apps/s_server.c:269: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 67108856] by call to `SSL_set_srp_server_param`.
Showing all 12 steps of the trace


apps/s_server.c:269:9: Call
267.       }
268.   
269.       if (SSL_set_srp_server_param
               ^
270.           (s, p->user->N, p->user->g, p->user->s, p->user->v,
271.            p->user->info) < 0) {

ssl/tls_srp.c:196:1: Parameter `N->top`
  194.   }
  195.   
  196. > int SSL_set_srp_server_param(SSL *s, const BIGNUM *N, const BIGNUM *g,
  197.                                BIGNUM *sa, BIGNUM *v, char *info)
  198.   {

ssl/tls_srp.c:206:28: Call
  204.               }
  205.           } else
  206.               s->srp_ctx.N = BN_dup(N);
                                    ^
  207.       }
  208.       if (g != NULL) {

crypto/bn/bn_lib.c:261:1: Parameter `a->top`
    259.   }
    260.   
    261. > BIGNUM *BN_dup(const BIGNUM *a)
    262.   {
    263.       BIGNUM *t;

crypto/bn/bn_lib.c:272:10: Call
    270.       if (t == NULL)
    271.           return NULL;
    272.       if (!BN_copy(t, a)) {
                    ^
    273.           BN_free(t);
    274.           return NULL;

crypto/bn/bn_lib.c:280:1: <Offset trace>
278.   }
279.   
280. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
281.   {
282.       bn_check_top(b);

crypto/bn/bn_lib.c:280:1: Parameter `b->top`
      278.   }
      279.   
      280. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      281.   {
      282.       bn_check_top(b);

crypto/bn/bn_lib.c:280:1: <Length trace>
278.   }
279.   
280. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
281.   {
282.       bn_check_top(b);

crypto/bn/bn_lib.c:280:1: Parameter `*a->d`
      278.   }
      279.   
      280. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      281.   {
      282.       bn_check_top(b);

crypto/bn/bn_lib.c:286:9: Call
      284.       if (a == b)
      285.           return a;
      286.       if (bn_wexpand(a, b->top) == NULL)
                     ^
      287.           return NULL;
      288.   

crypto/bn/bn_lib.c:942:1: Parameter `*a->d`
        940.   }
        941.   
        942. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
        943.   {
        944.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:290:9: Array access: Offset added: [8, +oo] Size: [0, 67108856] by call to `SSL_set_srp_server_param` 
      288.   
      289.       if (b->top > 0)
      290.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                     ^
      291.   
      292.       a->neg = b->neg;

BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
{
    bn_check_top(b);
    if (a == b)
        return a;
    if (bn_wexpand(a, b->top) == NULL)
        return NULL;
    if (b->top > 0)
        memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
    a->neg = b->neg;
    a->top = b->top;
    a->flags |= b->flags & BN_FLG_FIXED_TOP;
    bn_check_top(a);
    return a;
}
['static int ssl_srp_server_param_cb(SSL *s, int *ad, void *arg)\n{\n    srpsrvparm *p = (srpsrvparm *) arg;\n    int ret = SSL3_AL_FATAL;\n    if (p->login == NULL && p->user == NULL) {\n        p->login = SSL_get_srp_username(s);\n        BIO_printf(bio_err, "SRP username = \\"%s\\"\\n", p->login);\n        return -1;\n    }\n    if (p->user == NULL) {\n        BIO_printf(bio_err, "User %s doesn\'t exist\\n", p->login);\n        goto err;\n    }\n    if (SSL_set_srp_server_param\n        (s, p->user->N, p->user->g, p->user->s, p->user->v,\n         p->user->info) < 0) {\n        *ad = SSL_AD_INTERNAL_ERROR;\n        goto err;\n    }\n    BIO_printf(bio_err,\n               "SRP parameters set: username = \\"%s\\" info=\\"%s\\" \\n",\n               p->login, p->user->info);\n    ret = SSL_ERROR_NONE;\n err:\n    SRP_user_pwd_free(p->user);\n    p->user = NULL;\n    p->login = NULL;\n    return ret;\n}', 'int SSL_set_srp_server_param(SSL *s, const BIGNUM *N, const BIGNUM *g,\n                             BIGNUM *sa, BIGNUM *v, char *info)\n{\n    if (N != NULL) {\n        if (s->srp_ctx.N != NULL) {\n            if (!BN_copy(s->srp_ctx.N, N)) {\n                BN_free(s->srp_ctx.N);\n                s->srp_ctx.N = NULL;\n            }\n        } else\n            s->srp_ctx.N = BN_dup(N);\n    }\n    if (g != NULL) {\n        if (s->srp_ctx.g != NULL) {\n            if (!BN_copy(s->srp_ctx.g, g)) {\n                BN_free(s->srp_ctx.g);\n                s->srp_ctx.g = NULL;\n            }\n        } else\n            s->srp_ctx.g = BN_dup(g);\n    }\n    if (sa != NULL) {\n        if (s->srp_ctx.s != NULL) {\n            if (!BN_copy(s->srp_ctx.s, sa)) {\n                BN_free(s->srp_ctx.s);\n                s->srp_ctx.s = NULL;\n            }\n        } else\n            s->srp_ctx.s = BN_dup(sa);\n    }\n    if (v != NULL) {\n        if (s->srp_ctx.v != NULL) {\n            if (!BN_copy(s->srp_ctx.v, v)) {\n                BN_free(s->srp_ctx.v);\n                s->srp_ctx.v = NULL;\n            }\n        } else\n            s->srp_ctx.v = BN_dup(v);\n    }\n    if (info != NULL) {\n        if (s->srp_ctx.info)\n            OPENSSL_free(s->srp_ctx.info);\n        if ((s->srp_ctx.info = BUF_strdup(info)) == NULL)\n            return -1;\n    }\n    if (!(s->srp_ctx.N) ||\n        !(s->srp_ctx.g) || !(s->srp_ctx.s) || !(s->srp_ctx.v))\n        return -1;\n    return 1;\n}', 'BIGNUM *BN_dup(const BIGNUM *a)\n{\n    BIGNUM *t;\n    if (a == NULL)\n        return NULL;\n    bn_check_top(a);\n    t = BN_get_flags(a, BN_FLG_SECURE) ? BN_secure_new() : BN_new();\n    if (t == NULL)\n        return NULL;\n    if (!BN_copy(t, a)) {\n        BN_free(t);\n        return NULL;\n    }\n    bn_check_top(t);\n    return t;\n}', 'BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)\n{\n    bn_check_top(b);\n    if (a == b)\n        return a;\n    if (bn_wexpand(a, b->top) == NULL)\n        return NULL;\n    if (b->top > 0)\n        memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);\n    a->neg = b->neg;\n    a->top = b->top;\n    a->flags |= b->flags & BN_FLG_FIXED_TOP;\n    bn_check_top(a);\n    return a;\n}', 'BIGNUM *bn_wexpand(BIGNUM *a, int words)\n{\n    return (words <= a->dmax) ? a : bn_expand2(a, words);\n}']