crypto/pem/pvkfmt.c:773: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned32 by call to `EVP_DecryptFinal_ex`.
Showing all 11 steps of the trace


crypto/pem/pvkfmt.c:771:8: Call
769.   		if (!EVP_DecryptInit_ex(&cctx, EVP_rc4(), NULL, keybuf, NULL))
770.   			goto err;
771.   		if (!EVP_DecryptUpdate(&cctx, q, &enctmplen, p, inlen))
              ^
772.   			goto err;
773.   		if (!EVP_DecryptFinal_ex(&cctx, q + enctmplen, &enctmplen))

crypto/evp/evp_enc.c:425:1: Parameter `ctx->buf[*]`
  423.   	}
  424.   
  425. > int EVP_DecryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,
  426.   	     const unsigned char *in, int inl)
  427.   	{

crypto/pem/pvkfmt.c:773:8: Call
771.   		if (!EVP_DecryptUpdate(&cctx, q, &enctmplen, p, inlen))
772.   			goto err;
773.   		if (!EVP_DecryptFinal_ex(&cctx, q + enctmplen, &enctmplen))
              ^
774.   			goto err;
775.   		magic = read_ledword((const unsigned char **)&q);

crypto/evp/evp_enc.c:493:1: Parameter `ctx->final[*]`
  491.   	}
  492.   
  493. > int EVP_DecryptFinal_ex(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl)
  494.   	{
  495.   	unsigned int i, b;

crypto/evp/evp_enc.c:528:3: Assignment
  526.   			}
  527.   		OPENSSL_assert(b <= sizeof ctx->final);
  528.   		pad=ctx->final[b-1];
           ^
  529.   
  530.   		padding_good = (unsigned char)(~constant_time_is_zero_8(pad));

crypto/evp/evp_enc.c:530:35: Call
  528.   		pad=ctx->final[b-1];
  529.   
  530.   		padding_good = (unsigned char)(~constant_time_is_zero_8(pad));
                                           ^
  531.   		padding_good &= constant_time_ge_8(b, pad);
  532.   

crypto/constant_time_locl.h:170:1: Parameter `a`
    168.   	}
    169.   
    170. > static inline unsigned char constant_time_is_zero_8(unsigned int a)
    171.   	{
    172.   	return (unsigned char)(constant_time_is_zero(a));

crypto/constant_time_locl.h:172:25: Call
    170.   static inline unsigned char constant_time_is_zero_8(unsigned int a)
    171.   	{
    172.   	return (unsigned char)(constant_time_is_zero(a));
                                   ^
    173.   	}
    174.   

crypto/constant_time_locl.h:165:1: <LHS trace>
163.   	}
164.   
165. > static inline unsigned int constant_time_is_zero(unsigned int a)
166.   	{
167.   	return constant_time_msb(~a & (a - 1));

crypto/constant_time_locl.h:165:1: Parameter `a`
      163.   	}
      164.   
      165. > static inline unsigned int constant_time_is_zero(unsigned int a)
      166.   	{
      167.   	return constant_time_msb(~a & (a - 1));

crypto/constant_time_locl.h:167:9: Binary operation: ([0, +oo] - 1):unsigned32 by call to `EVP_DecryptFinal_ex` 
      165.   static inline unsigned int constant_time_is_zero(unsigned int a)
      166.   	{
      167.   	return constant_time_msb(~a & (a - 1));
                     ^
      168.   	}
      169.   

static inline unsigned int constant_time_is_zero(unsigned int a)
	{
	return constant_time_msb(~a & (a - 1));
	}
['static EVP_PKEY *do_PVK_body(const unsigned char **in,\n\t\tunsigned int saltlen, unsigned int keylen,\n\t\tpem_password_cb *cb, void *u)\n\t{\n\tEVP_PKEY *ret = NULL;\n\tconst unsigned char *p = *in;\n\tunsigned int magic;\n\tunsigned char *enctmp = NULL, *q;\n\tEVP_CIPHER_CTX cctx;\n\tEVP_CIPHER_CTX_init(&cctx);\n\tif (saltlen)\n\t\t{\n\t\tchar psbuf[PEM_BUFSIZE];\n\t\tunsigned char keybuf[20];\n\t\tint enctmplen, inlen;\n\t\tif (cb)\n\t\t\tinlen=cb(psbuf,PEM_BUFSIZE,0,u);\n\t\telse\n\t\t\tinlen=PEM_def_callback(psbuf,PEM_BUFSIZE,0,u);\n\t\tif (inlen <= 0)\n\t\t\t{\n\t\t\tPEMerr(PEM_F_DO_PVK_BODY,PEM_R_BAD_PASSWORD_READ);\n\t\t\treturn NULL;\n\t\t\t}\n\t\tenctmp = OPENSSL_malloc(keylen + 8);\n\t\tif (!enctmp)\n\t\t\t{\n\t\t\tPEMerr(PEM_F_DO_PVK_BODY, ERR_R_MALLOC_FAILURE);\n\t\t\treturn NULL;\n\t\t\t}\n\t\tif (!derive_pvk_key(keybuf, p, saltlen,\n\t\t\t    (unsigned char *)psbuf, inlen))\n\t\t\treturn NULL;\n\t\tp += saltlen;\n\t\tmemcpy(enctmp, p, 8);\n\t\tp += 8;\n\t\tif (keylen < 8)\n\t\t\t{\n\t\t\tPEMerr(PEM_F_DO_PVK_BODY, PEM_R_PVK_TOO_SHORT);\n\t\t\treturn NULL;\n\t\t\t}\n\t\tinlen = keylen - 8;\n\t\tq = enctmp + 8;\n\t\tif (!EVP_DecryptInit_ex(&cctx, EVP_rc4(), NULL, keybuf, NULL))\n\t\t\tgoto err;\n\t\tif (!EVP_DecryptUpdate(&cctx, q, &enctmplen, p, inlen))\n\t\t\tgoto err;\n\t\tif (!EVP_DecryptFinal_ex(&cctx, q + enctmplen, &enctmplen))\n\t\t\tgoto err;\n\t\tmagic = read_ledword((const unsigned char **)&q);\n\t\tif (magic != MS_RSA2MAGIC && magic != MS_DSS2MAGIC)\n\t\t\t{\n\t\t\tq = enctmp + 8;\n\t\t\tmemset(keybuf + 5, 0, 11);\n\t\t\tif (!EVP_DecryptInit_ex(&cctx, EVP_rc4(), NULL, keybuf,\n\t\t\t\t\t\t\t\tNULL))\n\t\t\t\tgoto err;\n\t\t\tOPENSSL_cleanse(keybuf, 20);\n\t\t\tif (!EVP_DecryptUpdate(&cctx, q, &enctmplen, p, inlen))\n\t\t\t\tgoto err;\n\t\t\tif (!EVP_DecryptFinal_ex(&cctx, q + enctmplen,\n\t\t\t\t\t\t\t\t&enctmplen))\n\t\t\t\tgoto err;\n\t\t\tmagic = read_ledword((const unsigned char **)&q);\n\t\t\tif (magic != MS_RSA2MAGIC && magic != MS_DSS2MAGIC)\n\t\t\t\t{\n\t\t\t\tPEMerr(PEM_F_DO_PVK_BODY, PEM_R_BAD_DECRYPT);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\t}\n\t\telse\n\t\t\tOPENSSL_cleanse(keybuf, 20);\n\t\tp = enctmp;\n\t\t}\n\tret = b2i_PrivateKey(&p, keylen);\n\terr:\n\tEVP_CIPHER_CTX_cleanup(&cctx);\n\tif (enctmp && saltlen)\n\t\tOPENSSL_free(enctmp);\n\treturn ret;\n\t}', 'int EVP_DecryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,\n\t     const unsigned char *in, int inl)\n\t{\n\tint fix_len;\n\tunsigned int b;\n\tif (ctx->cipher->flags & EVP_CIPH_FLAG_CUSTOM_CIPHER)\n\t\t{\n\t\tfix_len = ctx->cipher->do_cipher(ctx, out, in, inl);\n\t\tif (fix_len < 0)\n\t\t\t{\n\t\t\t*outl = 0;\n\t\t\treturn 0;\n\t\t\t}\n\t\telse\n\t\t\t*outl = fix_len;\n\t\treturn 1;\n\t\t}\n\tif (inl <= 0)\n\t\t{\n\t\t*outl = 0;\n\t\treturn inl == 0;\n\t\t}\n\tif (ctx->flags & EVP_CIPH_NO_PADDING)\n\t\treturn EVP_EncryptUpdate(ctx, out, outl, in, inl);\n\tb=ctx->cipher->block_size;\n\tOPENSSL_assert(b <= sizeof ctx->final);\n\tif(ctx->final_used)\n\t\t{\n\t\tmemcpy(out,ctx->final,b);\n\t\tout+=b;\n\t\tfix_len = 1;\n\t\t}\n\telse\n\t\tfix_len = 0;\n\tif(!EVP_EncryptUpdate(ctx,out,outl,in,inl))\n\t\treturn 0;\n\tif (b > 1 && !ctx->buf_len)\n\t\t{\n\t\t*outl-=b;\n\t\tctx->final_used=1;\n\t\tmemcpy(ctx->final,&out[*outl],b);\n\t\t}\n\telse\n\t\tctx->final_used = 0;\n\tif (fix_len)\n\t\t*outl += b;\n\treturn 1;\n\t}', 'int EVP_DecryptFinal_ex(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl)\n\t{\n\tunsigned int i, b;\n        unsigned char pad, padding_good;\n\t*outl=0;\n\tif (ctx->cipher->flags & EVP_CIPH_FLAG_CUSTOM_CIPHER)\n\t\t{\n\t\tint ret = ctx->cipher->do_cipher(ctx, out, NULL, 0);\n\t\tif (ret < 0)\n\t\t\treturn 0;\n\t\telse\n\t\t\t*outl = ret;\n\t\treturn 1;\n\t\t}\n\tb=(unsigned int)(ctx->cipher->block_size);\n\tif (ctx->flags & EVP_CIPH_NO_PADDING)\n\t\t{\n\t\tif(ctx->buf_len)\n\t\t\t{\n\t\t\tEVPerr(EVP_F_EVP_DECRYPTFINAL_EX,EVP_R_DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH);\n\t\t\treturn 0;\n\t\t\t}\n\t\t*outl = 0;\n\t\treturn 1;\n\t\t}\n\tif (b > 1)\n\t\t{\n\t\tif (ctx->buf_len || !ctx->final_used)\n\t\t\t{\n\t\t\tEVPerr(EVP_F_EVP_DECRYPTFINAL_EX,EVP_R_WRONG_FINAL_BLOCK_LENGTH);\n\t\t\treturn(0);\n\t\t\t}\n\t\tOPENSSL_assert(b <= sizeof ctx->final);\n\t\tpad=ctx->final[b-1];\n\t\tpadding_good = (unsigned char)(~constant_time_is_zero_8(pad));\n\t\tpadding_good &= constant_time_ge_8(b, pad);\n                for (i = 1; i < b; ++i)\n\t\t\t{\n\t\t\tunsigned char is_pad_index = constant_time_lt_8(i, pad);\n\t\t\tunsigned char pad_byte_good = constant_time_eq_8(ctx->final[b-i-1], pad);\n\t\t\tpadding_good &= constant_time_select_8(is_pad_index, pad_byte_good, 0xff);\n\t\t\t}\n\t\tfor (i = 0; i < b - 1; ++i)\n\t\t\tout[i] = ctx->final[i] & padding_good;\n\t\t*outl = padding_good & ((unsigned char)(b - pad));\n\t\treturn padding_good & 1;\n\t\t}\n\telse\n\t\t{\n\t\t*outl = 0;\n\t\treturn 1;\n\t\t}\n\t}', 'static inline unsigned char constant_time_is_zero_8(unsigned int a)\n\t{\n\treturn (unsigned char)(constant_time_is_zero(a));\n\t}', 'static inline unsigned int constant_time_is_zero(unsigned int a)\n\t{\n\treturn constant_time_msb(~a & (a - 1));\n\t}']