crypto/ec/ecdsa_ossl.c:277: error: BUFFER_OVERRUN_L3
  Offset: [10, +oo] Size: [0, 8388607] by call to `ecdsa_sign_setup`.
Showing all 35 steps of the trace


crypto/ec/ecdsa_ossl.c:211:1: Parameter `eckey->group->order->top`
209.   }
210.   
211. > ECDSA_SIG *ossl_ecdsa_sign_sig(const unsigned char *dgst, int dgst_len,
212.                                  const BIGNUM *in_kinv, const BIGNUM *in_r,
213.                                  EC_KEY *eckey)

crypto/ec/ecdsa_ossl.c:260:9: Call
258.           goto err;
259.       }
260.       i = BN_num_bits(order);
               ^
261.       /*
262.        * Need to truncate digest if it is too long: first truncate whole bytes.

crypto/bn/bn_lib.c:139:9: Call
  137.       bn_check_top(a);
  138.   
  139.       if (BN_is_zero(a))
                 ^
  140.           return 0;
  141.       return ((i * BN_BITS2) + BN_num_bits_word(a->d[i]));

crypto/bn/bn_lib.c:827:1: Parameter `a->top`
    825.   }
    826.   
    827. > int BN_is_zero(const BIGNUM *a)
    828.   {
    829.       return a->top == 0;

crypto/ec/ecdsa_ossl.c:277:18: Call
275.       do {
276.           if (in_kinv == NULL || in_r == NULL) {
277.               if (!ecdsa_sign_setup(eckey, ctx, &kinv, &ret->r, dgst, dgst_len)) {
                        ^
278.                   ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_ECDSA_LIB);
279.                   goto err;

crypto/ec/ecdsa_ossl.c:34:1: Parameter `eckey->group->order->top`
  32.   }
  33.   
  34. > static int ecdsa_sign_setup(EC_KEY *eckey, BN_CTX *ctx_in,
  35.                               BIGNUM **kinvp, BIGNUM **rp,
  36.                               const unsigned char *dgst, int dlen)

crypto/ec/ecdsa_ossl.c:82:18: Call
  80.   
  81.       /* Preallocate space */
  82.       order_bits = BN_num_bits(order);
                         ^
  83.       if (!BN_set_bit(k, order_bits)
  84.           || !BN_set_bit(r, order_bits)

crypto/bn/bn_lib.c:139:9: Call
    137.       bn_check_top(a);
    138.   
    139.       if (BN_is_zero(a))
                   ^
    140.           return 0;
    141.       return ((i * BN_BITS2) + BN_num_bits_word(a->d[i]));

crypto/bn/bn_lib.c:827:1: Parameter `a->top`
      825.   }
      826.   
      827. > int BN_is_zero(const BIGNUM *a)
      828.   {
      829.       return a->top == 0;

crypto/ec/ecdsa_ossl.c:100:22: Call
  98.                   }
  99.               } else {
  100.                   if (!BN_priv_rand_range(k, order)) {
                              ^
  101.                       ECerr(EC_F_ECDSA_SIGN_SETUP,
  102.                                EC_R_RANDOM_NUMBER_GENERATION_FAILED);

crypto/bn/bn_rand.c:182:1: Parameter `range->top`
    180.   }
    181.   
    182. > int BN_priv_rand_range(BIGNUM *r, const BIGNUM *range)
    183.   {
    184.       return bnrand_range(PRIVATE, r, range);

crypto/bn/bn_rand.c:184:12: Call
    182.   int BN_priv_rand_range(BIGNUM *r, const BIGNUM *range)
    183.   {
    184.       return bnrand_range(PRIVATE, r, range);
                      ^
    185.   }
    186.   

crypto/bn/bn_rand.c:113:1: Parameter `range->top`
      111.   
      112.   /* random number r:  0 <= r < range */
      113. > static int bnrand_range(BNRAND_FLAG flag, BIGNUM *r, const BIGNUM *range)
      114.   {
      115.       int n;

crypto/ec/ecdsa_ossl.c:120:14: Call
  118.            * conditional copy.
  119.            */
  120.           if (!BN_add(r, k, order)
                      ^
  121.               || !BN_add(X, r, order)
  122.               || !BN_copy(k, BN_num_bits(r) > order_bits ? r : X))

crypto/bn/bn_add.c:14:1: Parameter `b->top`
    12.   
    13.   /* signed add of b to a. */
    14. > int BN_add(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
    15.   {
    16.       int ret, r_neg, cmp_res;

crypto/ec/ecdsa_ossl.c:121:17: Call
  119.            */
  120.           if (!BN_add(r, k, order)
  121.               || !BN_add(X, r, order)
                         ^
  122.               || !BN_copy(k, BN_num_bits(r) > order_bits ? r : X))
  123.               goto err;

crypto/bn/bn_add.c:14:1: Parameter `b->top`
    12.   
    13.   /* signed add of b to a. */
    14. > int BN_add(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
    15.   {
    16.       int ret, r_neg, cmp_res;

crypto/ec/ecdsa_ossl.c:126:14: Call
  124.   
  125.           /* compute r the x-coordinate of generator * k */
  126.           if (!EC_POINT_mul(group, tmp_point, k, NULL, NULL, ctx)) {
                      ^
  127.               ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_EC_LIB);
  128.               goto err;

crypto/ec/ec_lib.c:922:1: Parameter `group->order->top`
    920.   }
    921.   
    922. > int EC_POINT_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *g_scalar,
    923.                    const EC_POINT *point, const BIGNUM *p_scalar, BN_CTX *ctx)
    924.   {

crypto/ec/ec_lib.c:933:12: Call
    931.       scalars[0] = p_scalar;
    932.   
    933.       return EC_POINTs_mul(group, r, g_scalar,
                      ^
    934.                            (point != NULL
    935.                             && p_scalar != NULL), points, scalars, ctx);

crypto/ec/ec_lib.c:911:1: Parameter `group->order->top`
      909.    */
      910.   
      911. > int EC_POINTs_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
      912.                     size_t num, const EC_POINT *points[],
      913.                     const BIGNUM *scalars[], BN_CTX *ctx)

crypto/ec/ec_lib.c:917:16: Call
      915.       if (group->meth->mul == 0)
      916.           /* use default */
      917.           return ec_wNAF_mul(group, r, scalar, num, points, scalars, ctx);
                            ^
      918.   
      919.       return group->meth->mul(group, r, scalar, num, points, scalars, ctx);

crypto/ec/ec_mult.c:346:1: Parameter `group->order->top`
        344.    * in the addition if scalar != NULL
        345.    */
        346. > int ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
        347.                   size_t num, const EC_POINT *points[], const BIGNUM *scalars[],
        348.                   BN_CTX *ctx)

crypto/ec/ec_mult.c:388:16: Call
        386.            * constant time version.
        387.            */
        388.           return ec_mul_consttime(group, r, scalar, NULL, ctx);
                              ^
        389.       }
        390.       if ((scalar == NULL) && (num == 1)) {

crypto/ec/ec_mult.c:167:14: Call
          165.   
          166.       BN_CTX_start(ctx);
          167.       lambda = BN_CTX_get(ctx);
                              ^
          168.       k = BN_CTX_get(ctx);
          169.       if (k == NULL)

crypto/bn/bn_ctx.c:229:5: Call
            227.       }
            228.       /* OK, make sure the returned bignum is "zero" */
            229.       BN_zero(ret);
                       ^
            230.       ctx->used++;
            231.       CTXDBG_RET(ctx, ret);

crypto/bn/bn_lib.c:357:1: Parameter `*a->d`
              355.   }
              356.   
              357. > int BN_set_word(BIGNUM *a, BN_ULONG w)
              358.   {
              359.       bn_check_top(a);

crypto/bn/bn_lib.c:360:9: Call
              358.   {
              359.       bn_check_top(a);
              360.       if (bn_expand(a, (int)sizeof(BN_ULONG) * 8) == NULL)
                             ^
              361.           return 0;
              362.       a->neg = 0;

crypto/bn/bn_lcl.h:651:1: Parameter `*a->d`
                649.                            const BIGNUM *add, const BIGNUM *rem, BN_CTX *ctx);
                650.   
                651. > static ossl_inline BIGNUM *bn_expand(BIGNUM *a, int bits)
                652.   {
                653.       if (bits > (INT_MAX - BN_BITS2 + 1))

crypto/ec/ec_mult.c:207:5: Call
          205.        */
          206.       kbit = BN_is_bit_set(lambda, order_bits);
          207.       BN_consttime_swap(kbit, k, lambda, group_top + 1);
                     ^
          208.   
          209.       group_top = bn_get_top(group->field);

crypto/bn/bn_lib.c:724:1: <Offset trace>
722.    * a and b cannot be the same number
723.    */
724. > void BN_consttime_swap(BN_ULONG condition, BIGNUM *a, BIGNUM *b, int nwords)
725.   {
726.       BN_ULONG t;

crypto/bn/bn_lib.c:724:1: Parameter `nwords`
            722.    * a and b cannot be the same number
            723.    */
            724. > void BN_consttime_swap(BN_ULONG condition, BIGNUM *a, BIGNUM *b, int nwords)
            725.   {
            726.       BN_ULONG t;

crypto/bn/bn_lib.c:724:1: <Length trace>
722.    * a and b cannot be the same number
723.    */
724. > void BN_consttime_swap(BN_ULONG condition, BIGNUM *a, BIGNUM *b, int nwords)
725.   {
726.       BN_ULONG t;

crypto/bn/bn_lib.c:724:1: Parameter `*b->d`
            722.    * a and b cannot be the same number
            723.    */
            724. > void BN_consttime_swap(BN_ULONG condition, BIGNUM *a, BIGNUM *b, int nwords)
            725.   {
            726.       BN_ULONG t;

crypto/bn/bn_lib.c:765:13: Array access: Offset: [10, +oo] Size: [0, 8388607] by call to `ecdsa_sign_setup` 
            763.       default:
            764.           for (i = 10; i < nwords; i++)
            765.               BN_CONSTTIME_SWAP(i);
                               ^
            766.           /* Fallthrough */
            767.       case 10:

void BN_consttime_swap(BN_ULONG condition, BIGNUM *a, BIGNUM *b, int nwords)
{
    BN_ULONG t;
    int i;
    bn_wcheck_size(a, nwords);
    bn_wcheck_size(b, nwords);
    assert(a != b);
    assert((condition & (condition - 1)) == 0);
    assert(sizeof(BN_ULONG) >= sizeof(int));
    condition = ((condition - 1) >> (BN_BITS2 - 1)) - 1;
    t = (a->top ^ b->top) & condition;
    a->top ^= t;
    b->top ^= t;
    t = (a->neg ^ b->neg) & condition;
    a->neg ^= t;
    b->neg ^= t;
    t = (a->flags ^ b->flags) & condition & BN_FLG_CONSTTIME;
    a->flags ^= t;
    b->flags ^= t;
#define BN_CONSTTIME_SWAP(ind) \
        do { \
                t = (a->d[ind] ^ b->d[ind]) & condition; \
                a->d[ind] ^= t; \
                b->d[ind] ^= t; \
        } while (0)
    switch (nwords) {
    default:
        for (i = 10; i < nwords; i++)
            BN_CONSTTIME_SWAP(i);
    case 10:
        BN_CONSTTIME_SWAP(9);
    case 9:
        BN_CONSTTIME_SWAP(8);
    case 8:
        BN_CONSTTIME_SWAP(7);
    case 7:
        BN_CONSTTIME_SWAP(6);
    case 6:
        BN_CONSTTIME_SWAP(5);
    case 5:
        BN_CONSTTIME_SWAP(4);
    case 4:
        BN_CONSTTIME_SWAP(3);
    case 3:
        BN_CONSTTIME_SWAP(2);
    case 2:
        BN_CONSTTIME_SWAP(1);
    case 1:
        BN_CONSTTIME_SWAP(0);
    }
#undef BN_CONSTTIME_SWAP
}
['ECDSA_SIG *ossl_ecdsa_sign_sig(const unsigned char *dgst, int dgst_len,\n                               const BIGNUM *in_kinv, const BIGNUM *in_r,\n                               EC_KEY *eckey)\n{\n    int ok = 0, i;\n    BIGNUM *kinv = NULL, *s, *m = NULL, *tmp = NULL;\n    const BIGNUM *order, *ckinv;\n    BN_CTX *ctx = NULL;\n    const EC_GROUP *group;\n    ECDSA_SIG *ret;\n    const BIGNUM *priv_key;\n    group = EC_KEY_get0_group(eckey);\n    priv_key = EC_KEY_get0_private_key(eckey);\n    if (group == NULL || priv_key == NULL) {\n        ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_PASSED_NULL_PARAMETER);\n        return NULL;\n    }\n    if (!EC_KEY_can_sign(eckey)) {\n        ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, EC_R_CURVE_DOES_NOT_SUPPORT_SIGNING);\n        return NULL;\n    }\n    ret = ECDSA_SIG_new();\n    if (ret == NULL) {\n        ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_MALLOC_FAILURE);\n        return NULL;\n    }\n    ret->r = BN_new();\n    ret->s = BN_new();\n    if (ret->r == NULL || ret->s == NULL) {\n        ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    s = ret->s;\n    if ((ctx = BN_CTX_new()) == NULL ||\n        (tmp = BN_new()) == NULL || (m = BN_new()) == NULL) {\n        ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    order = EC_GROUP_get0_order(group);\n    if (order == NULL) {\n        ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_EC_LIB);\n        goto err;\n    }\n    i = BN_num_bits(order);\n    if (8 * dgst_len > i)\n        dgst_len = (i + 7) / 8;\n    if (!BN_bin2bn(dgst, dgst_len, m)) {\n        ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB);\n        goto err;\n    }\n    if ((8 * dgst_len > i) && !BN_rshift(m, m, 8 - (i & 0x7))) {\n        ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB);\n        goto err;\n    }\n    do {\n        if (in_kinv == NULL || in_r == NULL) {\n            if (!ecdsa_sign_setup(eckey, ctx, &kinv, &ret->r, dgst, dgst_len)) {\n                ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_ECDSA_LIB);\n                goto err;\n            }\n            ckinv = kinv;\n        } else {\n            ckinv = in_kinv;\n            if (BN_copy(ret->r, in_r) == NULL) {\n                ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_MALLOC_FAILURE);\n                goto err;\n            }\n        }\n        if (!BN_mod_mul(tmp, priv_key, ret->r, order, ctx)) {\n            ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB);\n            goto err;\n        }\n        if (!BN_mod_add_quick(s, tmp, m, order)) {\n            ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB);\n            goto err;\n        }\n        if (!BN_mod_mul(s, s, ckinv, order, ctx)) {\n            ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB);\n            goto err;\n        }\n        if (BN_is_zero(s)) {\n            if (in_kinv != NULL && in_r != NULL) {\n                ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, EC_R_NEED_NEW_SETUP_VALUES);\n                goto err;\n            }\n        } else\n            break;\n    }\n    while (1);\n    ok = 1;\n err:\n    if (!ok) {\n        ECDSA_SIG_free(ret);\n        ret = NULL;\n    }\n    BN_CTX_free(ctx);\n    BN_clear_free(m);\n    BN_clear_free(tmp);\n    BN_clear_free(kinv);\n    return ret;\n}', 'int BN_num_bits(const BIGNUM *a)\n{\n    int i = a->top - 1;\n    bn_check_top(a);\n    if (BN_is_zero(a))\n        return 0;\n    return ((i * BN_BITS2) + BN_num_bits_word(a->d[i]));\n}', 'int BN_is_zero(const BIGNUM *a)\n{\n    return a->top == 0;\n}', 'static int ecdsa_sign_setup(EC_KEY *eckey, BN_CTX *ctx_in,\n                            BIGNUM **kinvp, BIGNUM **rp,\n                            const unsigned char *dgst, int dlen)\n{\n    BN_CTX *ctx = NULL;\n    BIGNUM *k = NULL, *r = NULL, *X = NULL;\n    const BIGNUM *order;\n    EC_POINT *tmp_point = NULL;\n    const EC_GROUP *group;\n    int ret = 0;\n    int order_bits;\n    if (eckey == NULL || (group = EC_KEY_get0_group(eckey)) == NULL) {\n        ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_PASSED_NULL_PARAMETER);\n        return 0;\n    }\n    if (!EC_KEY_can_sign(eckey)) {\n        ECerr(EC_F_ECDSA_SIGN_SETUP, EC_R_CURVE_DOES_NOT_SUPPORT_SIGNING);\n        return 0;\n    }\n    if (ctx_in == NULL) {\n        if ((ctx = BN_CTX_new()) == NULL) {\n            ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_MALLOC_FAILURE);\n            return 0;\n        }\n    } else\n        ctx = ctx_in;\n    k = BN_new();\n    r = BN_new();\n    X = BN_new();\n    if (k == NULL || r == NULL || X == NULL) {\n        ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    if ((tmp_point = EC_POINT_new(group)) == NULL) {\n        ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_EC_LIB);\n        goto err;\n    }\n    order = EC_GROUP_get0_order(group);\n    if (order == NULL) {\n        ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_EC_LIB);\n        goto err;\n    }\n    order_bits = BN_num_bits(order);\n    if (!BN_set_bit(k, order_bits)\n        || !BN_set_bit(r, order_bits)\n        || !BN_set_bit(X, order_bits))\n        goto err;\n    do {\n        do\n            if (dgst != NULL) {\n                if (!BN_generate_dsa_nonce\n                    (k, order, EC_KEY_get0_private_key(eckey), dgst, dlen,\n                     ctx)) {\n                    ECerr(EC_F_ECDSA_SIGN_SETUP,\n                             EC_R_RANDOM_NUMBER_GENERATION_FAILED);\n                    goto err;\n                }\n            } else {\n                if (!BN_priv_rand_range(k, order)) {\n                    ECerr(EC_F_ECDSA_SIGN_SETUP,\n                             EC_R_RANDOM_NUMBER_GENERATION_FAILED);\n                    goto err;\n                }\n            }\n        while (BN_is_zero(k));\n        if (!BN_add(r, k, order)\n            || !BN_add(X, r, order)\n            || !BN_copy(k, BN_num_bits(r) > order_bits ? r : X))\n            goto err;\n        if (!EC_POINT_mul(group, tmp_point, k, NULL, NULL, ctx)) {\n            ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_EC_LIB);\n            goto err;\n        }\n        if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) ==\n            NID_X9_62_prime_field) {\n            if (!EC_POINT_get_affine_coordinates_GFp\n                (group, tmp_point, X, NULL, ctx)) {\n                ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_EC_LIB);\n                goto err;\n            }\n        }\n#ifndef OPENSSL_NO_EC2M\n        else {\n            if (!EC_POINT_get_affine_coordinates_GF2m(group,\n                                                      tmp_point, X, NULL,\n                                                      ctx)) {\n                ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_EC_LIB);\n                goto err;\n            }\n        }\n#endif\n        if (!BN_nnmod(r, X, order, ctx)) {\n            ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_BN_LIB);\n            goto err;\n        }\n    }\n    while (BN_is_zero(r));\n    if (EC_GROUP_do_inverse_ord(group, k, k, ctx) == 0) {\n        if (group->mont_data != NULL) {\n            if (!BN_set_word(X, 2)) {\n                ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_BN_LIB);\n                goto err;\n            }\n            if (!BN_mod_sub(X, order, X, order, ctx)) {\n                ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_BN_LIB);\n                goto err;\n            }\n            BN_set_flags(X, BN_FLG_CONSTTIME);\n            if (!BN_mod_exp_mont_consttime(k, k, X, order, ctx,\n                                           group->mont_data)) {\n                ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_BN_LIB);\n                goto err;\n            }\n        } else {\n            if (!BN_mod_inverse(k, k, order, ctx)) {\n                ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_BN_LIB);\n                goto err;\n            }\n        }\n    }\n    BN_clear_free(*rp);\n    BN_clear_free(*kinvp);\n    *rp = r;\n    *kinvp = k;\n    ret = 1;\n err:\n    if (!ret) {\n        BN_clear_free(k);\n        BN_clear_free(r);\n    }\n    if (ctx != ctx_in)\n        BN_CTX_free(ctx);\n    EC_POINT_free(tmp_point);\n    BN_clear_free(X);\n    return ret;\n}', 'int BN_priv_rand_range(BIGNUM *r, const BIGNUM *range)\n{\n    return bnrand_range(PRIVATE, r, range);\n}', 'static int bnrand_range(BNRAND_FLAG flag, BIGNUM *r, const BIGNUM *range)\n{\n    int n;\n    int count = 100;\n    if (range->neg || BN_is_zero(range)) {\n        BNerr(BN_F_BNRAND_RANGE, BN_R_INVALID_RANGE);\n        return 0;\n    }\n    n = BN_num_bits(range);\n    if (n == 1)\n        BN_zero(r);\n    else if (!BN_is_bit_set(range, n - 2) && !BN_is_bit_set(range, n - 3)) {\n        do {\n            if (!bnrand(flag, r, n + 1, BN_RAND_TOP_ANY, BN_RAND_BOTTOM_ANY))\n                return 0;\n            if (BN_cmp(r, range) >= 0) {\n                if (!BN_sub(r, r, range))\n                    return 0;\n                if (BN_cmp(r, range) >= 0)\n                    if (!BN_sub(r, r, range))\n                        return 0;\n            }\n            if (!--count) {\n                BNerr(BN_F_BNRAND_RANGE, BN_R_TOO_MANY_ITERATIONS);\n                return 0;\n            }\n        }\n        while (BN_cmp(r, range) >= 0);\n    } else {\n        do {\n            if (!bnrand(flag, r, n, BN_RAND_TOP_ANY, BN_RAND_BOTTOM_ANY))\n                return 0;\n            if (!--count) {\n                BNerr(BN_F_BNRAND_RANGE, BN_R_TOO_MANY_ITERATIONS);\n                return 0;\n            }\n        }\n        while (BN_cmp(r, range) >= 0);\n    }\n    bn_check_top(r);\n    return 1;\n}', 'int BN_add(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)\n{\n    int ret, r_neg, cmp_res;\n    bn_check_top(a);\n    bn_check_top(b);\n    if (a->neg == b->neg) {\n        r_neg = a->neg;\n        ret = BN_uadd(r, a, b);\n    } else {\n        cmp_res = BN_ucmp(a, b);\n        if (cmp_res > 0) {\n            r_neg = a->neg;\n            ret = BN_usub(r, a, b);\n        } else if (cmp_res < 0) {\n            r_neg = b->neg;\n            ret = BN_usub(r, b, a);\n        } else {\n            r_neg = 0;\n            BN_zero(r);\n            ret = 1;\n        }\n    }\n    r->neg = r_neg;\n    bn_check_top(r);\n    return ret;\n}', 'int EC_POINT_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *g_scalar,\n                 const EC_POINT *point, const BIGNUM *p_scalar, BN_CTX *ctx)\n{\n    const EC_POINT *points[1];\n    const BIGNUM *scalars[1];\n    points[0] = point;\n    scalars[0] = p_scalar;\n    return EC_POINTs_mul(group, r, g_scalar,\n                         (point != NULL\n                          && p_scalar != NULL), points, scalars, ctx);\n}', 'int EC_POINTs_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,\n                  size_t num, const EC_POINT *points[],\n                  const BIGNUM *scalars[], BN_CTX *ctx)\n{\n    if (group->meth->mul == 0)\n        return ec_wNAF_mul(group, r, scalar, num, points, scalars, ctx);\n    return group->meth->mul(group, r, scalar, num, points, scalars, ctx);\n}', 'int ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,\n                size_t num, const EC_POINT *points[], const BIGNUM *scalars[],\n                BN_CTX *ctx)\n{\n    BN_CTX *new_ctx = NULL;\n    const EC_POINT *generator = NULL;\n    EC_POINT *tmp = NULL;\n    size_t totalnum;\n    size_t blocksize = 0, numblocks = 0;\n    size_t pre_points_per_block = 0;\n    size_t i, j;\n    int k;\n    int r_is_inverted = 0;\n    int r_is_at_infinity = 1;\n    size_t *wsize = NULL;\n    signed char **wNAF = NULL;\n    size_t *wNAF_len = NULL;\n    size_t max_len = 0;\n    size_t num_val;\n    EC_POINT **val = NULL;\n    EC_POINT **v;\n    EC_POINT ***val_sub = NULL;\n    const EC_PRE_COMP *pre_comp = NULL;\n    int num_scalar = 0;\n    int ret = 0;\n    if ((scalar != NULL) && (num == 0)) {\n        return ec_mul_consttime(group, r, scalar, NULL, ctx);\n    }\n    if ((scalar == NULL) && (num == 1)) {\n        return ec_mul_consttime(group, r, scalars[0], points[0], ctx);\n    }\n    if (group->meth != r->meth) {\n        ECerr(EC_F_EC_WNAF_MUL, EC_R_INCOMPATIBLE_OBJECTS);\n        return 0;\n    }\n    if ((scalar == NULL) && (num == 0)) {\n        return EC_POINT_set_to_infinity(group, r);\n    }\n    for (i = 0; i < num; i++) {\n        if (group->meth != points[i]->meth) {\n            ECerr(EC_F_EC_WNAF_MUL, EC_R_INCOMPATIBLE_OBJECTS);\n            return 0;\n        }\n    }\n    if (ctx == NULL) {\n        ctx = new_ctx = BN_CTX_new();\n        if (ctx == NULL)\n            goto err;\n    }\n    if (scalar != NULL) {\n        generator = EC_GROUP_get0_generator(group);\n        if (generator == NULL) {\n            ECerr(EC_F_EC_WNAF_MUL, EC_R_UNDEFINED_GENERATOR);\n            goto err;\n        }\n        pre_comp = group->pre_comp.ec;\n        if (pre_comp && pre_comp->numblocks\n            && (EC_POINT_cmp(group, generator, pre_comp->points[0], ctx) ==\n                0)) {\n            blocksize = pre_comp->blocksize;\n            numblocks = (BN_num_bits(scalar) / blocksize) + 1;\n            if (numblocks > pre_comp->numblocks)\n                numblocks = pre_comp->numblocks;\n            pre_points_per_block = (size_t)1 << (pre_comp->w - 1);\n            if (pre_comp->num != (pre_comp->numblocks * pre_points_per_block)) {\n                ECerr(EC_F_EC_WNAF_MUL, ERR_R_INTERNAL_ERROR);\n                goto err;\n            }\n        } else {\n            pre_comp = NULL;\n            numblocks = 1;\n            num_scalar = 1;\n        }\n    }\n    totalnum = num + numblocks;\n    wsize = OPENSSL_malloc(totalnum * sizeof(wsize[0]));\n    wNAF_len = OPENSSL_malloc(totalnum * sizeof(wNAF_len[0]));\n    wNAF = OPENSSL_malloc((totalnum + 1) * sizeof(wNAF[0]));\n    val_sub = OPENSSL_malloc(totalnum * sizeof(val_sub[0]));\n    if (wNAF != NULL)\n        wNAF[0] = NULL;\n    if (wsize == NULL || wNAF_len == NULL || wNAF == NULL || val_sub == NULL) {\n        ECerr(EC_F_EC_WNAF_MUL, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    num_val = 0;\n    for (i = 0; i < num + num_scalar; i++) {\n        size_t bits;\n        bits = i < num ? BN_num_bits(scalars[i]) : BN_num_bits(scalar);\n        wsize[i] = EC_window_bits_for_scalar_size(bits);\n        num_val += (size_t)1 << (wsize[i] - 1);\n        wNAF[i + 1] = NULL;\n        wNAF[i] =\n            bn_compute_wNAF((i < num ? scalars[i] : scalar), wsize[i],\n                            &wNAF_len[i]);\n        if (wNAF[i] == NULL)\n            goto err;\n        if (wNAF_len[i] > max_len)\n            max_len = wNAF_len[i];\n    }\n    if (numblocks) {\n        if (pre_comp == NULL) {\n            if (num_scalar != 1) {\n                ECerr(EC_F_EC_WNAF_MUL, ERR_R_INTERNAL_ERROR);\n                goto err;\n            }\n        } else {\n            signed char *tmp_wNAF = NULL;\n            size_t tmp_len = 0;\n            if (num_scalar != 0) {\n                ECerr(EC_F_EC_WNAF_MUL, ERR_R_INTERNAL_ERROR);\n                goto err;\n            }\n            wsize[num] = pre_comp->w;\n            tmp_wNAF = bn_compute_wNAF(scalar, wsize[num], &tmp_len);\n            if (!tmp_wNAF)\n                goto err;\n            if (tmp_len <= max_len) {\n                numblocks = 1;\n                totalnum = num + 1;\n                wNAF[num] = tmp_wNAF;\n                wNAF[num + 1] = NULL;\n                wNAF_len[num] = tmp_len;\n                val_sub[num] = pre_comp->points;\n            } else {\n                signed char *pp;\n                EC_POINT **tmp_points;\n                if (tmp_len < numblocks * blocksize) {\n                    numblocks = (tmp_len + blocksize - 1) / blocksize;\n                    if (numblocks > pre_comp->numblocks) {\n                        ECerr(EC_F_EC_WNAF_MUL, ERR_R_INTERNAL_ERROR);\n                        OPENSSL_free(tmp_wNAF);\n                        goto err;\n                    }\n                    totalnum = num + numblocks;\n                }\n                pp = tmp_wNAF;\n                tmp_points = pre_comp->points;\n                for (i = num; i < totalnum; i++) {\n                    if (i < totalnum - 1) {\n                        wNAF_len[i] = blocksize;\n                        if (tmp_len < blocksize) {\n                            ECerr(EC_F_EC_WNAF_MUL, ERR_R_INTERNAL_ERROR);\n                            OPENSSL_free(tmp_wNAF);\n                            goto err;\n                        }\n                        tmp_len -= blocksize;\n                    } else\n                        wNAF_len[i] = tmp_len;\n                    wNAF[i + 1] = NULL;\n                    wNAF[i] = OPENSSL_malloc(wNAF_len[i]);\n                    if (wNAF[i] == NULL) {\n                        ECerr(EC_F_EC_WNAF_MUL, ERR_R_MALLOC_FAILURE);\n                        OPENSSL_free(tmp_wNAF);\n                        goto err;\n                    }\n                    memcpy(wNAF[i], pp, wNAF_len[i]);\n                    if (wNAF_len[i] > max_len)\n                        max_len = wNAF_len[i];\n                    if (*tmp_points == NULL) {\n                        ECerr(EC_F_EC_WNAF_MUL, ERR_R_INTERNAL_ERROR);\n                        OPENSSL_free(tmp_wNAF);\n                        goto err;\n                    }\n                    val_sub[i] = tmp_points;\n                    tmp_points += pre_points_per_block;\n                    pp += blocksize;\n                }\n                OPENSSL_free(tmp_wNAF);\n            }\n        }\n    }\n    val = OPENSSL_malloc((num_val + 1) * sizeof(val[0]));\n    if (val == NULL) {\n        ECerr(EC_F_EC_WNAF_MUL, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    val[num_val] = NULL;\n    v = val;\n    for (i = 0; i < num + num_scalar; i++) {\n        val_sub[i] = v;\n        for (j = 0; j < ((size_t)1 << (wsize[i] - 1)); j++) {\n            *v = EC_POINT_new(group);\n            if (*v == NULL)\n                goto err;\n            v++;\n        }\n    }\n    if (!(v == val + num_val)) {\n        ECerr(EC_F_EC_WNAF_MUL, ERR_R_INTERNAL_ERROR);\n        goto err;\n    }\n    if ((tmp = EC_POINT_new(group)) == NULL)\n        goto err;\n    for (i = 0; i < num + num_scalar; i++) {\n        if (i < num) {\n            if (!EC_POINT_copy(val_sub[i][0], points[i]))\n                goto err;\n        } else {\n            if (!EC_POINT_copy(val_sub[i][0], generator))\n                goto err;\n        }\n        if (wsize[i] > 1) {\n            if (!EC_POINT_dbl(group, tmp, val_sub[i][0], ctx))\n                goto err;\n            for (j = 1; j < ((size_t)1 << (wsize[i] - 1)); j++) {\n                if (!EC_POINT_add\n                    (group, val_sub[i][j], val_sub[i][j - 1], tmp, ctx))\n                    goto err;\n            }\n        }\n    }\n    if (!EC_POINTs_make_affine(group, num_val, val, ctx))\n        goto err;\n    r_is_at_infinity = 1;\n    for (k = max_len - 1; k >= 0; k--) {\n        if (!r_is_at_infinity) {\n            if (!EC_POINT_dbl(group, r, r, ctx))\n                goto err;\n        }\n        for (i = 0; i < totalnum; i++) {\n            if (wNAF_len[i] > (size_t)k) {\n                int digit = wNAF[i][k];\n                int is_neg;\n                if (digit) {\n                    is_neg = digit < 0;\n                    if (is_neg)\n                        digit = -digit;\n                    if (is_neg != r_is_inverted) {\n                        if (!r_is_at_infinity) {\n                            if (!EC_POINT_invert(group, r, ctx))\n                                goto err;\n                        }\n                        r_is_inverted = !r_is_inverted;\n                    }\n                    if (r_is_at_infinity) {\n                        if (!EC_POINT_copy(r, val_sub[i][digit >> 1]))\n                            goto err;\n                        r_is_at_infinity = 0;\n                    } else {\n                        if (!EC_POINT_add\n                            (group, r, r, val_sub[i][digit >> 1], ctx))\n                            goto err;\n                    }\n                }\n            }\n        }\n    }\n    if (r_is_at_infinity) {\n        if (!EC_POINT_set_to_infinity(group, r))\n            goto err;\n    } else {\n        if (r_is_inverted)\n            if (!EC_POINT_invert(group, r, ctx))\n                goto err;\n    }\n    ret = 1;\n err:\n    BN_CTX_free(new_ctx);\n    EC_POINT_free(tmp);\n    OPENSSL_free(wsize);\n    OPENSSL_free(wNAF_len);\n    if (wNAF != NULL) {\n        signed char **w;\n        for (w = wNAF; *w != NULL; w++)\n            OPENSSL_free(*w);\n        OPENSSL_free(wNAF);\n    }\n    if (val != NULL) {\n        for (v = val; *v != NULL; v++)\n            EC_POINT_clear_free(*v);\n        OPENSSL_free(val);\n    }\n    OPENSSL_free(val_sub);\n    return ret;\n}', 'static int ec_mul_consttime(const EC_GROUP *group, EC_POINT *r,\n                            const BIGNUM *scalar, const EC_POINT *point,\n                            BN_CTX *ctx)\n{\n    int i, order_bits, group_top, kbit, pbit, Z_is_one;\n    EC_POINT *s = NULL;\n    BIGNUM *k = NULL;\n    BIGNUM *lambda = NULL;\n    BN_CTX *new_ctx = NULL;\n    int ret = 0;\n    if (ctx == NULL && (ctx = new_ctx = BN_CTX_secure_new()) == NULL)\n        goto err;\n    if ((group->order == NULL) || (group->field == NULL))\n        goto err;\n    order_bits = BN_num_bits(group->order);\n    s = EC_POINT_new(group);\n    if (s == NULL)\n        goto err;\n    if (point == NULL) {\n        if (group->generator == NULL)\n            goto err;\n        if (!EC_POINT_copy(s, group->generator))\n            goto err;\n    } else {\n        if (!EC_POINT_copy(s, point))\n            goto err;\n    }\n    EC_POINT_BN_set_flags(s, BN_FLG_CONSTTIME);\n    BN_CTX_start(ctx);\n    lambda = BN_CTX_get(ctx);\n    k = BN_CTX_get(ctx);\n    if (k == NULL)\n        goto err;\n    group_top = bn_get_top(group->order);\n    if ((bn_wexpand(k, group_top + 1) == NULL)\n        || (bn_wexpand(lambda, group_top + 1) == NULL))\n        goto err;\n    if (!BN_copy(k, scalar))\n        goto err;\n    BN_set_flags(k, BN_FLG_CONSTTIME);\n    if ((BN_num_bits(k) > order_bits) || (BN_is_negative(k))) {\n        if (!BN_nnmod(k, k, group->order, ctx))\n            goto err;\n    }\n    if (!BN_add(lambda, k, group->order))\n        goto err;\n    BN_set_flags(lambda, BN_FLG_CONSTTIME);\n    if (!BN_add(k, lambda, group->order))\n        goto err;\n    kbit = BN_is_bit_set(lambda, order_bits);\n    BN_consttime_swap(kbit, k, lambda, group_top + 1);\n    group_top = bn_get_top(group->field);\n    if ((bn_wexpand(s->X, group_top) == NULL)\n        || (bn_wexpand(s->Y, group_top) == NULL)\n        || (bn_wexpand(s->Z, group_top) == NULL)\n        || (bn_wexpand(r->X, group_top) == NULL)\n        || (bn_wexpand(r->Y, group_top) == NULL)\n        || (bn_wexpand(r->Z, group_top) == NULL))\n        goto err;\n    if (!EC_POINT_copy(r, s))\n        goto err;\n    EC_POINT_BN_set_flags(r, BN_FLG_CONSTTIME);\n    if (!EC_POINT_dbl(group, s, s, ctx))\n        goto err;\n    pbit = 0;\n#define EC_POINT_CSWAP(c, a, b, w, t) do {         \\\n        BN_consttime_swap(c, (a)->X, (b)->X, w);   \\\n        BN_consttime_swap(c, (a)->Y, (b)->Y, w);   \\\n        BN_consttime_swap(c, (a)->Z, (b)->Z, w);   \\\n        t = ((a)->Z_is_one ^ (b)->Z_is_one) & (c); \\\n        (a)->Z_is_one ^= (t);                      \\\n        (b)->Z_is_one ^= (t);                      \\\n} while(0)\n    for (i = order_bits - 1; i >= 0; i--) {\n        kbit = BN_is_bit_set(k, i) ^ pbit;\n        EC_POINT_CSWAP(kbit, r, s, group_top, Z_is_one);\n        if (!EC_POINT_add(group, s, r, s, ctx))\n            goto err;\n        if (!EC_POINT_dbl(group, r, r, ctx))\n            goto err;\n        pbit ^= kbit;\n    }\n    EC_POINT_CSWAP(pbit, r, s, group_top, Z_is_one);\n#undef EC_POINT_CSWAP\n    ret = 1;\n err:\n    EC_POINT_free(s);\n    BN_CTX_end(ctx);\n    BN_CTX_free(new_ctx);\n    return ret;\n}', 'BIGNUM *BN_CTX_get(BN_CTX *ctx)\n{\n    BIGNUM *ret;\n    CTXDBG_ENTRY("BN_CTX_get", ctx);\n    if (ctx->err_stack || ctx->too_many)\n        return NULL;\n    if ((ret = BN_POOL_get(&ctx->pool, ctx->flags)) == NULL) {\n        ctx->too_many = 1;\n        BNerr(BN_F_BN_CTX_GET, BN_R_TOO_MANY_TEMPORARY_VARIABLES);\n        return NULL;\n    }\n    BN_zero(ret);\n    ctx->used++;\n    CTXDBG_RET(ctx, ret);\n    return ret;\n}', 'int BN_set_word(BIGNUM *a, BN_ULONG w)\n{\n    bn_check_top(a);\n    if (bn_expand(a, (int)sizeof(BN_ULONG) * 8) == NULL)\n        return 0;\n    a->neg = 0;\n    a->d[0] = w;\n    a->top = (w ? 1 : 0);\n    bn_check_top(a);\n    return 1;\n}', 'static ossl_inline BIGNUM *bn_expand(BIGNUM *a, int bits)\n{\n    if (bits > (INT_MAX - BN_BITS2 + 1))\n        return NULL;\n    if (((bits+BN_BITS2-1)/BN_BITS2) <= (a)->dmax)\n        return a;\n    return bn_expand2((a),(bits+BN_BITS2-1)/BN_BITS2);\n}', 'void BN_consttime_swap(BN_ULONG condition, BIGNUM *a, BIGNUM *b, int nwords)\n{\n    BN_ULONG t;\n    int i;\n    bn_wcheck_size(a, nwords);\n    bn_wcheck_size(b, nwords);\n    assert(a != b);\n    assert((condition & (condition - 1)) == 0);\n    assert(sizeof(BN_ULONG) >= sizeof(int));\n    condition = ((condition - 1) >> (BN_BITS2 - 1)) - 1;\n    t = (a->top ^ b->top) & condition;\n    a->top ^= t;\n    b->top ^= t;\n    t = (a->neg ^ b->neg) & condition;\n    a->neg ^= t;\n    b->neg ^= t;\n    t = (a->flags ^ b->flags) & condition & BN_FLG_CONSTTIME;\n    a->flags ^= t;\n    b->flags ^= t;\n#define BN_CONSTTIME_SWAP(ind) \\\n        do { \\\n                t = (a->d[ind] ^ b->d[ind]) & condition; \\\n                a->d[ind] ^= t; \\\n                b->d[ind] ^= t; \\\n        } while (0)\n    switch (nwords) {\n    default:\n        for (i = 10; i < nwords; i++)\n            BN_CONSTTIME_SWAP(i);\n    case 10:\n        BN_CONSTTIME_SWAP(9);\n    case 9:\n        BN_CONSTTIME_SWAP(8);\n    case 8:\n        BN_CONSTTIME_SWAP(7);\n    case 7:\n        BN_CONSTTIME_SWAP(6);\n    case 6:\n        BN_CONSTTIME_SWAP(5);\n    case 5:\n        BN_CONSTTIME_SWAP(4);\n    case 4:\n        BN_CONSTTIME_SWAP(3);\n    case 3:\n        BN_CONSTTIME_SWAP(2);\n    case 2:\n        BN_CONSTTIME_SWAP(1);\n    case 1:\n        BN_CONSTTIME_SWAP(0);\n    }\n#undef BN_CONSTTIME_SWAP\n}']