crypto/bn/bn_prime.c:196: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_copy`.
Showing all 13 steps of the trace


crypto/bn/bn_prime.c:153:1: Parameter `a->top`
151.   }
152.   
153. > int BN_is_prime_fasttest_ex(const BIGNUM *a, int checks, BN_CTX *ctx_passed,
154.                               int do_trial_division, BN_GENCB *cb)
155.   {

crypto/bn/bn_prime.c:163:9: Call
161.       const BIGNUM *A = NULL;
162.   
163.       if (BN_cmp(a, BN_value_one()) <= 0)
               ^
164.           return 0;
165.   

crypto/bn/bn_lib.c:577:1: Parameter `a->top`
  575.   }
  576.   
  577. > int BN_cmp(const BIGNUM *a, const BIGNUM *b)
  578.   {
  579.       int i;

crypto/bn/bn_prime.c:170:10: Call
168.   
169.       /* first look for small factors */
170.       if (!BN_is_odd(a))
                ^
171.           /* a is even => a is prime if and only if a == 2 */
172.           return BN_is_word(a, 2);

crypto/bn/bn_lib.c:867:1: Parameter `a->top`
  865.   }
  866.   
  867. > int BN_is_odd(const BIGNUM *a)
  868.   {
  869.       return (a->top > 0) && (a->d[0] & 1);

crypto/bn/bn_prime.c:196:13: Call
194.           if ((t = BN_CTX_get(ctx)) == NULL)
195.               goto err;
196.           if (BN_copy(t, a) == NULL)
                   ^
197.               goto err;
198.           t->neg = 0;

crypto/bn/bn_lib.c:323:1: <Offset trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `b->top`
  321.   }
  322.   
  323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
  324.   {
  325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: <Length trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `*a->d`
  321.   }
  322.   
  323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
  324.   {
  325.       bn_check_top(b);

crypto/bn/bn_lib.c:329:9: Call
  327.       if (a == b)
  328.           return a;
  329.       if (bn_wexpand(a, b->top) == NULL)
                 ^
  330.           return NULL;
  331.   

crypto/bn/bn_lib.c:948:1: Parameter `*a->d`
    946.   }
    947.   
    948. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
    949.   {
    950.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:333:9: Array access: Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_copy` 
  331.   
  332.       if (b->top > 0)
  333.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                 ^
  334.   
  335.       a->top = b->top;

BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
{
    bn_check_top(b);
    if (a == b)
        return a;
    if (bn_wexpand(a, b->top) == NULL)
        return NULL;
    if (b->top > 0)
        memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
    a->top = b->top;
    a->neg = b->neg;
    bn_check_top(a);
    return a;
}
['int BN_is_prime_fasttest_ex(const BIGNUM *a, int checks, BN_CTX *ctx_passed,\n                            int do_trial_division, BN_GENCB *cb)\n{\n    int i, j, ret = -1;\n    int k;\n    BN_CTX *ctx = NULL;\n    BIGNUM *A1, *A1_odd, *check;\n    BN_MONT_CTX *mont = NULL;\n    const BIGNUM *A = NULL;\n    if (BN_cmp(a, BN_value_one()) <= 0)\n        return 0;\n    if (checks == BN_prime_checks)\n        checks = BN_prime_checks_for_size(BN_num_bits(a));\n    if (!BN_is_odd(a))\n        return BN_is_word(a, 2);\n    if (do_trial_division) {\n        for (i = 1; i < NUMPRIMES; i++) {\n            BN_ULONG mod = BN_mod_word(a, primes[i]);\n            if (mod == (BN_ULONG)-1)\n                goto err;\n            if (mod == 0)\n                return 0;\n        }\n        if (!BN_GENCB_call(cb, 1, -1))\n            goto err;\n    }\n    if (ctx_passed != NULL)\n        ctx = ctx_passed;\n    else if ((ctx = BN_CTX_new()) == NULL)\n        goto err;\n    BN_CTX_start(ctx);\n    if (a->neg) {\n        BIGNUM *t;\n        if ((t = BN_CTX_get(ctx)) == NULL)\n            goto err;\n        if (BN_copy(t, a) == NULL)\n            goto err;\n        t->neg = 0;\n        A = t;\n    } else\n        A = a;\n    A1 = BN_CTX_get(ctx);\n    A1_odd = BN_CTX_get(ctx);\n    check = BN_CTX_get(ctx);\n    if (check == NULL)\n        goto err;\n    if (!BN_copy(A1, A))\n        goto err;\n    if (!BN_sub_word(A1, 1))\n        goto err;\n    if (BN_is_zero(A1)) {\n        ret = 0;\n        goto err;\n    }\n    k = 1;\n    while (!BN_is_bit_set(A1, k))\n        k++;\n    if (!BN_rshift(A1_odd, A1, k))\n        goto err;\n    mont = BN_MONT_CTX_new();\n    if (mont == NULL)\n        goto err;\n    if (!BN_MONT_CTX_set(mont, A, ctx))\n        goto err;\n    for (i = 0; i < checks; i++) {\n        if (!BN_pseudo_rand_range(check, A1))\n            goto err;\n        if (!BN_add_word(check, 1))\n            goto err;\n        j = witness(check, A, A1, A1_odd, k, ctx, mont);\n        if (j == -1)\n            goto err;\n        if (j) {\n            ret = 0;\n            goto err;\n        }\n        if (!BN_GENCB_call(cb, 1, i))\n            goto err;\n    }\n    ret = 1;\n err:\n    if (ctx != NULL) {\n        BN_CTX_end(ctx);\n        if (ctx_passed == NULL)\n            BN_CTX_free(ctx);\n    }\n    BN_MONT_CTX_free(mont);\n    return (ret);\n}', 'int BN_cmp(const BIGNUM *a, const BIGNUM *b)\n{\n    int i;\n    int gt, lt;\n    BN_ULONG t1, t2;\n    if ((a == NULL) || (b == NULL)) {\n        if (a != NULL)\n            return (-1);\n        else if (b != NULL)\n            return (1);\n        else\n            return (0);\n    }\n    bn_check_top(a);\n    bn_check_top(b);\n    if (a->neg != b->neg) {\n        if (a->neg)\n            return (-1);\n        else\n            return (1);\n    }\n    if (a->neg == 0) {\n        gt = 1;\n        lt = -1;\n    } else {\n        gt = -1;\n        lt = 1;\n    }\n    if (a->top > b->top)\n        return (gt);\n    if (a->top < b->top)\n        return (lt);\n    for (i = a->top - 1; i >= 0; i--) {\n        t1 = a->d[i];\n        t2 = b->d[i];\n        if (t1 > t2)\n            return (gt);\n        if (t1 < t2)\n            return (lt);\n    }\n    return (0);\n}', 'int BN_is_odd(const BIGNUM *a)\n{\n    return (a->top > 0) && (a->d[0] & 1);\n}', 'BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)\n{\n    bn_check_top(b);\n    if (a == b)\n        return a;\n    if (bn_wexpand(a, b->top) == NULL)\n        return NULL;\n    if (b->top > 0)\n        memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);\n    a->top = b->top;\n    a->neg = b->neg;\n    bn_check_top(a);\n    return a;\n}', 'BIGNUM *bn_wexpand(BIGNUM *a, int words)\n{\n    return (words <= a->dmax) ? a : bn_expand2(a, words);\n}']