crypto/pkcs12/p12_key.c:184: error: BUFFER_OVERRUN_L3
  Offset: 0 Size: [0, 8388607] by call to `BN_add_word`.
Showing all 8 steps of the trace


crypto/pkcs12/p12_key.c:182:14: Call
180.               B[j] = Ai[j % u];
181.           /* Work out B + 1 first then can use B as tmp space */
182.           if (!BN_bin2bn(B, v, Bpl1))
                    ^
183.               goto err;
184.           if (!BN_add_word(Bpl1, 1))

crypto/bn/bn_lib.c:542:1: Parameter `*ret->d`
  540.   }
  541.   
  542. > BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)
  543.   {
  544.       unsigned int i, m;

crypto/pkcs12/p12_key.c:184:14: Call
182.           if (!BN_bin2bn(B, v, Bpl1))
183.               goto err;
184.           if (!BN_add_word(Bpl1, 1))
                    ^
185.               goto err;
186.           for (j = 0; j < Ilen; j += v) {

crypto/bn/bn_word.c:123:1: Parameter `*a->d`
  121.   }
  122.   
  123. > int BN_add_word(BIGNUM *a, BN_ULONG w)
  124.   {
  125.       BN_ULONG l;

crypto/bn/bn_word.c:140:13: Call
  138.       if (a->neg) {
  139.           a->neg = 0;
  140.           i = BN_sub_word(a, w);
                     ^
  141.           if (!BN_is_zero(a))
  142.               a->neg = !(a->neg);

crypto/bn/bn_word.c:159:1: <Length trace>
157.   }
158.   
159. > int BN_sub_word(BIGNUM *a, BN_ULONG w)
160.   {
161.       int i;

crypto/bn/bn_word.c:159:1: Parameter `*a->d`
    157.   }
    158.   
    159. > int BN_sub_word(BIGNUM *a, BN_ULONG w)
    160.   {
    161.       int i;

crypto/bn/bn_word.c:184:27: Array access: Offset: 0 Size: [0, 8388607] by call to `BN_add_word` 
    182.       }
    183.   
    184.       if ((a->top == 1) && (a->d[0] < w)) {
                                     ^
    185.           a->d[0] = w - a->d[0];
    186.           a->neg = 1;

int BN_sub_word(BIGNUM *a, BN_ULONG w)
{
    int i;
    bn_check_top(a);
    w &= BN_MASK2;
    if (!w)
        return 1;
    if (BN_is_zero(a)) {
        i = BN_set_word(a, w);
        if (i != 0)
            BN_set_negative(a, 1);
        return i;
    }
    if (a->neg) {
        a->neg = 0;
        i = BN_add_word(a, w);
        a->neg = 1;
        return (i);
    }
    if ((a->top == 1) && (a->d[0] < w)) {
        a->d[0] = w - a->d[0];
        a->neg = 1;
        return (1);
    }
    i = 0;
    for (;;) {
        if (a->d[i] >= w) {
            a->d[i] -= w;
            break;
        } else {
            a->d[i] = (a->d[i] - w) & BN_MASK2;
            i++;
            w = 1;
        }
    }
    if ((a->d[i] == 0) && (i == (a->top - 1)))
        a->top--;
    bn_check_top(a);
    return (1);
}
['int PKCS12_key_gen_uni(unsigned char *pass, int passlen, unsigned char *salt,\n                       int saltlen, int id, int iter, int n,\n                       unsigned char *out, const EVP_MD *md_type)\n{\n    unsigned char *B = NULL, *D = NULL, *I = NULL, *p = NULL, *Ai = NULL;\n    int Slen, Plen, Ilen, Ijlen;\n    int i, j, u, v;\n    int ret = 0;\n    BIGNUM *Ij = NULL, *Bpl1 = NULL;\n    EVP_MD_CTX *ctx = NULL;\n#ifdef  DEBUG_KEYGEN\n    unsigned char *tmpout = out;\n    int tmpn = n;\n#endif\n    ctx = EVP_MD_CTX_new();\n    if (ctx == NULL)\n        goto err;\n#ifdef  DEBUG_KEYGEN\n    fprintf(stderr, "KEYGEN DEBUG\\n");\n    fprintf(stderr, "ID %d, ITER %d\\n", id, iter);\n    fprintf(stderr, "Password (length %d):\\n", passlen);\n    h__dump(pass, passlen);\n    fprintf(stderr, "Salt (length %d):\\n", saltlen);\n    h__dump(salt, saltlen);\n#endif\n    v = EVP_MD_block_size(md_type);\n    u = EVP_MD_size(md_type);\n    if (u < 0)\n        return 0;\n    D = OPENSSL_malloc(v);\n    Ai = OPENSSL_malloc(u);\n    B = OPENSSL_malloc(v + 1);\n    Slen = v * ((saltlen + v - 1) / v);\n    if (passlen)\n        Plen = v * ((passlen + v - 1) / v);\n    else\n        Plen = 0;\n    Ilen = Slen + Plen;\n    I = OPENSSL_malloc(Ilen);\n    Ij = BN_new();\n    Bpl1 = BN_new();\n    if (D == NULL || Ai == NULL || B == NULL || I == NULL || Ij == NULL\n            || Bpl1 == NULL)\n        goto err;\n    for (i = 0; i < v; i++)\n        D[i] = id;\n    p = I;\n    for (i = 0; i < Slen; i++)\n        *p++ = salt[i % saltlen];\n    for (i = 0; i < Plen; i++)\n        *p++ = pass[i % passlen];\n    for (;;) {\n        if (!EVP_DigestInit_ex(ctx, md_type, NULL)\n            || !EVP_DigestUpdate(ctx, D, v)\n            || !EVP_DigestUpdate(ctx, I, Ilen)\n            || !EVP_DigestFinal_ex(ctx, Ai, NULL))\n            goto err;\n        for (j = 1; j < iter; j++) {\n            if (!EVP_DigestInit_ex(ctx, md_type, NULL)\n                || !EVP_DigestUpdate(ctx, Ai, u)\n                || !EVP_DigestFinal_ex(ctx, Ai, NULL))\n                goto err;\n        }\n        memcpy(out, Ai, min(n, u));\n        if (u >= n) {\n#ifdef DEBUG_KEYGEN\n            fprintf(stderr, "Output KEY (length %d)\\n", tmpn);\n            h__dump(tmpout, tmpn);\n#endif\n            ret = 1;\n            goto end;\n        }\n        n -= u;\n        out += u;\n        for (j = 0; j < v; j++)\n            B[j] = Ai[j % u];\n        if (!BN_bin2bn(B, v, Bpl1))\n            goto err;\n        if (!BN_add_word(Bpl1, 1))\n            goto err;\n        for (j = 0; j < Ilen; j += v) {\n            if (!BN_bin2bn(I + j, v, Ij))\n                goto err;\n            if (!BN_add(Ij, Ij, Bpl1))\n                goto err;\n            if (!BN_bn2bin(Ij, B))\n                goto err;\n            Ijlen = BN_num_bytes(Ij);\n            if (Ijlen > v) {\n                if (!BN_bn2bin(Ij, B))\n                    goto err;\n                memcpy(I + j, B + 1, v);\n#ifndef PKCS12_BROKEN_KEYGEN\n            } else if (Ijlen < v) {\n                memset(I + j, 0, v - Ijlen);\n                if (!BN_bn2bin(Ij, I + j + v - Ijlen))\n                    goto err;\n#endif\n            } else if (!BN_bn2bin(Ij, I + j))\n                goto err;\n        }\n    }\n err:\n    PKCS12err(PKCS12_F_PKCS12_KEY_GEN_UNI, ERR_R_MALLOC_FAILURE);\n end:\n    OPENSSL_free(Ai);\n    OPENSSL_free(B);\n    OPENSSL_free(D);\n    OPENSSL_free(I);\n    BN_free(Ij);\n    BN_free(Bpl1);\n    EVP_MD_CTX_free(ctx);\n    return ret;\n}', 'BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)\n{\n    unsigned int i, m;\n    unsigned int n;\n    BN_ULONG l;\n    BIGNUM *bn = NULL;\n    if (ret == NULL)\n        ret = bn = BN_new();\n    if (ret == NULL)\n        return (NULL);\n    bn_check_top(ret);\n    for ( ; len > 0 && *s == 0; s++, len--)\n        continue;\n    n = len;\n    if (n == 0) {\n        ret->top = 0;\n        return (ret);\n    }\n    i = ((n - 1) / BN_BYTES) + 1;\n    m = ((n - 1) % (BN_BYTES));\n    if (bn_wexpand(ret, (int)i) == NULL) {\n        BN_free(bn);\n        return NULL;\n    }\n    ret->top = i;\n    ret->neg = 0;\n    l = 0;\n    while (n--) {\n        l = (l << 8L) | *(s++);\n        if (m-- == 0) {\n            ret->d[--i] = l;\n            l = 0;\n            m = BN_BYTES - 1;\n        }\n    }\n    bn_correct_top(ret);\n    return (ret);\n}', 'int BN_add_word(BIGNUM *a, BN_ULONG w)\n{\n    BN_ULONG l;\n    int i;\n    bn_check_top(a);\n    w &= BN_MASK2;\n    if (!w)\n        return 1;\n    if (BN_is_zero(a))\n        return BN_set_word(a, w);\n    if (a->neg) {\n        a->neg = 0;\n        i = BN_sub_word(a, w);\n        if (!BN_is_zero(a))\n            a->neg = !(a->neg);\n        return (i);\n    }\n    for (i = 0; w != 0 && i < a->top; i++) {\n        a->d[i] = l = (a->d[i] + w) & BN_MASK2;\n        w = (w > l) ? 1 : 0;\n    }\n    if (w && i == a->top) {\n        if (bn_wexpand(a, a->top + 1) == NULL)\n            return 0;\n        a->top++;\n        a->d[i] = w;\n    }\n    bn_check_top(a);\n    return (1);\n}', 'int BN_sub_word(BIGNUM *a, BN_ULONG w)\n{\n    int i;\n    bn_check_top(a);\n    w &= BN_MASK2;\n    if (!w)\n        return 1;\n    if (BN_is_zero(a)) {\n        i = BN_set_word(a, w);\n        if (i != 0)\n            BN_set_negative(a, 1);\n        return i;\n    }\n    if (a->neg) {\n        a->neg = 0;\n        i = BN_add_word(a, w);\n        a->neg = 1;\n        return (i);\n    }\n    if ((a->top == 1) && (a->d[0] < w)) {\n        a->d[0] = w - a->d[0];\n        a->neg = 1;\n        return (1);\n    }\n    i = 0;\n    for (;;) {\n        if (a->d[i] >= w) {\n            a->d[i] -= w;\n            break;\n        } else {\n            a->d[i] = (a->d[i] - w) & BN_MASK2;\n            i++;\n            w = 1;\n        }\n    }\n    if ((a->d[i] == 0) && (i == (a->top - 1)))\n        a->top--;\n    bn_check_top(a);\n    return (1);\n}']