;\n        }\n    }\n    bn_correct_top(ret);\n    return (ret);\n}', 'static int rsa_blinding_invert(BN_BLINDING *b, BIGNUM *f, BIGNUM *unblind,\n                               BN_CTX *ctx)\n{\n    return BN_BLINDING_invert_ex(f, unblind, b, ctx);\n}', 'int BN_BLINDING_invert_ex(BIGNUM *n, const BIGNUM *r, BN_BLINDING *b,\n                          BN_CTX *ctx)\n{\n    int ret;\n    bn_check_top(n);\n    if (r != NULL)\n        ret = BN_mod_mul(n, n, r, b->mod, ctx);\n    else {\n        if (b->Ai == NULL) {\n            BNerr(BN_F_BN_BLINDING_INVERT_EX, BN_R_NOT_INITIALIZED);\n            return (0);\n        }\n        ret = BN_mod_mul(n, n, b->Ai, b->mod, ctx);\n    }\n    bn_check_top(n);\n    return (ret);\n}', 'int BN_mod_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *m,\n               BN_CTX *ctx)\n{\n    BIGNUM *t;\n    int ret = 0;\n    bn_check_top(a);\n    bn_check_top(b);\n    bn_check_top(m);\n    BN_CTX_start(ctx);\n    if ((t = BN_CTX_get(ctx)) == NULL)\n        goto err;\n    if (a == b) {\n        if (!BN_sqr(t, a, ctx))\n            goto err;\n    } else {\n        if (!BN_mul(t, a, b, ctx))\n            goto err;\n    }\n    if (!BN_nnmod(r, t, m, ctx))\n        goto err;\n    bn_check_top(r);\n    ret = 1;\n err:\n    BN_CTX_end(ctx);\n    return (ret);\n}', 'int BN_sqr(BIGNUM *r, const BIGNUM *a, BN_CTX *ctx)\n{\n    int max, al;\n    int ret = 0;\n    BIGNUM *tmp, *rr;\n    bn_check_top(a);\n    al = a->top;\n    if (al <= 0) {\n        r->top = 0;\n        r->neg = 0;\n        return 1;\n    }\n    BN_CTX_start(ctx);\n    rr = (a != r) ? r : BN_CTX_get(ctx);\n    tmp = BN_CTX_get(ctx);\n    if (!rr || !tmp)\n        goto err;\n    max = 2 * al;\n    if (bn_wexpand(rr, max) == NULL)\n        goto err;\n    if (al == 4) {\n#ifndef BN_SQR_COMBA\n        BN_ULONG t[8];\n        bn_sqr_normal(rr->d, a->d, 4, t);\n#else\n        bn_sqr_comba4(rr->d, a->d);\n#endif\n    } else if (al == 8) {\n#ifndef BN_SQR_COMBA\n        BN_ULONG t[16];\n        bn_sqr_normal(rr->d, a->d, 8, t);\n#else\n        bn_sqr_comba8(rr->d, a->d);\n#endif\n    } else {\n#if defined(BN_RECURSION)\n        if (al < BN_SQR_RECURSIVE_SIZE_NORMAL) {\n            BN_ULONG t[BN_SQR_RECURSIVE_SIZE_NORMAL * 2];\n            bn_sqr_normal(rr->d, a->d, al, t);\n        } else {\n            int j, k;\n            j = BN_num_bits_word((BN_ULONG)al);\n            j = 1 << (j - 1);\n            k = j + j;\n            if (al == j) {\n                if (bn_wexpand(tmp, k * 2) == NULL)\n                    goto err;\n                bn_sqr_recursive(rr->d, a->d, al, tmp->d);\n            } else {\n                if (bn_wexpand(tmp, max) == NULL)\n                    goto err;\n                bn_sqr_normal(rr->d, a->d, al, tmp->d);\n            }\n        }\n#else\n        if (bn_wexpand(tmp, max) == NULL)\n            goto err;\n        bn_sqr_normal(rr->d, a->d, al, tmp->d);\n#endif\n    }\n    rr->neg = 0;\n    if (a->d[al - 1] == (a->d[al - 1] & BN_MASK2l))\n        rr->top = max - 1;\n    else\n        rr->top = max;\n    if (rr != r)\n        BN_copy(r, rr);\n    ret = 1;\n err:\n    bn_check_top(rr);\n    bn_check_top(tmp);\n    BN_CTX_end(ctx);\n    return (ret);\n}', 'void bn_sqr_normal(BN_ULONG *r, const BN_ULONG *a, int n, BN_ULONG *tmp)\n{\n    int i, j, max;\n    const BN_ULONG *ap;\n    BN_ULONG *rp;\n    max = n * 2;\n    ap = a;\n    rp = r;\n    rp[0] = rp[max - 1] = 0;\n    rp++;\n    j = n;\n    if (--j > 0) {\n        ap++;\n        rp[j] = bn_mul_words(rp, ap, j, ap[-1]);\n        rp += 2;\n    }\n    for (i = n - 2; i > 0; i--) {\n        j--;\n        ap++;\n        rp[j] = bn_mul_add_words(rp, ap, j, ap[-1]);\n        rp += 2;\n    }\n    bn_add_words(r, r, r, max);\n    bn_sqr_words(tmp, a, n);\n    bn_add_words(r, r, tmp, max);\n}']