crypto/pem/pvkfmt.c:388: error: INTEGER_OVERFLOW_L2
  ([0, `bitlen` + 15] - 1):unsigned32 by call to `read_lebn`.
Showing all 9 steps of the trace


crypto/pem/pvkfmt.c:365:1: Parameter `bitlen`
363.   	}
364.   
365. > static EVP_PKEY *b2i_rsa(const unsigned char **in, unsigned int length,
366.   						unsigned int bitlen, int ispub)
367.   		

crypto/pem/pvkfmt.c:374:2: Assignment
372.   	unsigned int nbyte, hnbyte;
373.   	nbyte = (bitlen + 7) >> 3;
374.   	hnbyte = (bitlen + 15) >> 4;
        ^
375.   	rsa = RSA_new();
376.   	ret = EVP_PKEY_new();

crypto/pem/pvkfmt.c:388:8: Call
386.   	if (!ispub)
387.   		{
388.   		if (!read_lebn(&p, hnbyte, &rsa->p))
              ^
389.   			goto memerr;
390.   		if (!read_lebn(&p, hnbyte, &rsa->q))

crypto/pem/pvkfmt.c:86:1: Parameter `nbyte`
  84.    */
  85.   
  86. > static int read_lebn(const unsigned char **in, unsigned int nbyte, BIGNUM **r)
  87.   	{
  88.   	const unsigned char *p;

crypto/pem/pvkfmt.c:98:7: Call
  96.   	for (i = 0; i < nbyte; i++)
  97.   		*q++ = *p--;
  98.   	*r = BN_bin2bn(tmpbuf, nbyte, NULL);
               ^
  99.   	OPENSSL_free(tmpbuf);
  100.   	if (*r)

crypto/bn/bn_lib.c:597:1: <LHS trace>
595.   	}
596.   
597. > BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)
598.   	{
599.   	unsigned int i,m;

crypto/bn/bn_lib.c:597:1: Parameter `len`
    595.   	}
    596.   
    597. > BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)
    598.   	{
    599.   	unsigned int i,m;

crypto/bn/bn_lib.c:609:2: Assignment
    607.   	bn_check_top(ret);
    608.   	l=0;
    609.   	n=len;
            ^
    610.   	if (n == 0)
    611.   		{

crypto/bn/bn_lib.c:615:2: Binary operation: ([0, bitlen + 15] - 1):unsigned32 by call to `read_lebn` 
    613.   		return(ret);
    614.   		}
    615.   	i=((n-1)/BN_BYTES)+1;
            ^
    616.   	m=((n-1)%(BN_BYTES));
    617.   	if (bn_wexpand(ret, (int)i) == NULL)

BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)
	{
	unsigned int i,m;
	unsigned int n;
	BN_ULONG l;
	BIGNUM  *bn = NULL;
	if (ret == NULL)
		ret = bn = BN_new();
	if (ret == NULL) return(NULL);
	bn_check_top(ret);
	l=0;
	n=len;
	if (n == 0)
		{
		ret->top=0;
		return(ret);
		}
	i=((n-1)/BN_BYTES)+1;
	m=((n-1)%(BN_BYTES));
	if (bn_wexpand(ret, (int)i) == NULL)
		{
		if (bn) BN_free(bn);
		return NULL;
		}
	ret->top=i;
	ret->neg=0;
	while (n--)
		{
		l=(l<<8L)| *(s++);
		if (m-- == 0)
			{
			ret->d[--i]=l;
			l=0;
			m=BN_BYTES-1;
			}
		}
	bn_correct_top(ret);
	return(ret);
	}
['static EVP_PKEY *b2i_rsa(const unsigned char **in, unsigned int length,\n\t\t\t\t\t\tunsigned int bitlen, int ispub)\n\t{\n\tconst unsigned char *p = *in;\n\tEVP_PKEY *ret = NULL;\n\tRSA *rsa = NULL;\n\tunsigned int nbyte, hnbyte;\n\tnbyte = (bitlen + 7) >> 3;\n\thnbyte = (bitlen + 15) >> 4;\n\trsa = RSA_new();\n\tret = EVP_PKEY_new();\n\tif (!rsa || !ret)\n\t\tgoto memerr;\n\trsa->e = BN_new();\n\tif (!rsa->e)\n\t\tgoto memerr;\n\tif (!BN_set_word(rsa->e, read_ledword(&p)))\n\t\tgoto memerr;\n\tif (!read_lebn(&p, nbyte, &rsa->n))\n\t\tgoto memerr;\n\tif (!ispub)\n\t\t{\n\t\tif (!read_lebn(&p, hnbyte, &rsa->p))\n\t\t\tgoto memerr;\n\t\tif (!read_lebn(&p, hnbyte, &rsa->q))\n\t\t\tgoto memerr;\n\t\tif (!read_lebn(&p, hnbyte, &rsa->dmp1))\n\t\t\tgoto memerr;\n\t\tif (!read_lebn(&p, hnbyte, &rsa->dmq1))\n\t\t\tgoto memerr;\n\t\tif (!read_lebn(&p, hnbyte, &rsa->iqmp))\n\t\t\tgoto memerr;\n\t\tif (!read_lebn(&p, nbyte, &rsa->d))\n\t\t\tgoto memerr;\n\t\t}\n\tEVP_PKEY_set1_RSA(ret, rsa);\n\tRSA_free(rsa);\n\t*in = p;\n\treturn ret;\n\tmemerr:\n\tPEMerr(PEM_F_B2I_RSA, ERR_R_MALLOC_FAILURE);\n\tif (rsa)\n\t\tRSA_free(rsa);\n\tif (ret)\n\t\tEVP_PKEY_free(ret);\n\treturn NULL;\n\t}', 'static int read_lebn(const unsigned char **in, unsigned int nbyte, BIGNUM **r)\n\t{\n\tconst unsigned char *p;\n\tunsigned char *tmpbuf, *q;\n\tunsigned int i;\n\tp = *in + nbyte - 1;\n\ttmpbuf = OPENSSL_malloc(nbyte);\n\tif (!tmpbuf)\n\t\treturn 0;\n\tq = tmpbuf;\n\tfor (i = 0; i < nbyte; i++)\n\t\t*q++ = *p--;\n\t*r = BN_bin2bn(tmpbuf, nbyte, NULL);\n\tOPENSSL_free(tmpbuf);\n\tif (*r)\n\t\t{\n\t\t*in += nbyte;\n\t\treturn 1;\n\t\t}\n\telse\n\t\treturn 0;\n\t}', 'BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)\n\t{\n\tunsigned int i,m;\n\tunsigned int n;\n\tBN_ULONG l;\n\tBIGNUM  *bn = NULL;\n\tif (ret == NULL)\n\t\tret = bn = BN_new();\n\tif (ret == NULL) return(NULL);\n\tbn_check_top(ret);\n\tl=0;\n\tn=len;\n\tif (n == 0)\n\t\t{\n\t\tret->top=0;\n\t\treturn(ret);\n\t\t}\n\ti=((n-1)/BN_BYTES)+1;\n\tm=((n-1)%(BN_BYTES));\n\tif (bn_wexpand(ret, (int)i) == NULL)\n\t\t{\n\t\tif (bn) BN_free(bn);\n\t\treturn NULL;\n\t\t}\n\tret->top=i;\n\tret->neg=0;\n\twhile (n--)\n\t\t{\n\t\tl=(l<<8L)| *(s++);\n\t\tif (m-- == 0)\n\t\t\t{\n\t\t\tret->d[--i]=l;\n\t\t\tl=0;\n\t\t\tm=BN_BYTES-1;\n\t\t\t}\n\t\t}\n\tbn_correct_top(ret);\n\treturn(ret);\n\t}']