ssl/statem/statem_srvr.c:2374: error: BUFFER_OVERRUN_L3
  Offset: [16, +oo] (⇐ 1 + [15, +oo]) Size: [0, 8388607] by call to `srp_generate_server_master_secret`.
Showing all 27 steps of the trace


ssl/statem/statem_srvr.c:2356:29: Call
2354.               goto f_err;
2355.           }
2356.           if ((s->srp_ctx.A = BN_bin2bn(data, i, NULL)) == NULL) {
                                    ^
2357.               SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, ERR_R_BN_LIB);
2358.               goto err;

crypto/bn/bn_lib.c:492:9: Assignment
  490.       n = len;
  491.       if (n == 0) {
  492.           ret->top = 0;
                 ^
  493.           return (ret);
  494.       }

ssl/statem/statem_srvr.c:2374:14: Call
2372.           }
2373.   
2374.           if (!srp_generate_server_master_secret(s)) {
                     ^
2375.               SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
2376.               goto err;

ssl/tls_srp.c:284:1: Parameter `s->srp_ctx.A->top`
  282.   }
  283.   
  284. > int srp_generate_server_master_secret(SSL *s)
  285.   {
  286.       BIGNUM *K = NULL, *u = NULL;

ssl/tls_srp.c:290:10: Call
  288.       unsigned char *tmp = NULL;
  289.   
  290.       if (!SRP_Verify_A_mod_N(s->srp_ctx.A, s->srp_ctx.N))
                  ^
  291.           goto err;
  292.       if ((u = SRP_Calc_u(s->srp_ctx.A, s->srp_ctx.B, s->srp_ctx.N)) == NULL)

crypto/srp/srp_lib.c:273:1: Parameter `A->top`
    271.   }
    272.   
    273. > int SRP_Verify_A_mod_N(BIGNUM *A, BIGNUM *N)
    274.   {
    275.       /* Checks if A % N == 0 */

crypto/srp/srp_lib.c:276:12: Call
    274.   {
    275.       /* Checks if A % N == 0 */
    276.       return SRP_Verify_B_mod_N(A, N);
                      ^
    277.   }
    278.   

crypto/srp/srp_lib.c:252:1: Parameter `B->top`
      250.   }
      251.   
      252. > int SRP_Verify_B_mod_N(BIGNUM *B, BIGNUM *N)
      253.   {
      254.       BIGNUM *r;

ssl/tls_srp.c:292:14: Call
  290.       if (!SRP_Verify_A_mod_N(s->srp_ctx.A, s->srp_ctx.N))
  291.           goto err;
  292.       if ((u = SRP_Calc_u(s->srp_ctx.A, s->srp_ctx.B, s->srp_ctx.N)) == NULL)
                      ^
  293.           goto err;
  294.       if ((K = SRP_Calc_server_key(s->srp_ctx.A, s->srp_ctx.v, u, s->srp_ctx.b,

crypto/srp/srp_lib.c:55:1: Parameter `A->top`
    53.   }
    54.   
    55. > BIGNUM *SRP_Calc_u(BIGNUM *A, BIGNUM *B, BIGNUM *N)
    56.   {
    57.       /* k = SHA1(PAD(A) || PAD(B) ) -- tls-srp draft 8 */

ssl/tls_srp.c:294:14: Call
  292.       if ((u = SRP_Calc_u(s->srp_ctx.A, s->srp_ctx.B, s->srp_ctx.N)) == NULL)
  293.           goto err;
  294.       if ((K = SRP_Calc_server_key(s->srp_ctx.A, s->srp_ctx.v, u, s->srp_ctx.b,
                      ^
  295.                                    s->srp_ctx.N)) == NULL)
  296.           goto err;

crypto/srp/srp_lib.c:98:1: Parameter `A->top`
    96.   }
    97.   
    98. > BIGNUM *SRP_Calc_server_key(BIGNUM *A, BIGNUM *v, BIGNUM *u, BIGNUM *b,
    99.                               BIGNUM *N)
    100.   {

crypto/srp/srp_lib.c:114:10: Call
    112.       if (!BN_mod_exp(tmp, v, u, N, bn_ctx))
    113.           goto err;
    114.       if (!BN_mod_mul(tmp, A, tmp, N, bn_ctx))
                    ^
    115.           goto err;
    116.   

crypto/bn/bn_mod.c:73:1: Parameter `a->top`
      71.   
      72.   /* slow but works */
      73. > int BN_mod_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *m,
      74.                  BN_CTX *ctx)
      75.   {

crypto/bn/bn_mod.c:87:14: Call
      85.           goto err;
      86.       if (a == b) {
      87.           if (!BN_sqr(t, a, ctx))
                         ^
      88.               goto err;
      89.       } else {

crypto/bn/bn_sqr.c:17:1: Parameter `a->top`
        15.    * I've just gone over this and it is now %20 faster on x86 - eay - 27 Jun 96
        16.    */
        17. > int BN_sqr(BIGNUM *r, const BIGNUM *a, BN_CTX *ctx)
        18.   {
        19.       int max, al;

crypto/bn/bn_sqr.c:25:5: Assignment
        23.       bn_check_top(a);
        24.   
        25.       al = a->top;
                  ^
        26.       if (al <= 0) {
        27.           r->top = 0;

crypto/bn/bn_sqr.c:74:17: Call
        72.                   if (bn_wexpand(tmp, max) == NULL)
        73.                       goto err;
        74.                   bn_sqr_normal(rr->d, a->d, al, tmp->d);
                              ^
        75.               }
        76.           }

crypto/bn/bn_sqr.c:104:1: <Offset trace>
102.   
103.   /* tmp must have 2*n words */
104. > void bn_sqr_normal(BN_ULONG *r, const BN_ULONG *a, int n, BN_ULONG *tmp)
105.   {
106.       int i, j, max;

crypto/bn/bn_sqr.c:104:1: Parameter `n`
          102.   
          103.   /* tmp must have 2*n words */
          104. > void bn_sqr_normal(BN_ULONG *r, const BN_ULONG *a, int n, BN_ULONG *tmp)
          105.   {
          106.       int i, j, max;

crypto/bn/bn_sqr.c:115:5: Assignment
          113.       rp[0] = rp[max - 1] = 0;
          114.       rp++;
          115.       j = n;
                     ^
          116.   
          117.       if (--j > 0) {

crypto/bn/bn_sqr.c:117:9: Assignment
          115.       j = n;
          116.   
          117.       if (--j > 0) {
                         ^
          118.           ap++;
          119.           rp[j] = bn_mul_words(rp, ap, j, ap[-1]);

crypto/bn/bn_sqr.c:104:1: <Length trace>
102.   
103.   /* tmp must have 2*n words */
104. > void bn_sqr_normal(BN_ULONG *r, const BN_ULONG *a, int n, BN_ULONG *tmp)
105.   {
106.       int i, j, max;

crypto/bn/bn_sqr.c:104:1: Parameter `*r`
          102.   
          103.   /* tmp must have 2*n words */
          104. > void bn_sqr_normal(BN_ULONG *r, const BN_ULONG *a, int n, BN_ULONG *tmp)
          105.   {
          106.       int i, j, max;

crypto/bn/bn_sqr.c:112:5: Assignment
          110.       max = n * 2;
          111.       ap = a;
          112.       rp = r;
                     ^
          113.       rp[0] = rp[max - 1] = 0;
          114.       rp++;

crypto/bn/bn_sqr.c:114:5: Assignment
          112.       rp = r;
          113.       rp[0] = rp[max - 1] = 0;
          114.       rp++;
                     ^
          115.       j = n;
          116.   

crypto/bn/bn_sqr.c:119:9: Array access: Offset: [16, +oo] (⇐ 1 + [15, +oo]) Size: [0, 8388607] by call to `srp_generate_server_master_secret` 
          117.       if (--j > 0) {
          118.           ap++;
          119.           rp[j] = bn_mul_words(rp, ap, j, ap[-1]);
                         ^
          120.           rp += 2;
          121.       }

void bn_sqr_normal(BN_ULONG *r, const BN_ULONG *a, int n, BN_ULONG *tmp)
{
    int i, j, max;
    const BN_ULONG *ap;
    BN_ULONG *rp;
    max = n * 2;
    ap = a;
    rp = r;
    rp[0] = rp[max - 1] = 0;
    rp++;
    j = n;
    if (--j > 0) {
        ap++;
        rp[j] = bn_mul_words(rp, ap, j, ap[-1]);
        rp += 2;
    }
    for (i = n - 2; i > 0; i--) {
        j--;
        ap++;
        rp[j] = bn_mul_add_words(rp, ap, j, ap[-1]);
        rp += 2;
    }
    bn_add_words(r, r, r, max);
    bn_sqr_words(tmp, a, n);
    bn_add_words(r, r, tmp, max);
}
['MSG_PROCESS_RETURN tls_process_client_key_exchange(SSL *s, PACKET *pkt)\n{\n    int al;\n    unsigned long alg_k;\n#ifndef OPENSSL_NO_RSA\n    RSA *rsa = NULL;\n#endif\n#if !defined(OPENSSL_NO_EC) || !defined(OPENSSL_NO_DH)\n    EVP_PKEY *ckey = NULL;\n#endif\n    PACKET enc_premaster;\n    unsigned char *rsa_decrypt = NULL;\n    alg_k = s->s3->tmp.new_cipher->algorithm_mkey;\n#ifndef OPENSSL_NO_PSK\n    if (alg_k & SSL_PSK) {\n        unsigned char psk[PSK_MAX_PSK_LEN];\n        size_t psklen;\n        PACKET psk_identity;\n        if (!PACKET_get_length_prefixed_2(pkt, &psk_identity)) {\n            al = SSL_AD_DECODE_ERROR;\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, SSL_R_LENGTH_MISMATCH);\n            goto f_err;\n        }\n        if (PACKET_remaining(&psk_identity) > PSK_MAX_IDENTITY_LEN) {\n            al = SSL_AD_DECODE_ERROR;\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE,\n                   SSL_R_DATA_LENGTH_TOO_LONG);\n            goto f_err;\n        }\n        if (s->psk_server_callback == NULL) {\n            al = SSL_AD_INTERNAL_ERROR;\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE,\n                   SSL_R_PSK_NO_SERVER_CB);\n            goto f_err;\n        }\n        if (!PACKET_strndup(&psk_identity, &s->session->psk_identity)) {\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);\n            al = SSL_AD_INTERNAL_ERROR;\n            goto f_err;\n        }\n        psklen = s->psk_server_callback(s, s->session->psk_identity,\n                                         psk, sizeof(psk));\n        if (psklen > PSK_MAX_PSK_LEN) {\n            al = SSL_AD_INTERNAL_ERROR;\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);\n            goto f_err;\n        } else if (psklen == 0) {\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE,\n                   SSL_R_PSK_IDENTITY_NOT_FOUND);\n            al = SSL_AD_UNKNOWN_PSK_IDENTITY;\n            goto f_err;\n        }\n        OPENSSL_free(s->s3->tmp.psk);\n        s->s3->tmp.psk = OPENSSL_memdup(psk, psklen);\n        OPENSSL_cleanse(psk, psklen);\n        if (s->s3->tmp.psk == NULL) {\n            al = SSL_AD_INTERNAL_ERROR;\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, ERR_R_MALLOC_FAILURE);\n            goto f_err;\n        }\n        s->s3->tmp.psklen = psklen;\n    }\n    if (alg_k & SSL_kPSK) {\n        if (PACKET_remaining(pkt) != 0) {\n            al = SSL_AD_HANDSHAKE_FAILURE;\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, SSL_R_LENGTH_MISMATCH);\n            goto f_err;\n        }\n        if (!ssl_generate_master_secret(s, NULL, 0, 0)) {\n            al = SSL_AD_INTERNAL_ERROR;\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);\n            goto f_err;\n        }\n    } else\n#endif\n#ifndef OPENSSL_NO_RSA\n    if (alg_k & (SSL_kRSA | SSL_kRSAPSK)) {\n        unsigned char rand_premaster_secret[SSL_MAX_MASTER_KEY_LENGTH];\n        int decrypt_len;\n        unsigned char decrypt_good, version_good;\n        size_t j;\n        rsa = EVP_PKEY_get0_RSA(s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey);\n        if (rsa == NULL) {\n            al = SSL_AD_HANDSHAKE_FAILURE;\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE,\n                   SSL_R_MISSING_RSA_CERTIFICATE);\n            goto f_err;\n        }\n        if (s->version == SSL3_VERSION || s->version == DTLS1_BAD_VER) {\n            enc_premaster = *pkt;\n        } else {\n            if (!PACKET_get_length_prefixed_2(pkt, &enc_premaster)\n                || PACKET_remaining(pkt) != 0) {\n                al = SSL_AD_DECODE_ERROR;\n                SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE,\n                       SSL_R_LENGTH_MISMATCH);\n                goto f_err;\n            }\n        }\n        if (RSA_size(rsa) < SSL_MAX_MASTER_KEY_LENGTH) {\n            al = SSL_AD_INTERNAL_ERROR;\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE,\n                   RSA_R_KEY_SIZE_TOO_SMALL);\n            goto f_err;\n        }\n        rsa_decrypt = OPENSSL_malloc(RSA_size(rsa));\n        if (rsa_decrypt == NULL) {\n            al = SSL_AD_INTERNAL_ERROR;\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, ERR_R_MALLOC_FAILURE);\n            goto f_err;\n        }\n        if (RAND_bytes(rand_premaster_secret,\n                       sizeof(rand_premaster_secret)) <= 0) {\n            goto err;\n        }\n        decrypt_len = RSA_private_decrypt(PACKET_remaining(&enc_premaster),\n                                          PACKET_data(&enc_premaster),\n                                          rsa_decrypt, rsa, RSA_PKCS1_PADDING);\n        ERR_clear_error();\n        decrypt_good =\n            constant_time_eq_int_8(decrypt_len, SSL_MAX_MASTER_KEY_LENGTH);\n        version_good =\n            constant_time_eq_8(rsa_decrypt[0],\n                               (unsigned)(s->client_version >> 8));\n        version_good &=\n            constant_time_eq_8(rsa_decrypt[1],\n                               (unsigned)(s->client_version & 0xff));\n        if (s->options & SSL_OP_TLS_ROLLBACK_BUG) {\n            unsigned char workaround_good;\n            workaround_good =\n                constant_time_eq_8(rsa_decrypt[0], (unsigned)(s->version >> 8));\n            workaround_good &=\n                constant_time_eq_8(rsa_decrypt[1],\n                                   (unsigned)(s->version & 0xff));\n            version_good |= workaround_good;\n        }\n        decrypt_good &= version_good;\n        for (j = 0; j < sizeof(rand_premaster_secret); j++) {\n            rsa_decrypt[j] =\n                constant_time_select_8(decrypt_good, rsa_decrypt[j],\n                                       rand_premaster_secret[j]);\n        }\n        if (!ssl_generate_master_secret(s, rsa_decrypt,\n                                        sizeof(rand_premaster_secret), 0)) {\n            al = SSL_AD_INTERNAL_ERROR;\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);\n            goto f_err;\n        }\n        OPENSSL_free(rsa_decrypt);\n        rsa_decrypt = NULL;\n    } else\n#endif\n#ifndef OPENSSL_NO_DH\n    if (alg_k & (SSL_kDHE | SSL_kDHEPSK)) {\n        EVP_PKEY *skey = NULL;\n        DH *cdh;\n        unsigned int i;\n        BIGNUM *pub_key;\n        const unsigned char *data;\n        if (!PACKET_get_net_2(pkt, &i)) {\n            if (alg_k & (SSL_kDHE | SSL_kDHEPSK)) {\n                al = SSL_AD_HANDSHAKE_FAILURE;\n                SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE,\n                       SSL_R_DH_PUBLIC_VALUE_LENGTH_IS_WRONG);\n                goto f_err;\n            }\n            i = 0;\n        }\n        if (PACKET_remaining(pkt) != i) {\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE,\n                   SSL_R_DH_PUBLIC_VALUE_LENGTH_IS_WRONG);\n            goto err;\n        }\n        skey = s->s3->tmp.pkey;\n        if (skey == NULL) {\n            al = SSL_AD_HANDSHAKE_FAILURE;\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE,\n                   SSL_R_MISSING_TMP_DH_KEY);\n            goto f_err;\n        }\n        if (PACKET_remaining(pkt) == 0L) {\n            al = SSL_AD_HANDSHAKE_FAILURE;\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE,\n                   SSL_R_MISSING_TMP_DH_KEY);\n            goto f_err;\n        }\n        if (!PACKET_get_bytes(pkt, &data, i)) {\n            al = SSL_AD_INTERNAL_ERROR;\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE,\n                   ERR_R_INTERNAL_ERROR);\n            goto f_err;\n        }\n        ckey = EVP_PKEY_new();\n        if (ckey == NULL || EVP_PKEY_copy_parameters(ckey, skey) == 0) {\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, SSL_R_BN_LIB);\n            goto err;\n        }\n        cdh = EVP_PKEY_get0_DH(ckey);\n        pub_key = BN_bin2bn(data, i, NULL);\n        if (pub_key == NULL || !DH_set0_key(cdh, pub_key, NULL)) {\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);\n            if (pub_key != NULL)\n                BN_free(pub_key);\n            goto err;\n        }\n        if (ssl_derive(s, skey, ckey) == 0) {\n            al = SSL_AD_INTERNAL_ERROR;\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);\n            goto f_err;\n        }\n        EVP_PKEY_free(ckey);\n        ckey = NULL;\n        EVP_PKEY_free(s->s3->tmp.pkey);\n        s->s3->tmp.pkey = NULL;\n    } else\n#endif\n#ifndef OPENSSL_NO_EC\n    if (alg_k & (SSL_kECDHE | SSL_kECDHEPSK)) {\n        EVP_PKEY *skey = s->s3->tmp.pkey;\n        if (PACKET_remaining(pkt) == 0L) {\n            al = SSL_AD_HANDSHAKE_FAILURE;\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE,\n                   SSL_R_MISSING_TMP_ECDH_KEY);\n            goto f_err;\n        } else {\n            unsigned int i;\n            const unsigned char *data;\n            if (!PACKET_get_1(pkt, &i)) {\n                al = SSL_AD_DECODE_ERROR;\n                SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE,\n                       SSL_R_LENGTH_MISMATCH);\n                goto f_err;\n            }\n            if (!PACKET_get_bytes(pkt, &data, i)\n                    || PACKET_remaining(pkt) != 0) {\n                SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, ERR_R_EC_LIB);\n                goto err;\n            }\n            ckey = EVP_PKEY_new();\n            if (ckey == NULL || EVP_PKEY_copy_parameters(ckey, skey) <= 0) {\n                SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, ERR_R_EVP_LIB);\n                goto err;\n            }\n            if (EC_KEY_oct2key(EVP_PKEY_get0_EC_KEY(ckey), data, i,\n                               NULL) == 0) {\n                SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, ERR_R_EC_LIB);\n                goto err;\n            }\n        }\n        if (ssl_derive(s, skey, ckey) == 0) {\n            al = SSL_AD_INTERNAL_ERROR;\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);\n            goto f_err;\n        }\n        EVP_PKEY_free(ckey);\n        ckey = NULL;\n        EVP_PKEY_free(s->s3->tmp.pkey);\n        s->s3->tmp.pkey = NULL;\n        return MSG_PROCESS_CONTINUE_PROCESSING;\n    } else\n#endif\n#ifndef OPENSSL_NO_SRP\n    if (alg_k & SSL_kSRP) {\n        unsigned int i;\n        const unsigned char *data;\n        if (!PACKET_get_net_2(pkt, &i)\n                || !PACKET_get_bytes(pkt, &data, i)) {\n            al = SSL_AD_DECODE_ERROR;\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, SSL_R_BAD_SRP_A_LENGTH);\n            goto f_err;\n        }\n        if ((s->srp_ctx.A = BN_bin2bn(data, i, NULL)) == NULL) {\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, ERR_R_BN_LIB);\n            goto err;\n        }\n        if (BN_ucmp(s->srp_ctx.A, s->srp_ctx.N) >= 0\n            || BN_is_zero(s->srp_ctx.A)) {\n            al = SSL_AD_ILLEGAL_PARAMETER;\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE,\n                   SSL_R_BAD_SRP_PARAMETERS);\n            goto f_err;\n        }\n        OPENSSL_free(s->session->srp_username);\n        s->session->srp_username = OPENSSL_strdup(s->srp_ctx.login);\n        if (s->session->srp_username == NULL) {\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, ERR_R_MALLOC_FAILURE);\n            goto err;\n        }\n        if (!srp_generate_server_master_secret(s)) {\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);\n            goto err;\n        }\n    } else\n#endif\n#ifndef OPENSSL_NO_GOST\n    if (alg_k & SSL_kGOST) {\n        EVP_PKEY_CTX *pkey_ctx;\n        EVP_PKEY *client_pub_pkey = NULL, *pk = NULL;\n        unsigned char premaster_secret[32];\n        const unsigned char *start;\n        size_t outlen = 32, inlen;\n        unsigned long alg_a;\n        int Ttag, Tclass;\n        long Tlen;\n        long sess_key_len;\n        const unsigned char *data;\n        alg_a = s->s3->tmp.new_cipher->algorithm_auth;\n        if (alg_a & SSL_aGOST12) {\n            pk = s->cert->pkeys[SSL_PKEY_GOST12_512].privatekey;\n            if (pk == NULL) {\n                pk = s->cert->pkeys[SSL_PKEY_GOST12_256].privatekey;\n            }\n            if (pk == NULL) {\n                pk = s->cert->pkeys[SSL_PKEY_GOST01].privatekey;\n            }\n        } else if (alg_a & SSL_aGOST01) {\n            pk = s->cert->pkeys[SSL_PKEY_GOST01].privatekey;\n        }\n        pkey_ctx = EVP_PKEY_CTX_new(pk, NULL);\n        if (pkey_ctx == NULL) {\n            al = SSL_AD_INTERNAL_ERROR;\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, ERR_R_MALLOC_FAILURE);\n            goto f_err;\n        }\n        if (EVP_PKEY_decrypt_init(pkey_ctx) <= 0) {\n            al = SSL_AD_INTERNAL_ERROR;\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);\n            goto f_err;\n        }\n        client_pub_pkey = X509_get0_pubkey(s->session->peer);\n        if (client_pub_pkey) {\n            if (EVP_PKEY_derive_set_peer(pkey_ctx, client_pub_pkey) <= 0)\n                ERR_clear_error();\n        }\n        sess_key_len = PACKET_remaining(pkt);\n        if (!PACKET_get_bytes(pkt, &data, sess_key_len)) {\n            al = SSL_AD_INTERNAL_ERROR;\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);\n            goto gerr;\n        }\n        if (ASN1_get_object ((const unsigned char **)&data, &Tlen, &Ttag,\n                             &Tclass, sess_key_len) != V_ASN1_CONSTRUCTED\n            || Ttag != V_ASN1_SEQUENCE\n            || Tclass != V_ASN1_UNIVERSAL) {\n            al = SSL_AD_DECODE_ERROR;\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE,\n                   SSL_R_DECRYPTION_FAILED);\n            goto gerr;\n        }\n        start = data;\n        inlen = Tlen;\n        if (EVP_PKEY_decrypt\n            (pkey_ctx, premaster_secret, &outlen, start, inlen) <= 0) {\n            al = SSL_AD_DECODE_ERROR;\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE,\n                   SSL_R_DECRYPTION_FAILED);\n            goto gerr;\n        }\n        if (!ssl_generate_master_secret(s, premaster_secret,\n                                        sizeof(premaster_secret), 0)) {\n            al = SSL_AD_INTERNAL_ERROR;\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);\n            goto gerr;\n        }\n        if (EVP_PKEY_CTX_ctrl\n            (pkey_ctx, -1, -1, EVP_PKEY_CTRL_PEER_KEY, 2, NULL) > 0)\n            s->statem.no_cert_verify = 1;\n        EVP_PKEY_CTX_free(pkey_ctx);\n        return MSG_PROCESS_CONTINUE_PROCESSING;\n gerr:\n        EVP_PKEY_CTX_free(pkey_ctx);\n        goto f_err;\n    } else\n#endif\n    {\n        al = SSL_AD_HANDSHAKE_FAILURE;\n        SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, SSL_R_UNKNOWN_CIPHER_TYPE);\n        goto f_err;\n    }\n    return MSG_PROCESS_CONTINUE_PROCESSING;\n f_err:\n    ssl3_send_alert(s, SSL3_AL_FATAL, al);\n#if !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_RSA) || !defined(OPENSSL_NO_EC) || defined(OPENSSL_NO_SRP)\n err:\n#endif\n#if !defined(OPENSSL_NO_EC) || !defined(OPENSSL_NO_DH)\n    EVP_PKEY_free(ckey);\n#endif\n    OPENSSL_free(rsa_decrypt);\n#ifndef OPENSSL_NO_PSK\n    OPENSSL_clear_free(s->s3->tmp.psk, s->s3->tmp.psklen);\n    s->s3->tmp.psk = NULL;\n#endif\n    ossl_statem_set_error(s);\n    return MSG_PROCESS_ERROR;\n}', 'BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)\n{\n    unsigned int i, m;\n    unsigned int n;\n    BN_ULONG l;\n    BIGNUM *bn = NULL;\n    if (ret == NULL)\n        ret = bn = BN_new();\n    if (ret == NULL)\n        return (NULL);\n    bn_check_top(ret);\n    for ( ; len > 0 && *s == 0; s++, len--)\n        continue;\n    n = len;\n    if (n == 0) {\n        ret->top = 0;\n        return (ret);\n    }\n    i = ((n - 1) / BN_BYTES) + 1;\n    m = ((n - 1) % (BN_BYTES));\n    if (bn_wexpand(ret, (int)i) == NULL) {\n        BN_free(bn);\n        return NULL;\n    }\n    ret->top = i;\n    ret->neg = 0;\n    l = 0;\n    while (n--) {\n        l = (l << 8L) | *(s++);\n        if (m-- == 0) {\n            ret->d[--i] = l;\n            l = 0;\n            m = BN_BYTES - 1;\n        }\n    }\n    bn_correct_top(ret);\n    return (ret);\n}', 'int srp_generate_server_master_secret(SSL *s)\n{\n    BIGNUM *K = NULL, *u = NULL;\n    int ret = -1, tmp_len = 0;\n    unsigned char *tmp = NULL;\n    if (!SRP_Verify_A_mod_N(s->srp_ctx.A, s->srp_ctx.N))\n        goto err;\n    if ((u = SRP_Calc_u(s->srp_ctx.A, s->srp_ctx.B, s->srp_ctx.N)) == NULL)\n        goto err;\n    if ((K = SRP_Calc_server_key(s->srp_ctx.A, s->srp_ctx.v, u, s->srp_ctx.b,\n                                 s->srp_ctx.N)) == NULL)\n        goto err;\n    tmp_len = BN_num_bytes(K);\n    if ((tmp = OPENSSL_malloc(tmp_len)) == NULL)\n        goto err;\n    BN_bn2bin(K, tmp);\n    ret = ssl_generate_master_secret(s, tmp, tmp_len, 1);\n err:\n    BN_clear_free(K);\n    BN_clear_free(u);\n    return ret;\n}', 'int SRP_Verify_A_mod_N(BIGNUM *A, BIGNUM *N)\n{\n    return SRP_Verify_B_mod_N(A, N);\n}', 'int SRP_Verify_B_mod_N(BIGNUM *B, BIGNUM *N)\n{\n    BIGNUM *r;\n    BN_CTX *bn_ctx;\n    int ret = 0;\n    if (B == NULL || N == NULL || (bn_ctx = BN_CTX_new()) == NULL)\n        return 0;\n    if ((r = BN_new()) == NULL)\n        goto err;\n    if (!BN_nnmod(r, B, N, bn_ctx))\n        goto err;\n    ret = !BN_is_zero(r);\n err:\n    BN_CTX_free(bn_ctx);\n    BN_free(r);\n    return ret;\n}', 'BIGNUM *SRP_Calc_u(BIGNUM *A, BIGNUM *B, BIGNUM *N)\n{\n    BIGNUM *u = NULL;\n    unsigned char cu[SHA_DIGEST_LENGTH];\n    unsigned char *cAB = NULL;\n    EVP_MD_CTX *ctxt = NULL;\n    int longN;\n    if ((A == NULL) || (B == NULL) || (N == NULL))\n        return NULL;\n    if (BN_ucmp(A, N) >= 0 || BN_ucmp(B, N) >= 0)\n        return NULL;\n    longN = BN_num_bytes(N);\n    ctxt = EVP_MD_CTX_new();\n    if (ctxt == NULL)\n        return NULL;\n    if ((cAB = OPENSSL_malloc(2 * longN)) == NULL)\n        goto err;\n    memset(cAB, 0, longN);\n    EVP_DigestInit_ex(ctxt, EVP_sha1(), NULL);\n    EVP_DigestUpdate(ctxt, cAB + BN_bn2bin(A, cAB + longN), longN);\n    EVP_DigestUpdate(ctxt, cAB + BN_bn2bin(B, cAB + longN), longN);\n    OPENSSL_free(cAB);\n    EVP_DigestFinal_ex(ctxt, cu, NULL);\n    if ((u = BN_bin2bn(cu, sizeof(cu), NULL)) == NULL)\n        goto err;\n    if (BN_is_zero(u)) {\n        BN_free(u);\n        u = NULL;\n    }\n err:\n    EVP_MD_CTX_free(ctxt);\n    return u;\n}', 'BIGNUM *SRP_Calc_server_key(BIGNUM *A, BIGNUM *v, BIGNUM *u, BIGNUM *b,\n                            BIGNUM *N)\n{\n    BIGNUM *tmp = NULL, *S = NULL;\n    BN_CTX *bn_ctx;\n    if (u == NULL || A == NULL || v == NULL || b == NULL || N == NULL)\n        return NULL;\n    if ((bn_ctx = BN_CTX_new()) == NULL || (tmp = BN_new()) == NULL)\n        goto err;\n    if (!BN_mod_exp(tmp, v, u, N, bn_ctx))\n        goto err;\n    if (!BN_mod_mul(tmp, A, tmp, N, bn_ctx))\n        goto err;\n    S = BN_new();\n    if (S != NULL && !BN_mod_exp(S, tmp, b, N, bn_ctx)) {\n        BN_free(S);\n        S = NULL;\n    }\n err:\n    BN_CTX_free(bn_ctx);\n    BN_clear_free(tmp);\n    return S;\n}', 'int BN_mod_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *m,\n               BN_CTX *ctx)\n{\n    BIGNUM *t;\n    int ret = 0;\n    bn_check_top(a);\n    bn_check_top(b);\n    bn_check_top(m);\n    BN_CTX_start(ctx);\n    if ((t = BN_CTX_get(ctx)) == NULL)\n        goto err;\n    if (a == b) {\n        if (!BN_sqr(t, a, ctx))\n            goto err;\n    } else {\n        if (!BN_mul(t, a, b, ctx))\n            goto err;\n    }\n    if (!BN_nnmod(r, t, m, ctx))\n        goto err;\n    bn_check_top(r);\n    ret = 1;\n err:\n    BN_CTX_end(ctx);\n    return (ret);\n}', 'int BN_sqr(BIGNUM *r, const BIGNUM *a, BN_CTX *ctx)\n{\n    int max, al;\n    int ret = 0;\n    BIGNUM *tmp, *rr;\n    bn_check_top(a);\n    al = a->top;\n    if (al <= 0) {\n        r->top = 0;\n        r->neg = 0;\n        return 1;\n    }\n    BN_CTX_start(ctx);\n    rr = (a != r) ? r : BN_CTX_get(ctx);\n    tmp = BN_CTX_get(ctx);\n    if (!rr || !tmp)\n        goto err;\n    max = 2 * al;\n    if (bn_wexpand(rr, max) == NULL)\n        goto err;\n    if (al == 4) {\n#ifndef BN_SQR_COMBA\n        BN_ULONG t[8];\n        bn_sqr_normal(rr->d, a->d, 4, t);\n#else\n        bn_sqr_comba4(rr->d, a->d);\n#endif\n    } else if (al == 8) {\n#ifndef BN_SQR_COMBA\n        BN_ULONG t[16];\n        bn_sqr_normal(rr->d, a->d, 8, t);\n#else\n        bn_sqr_comba8(rr->d, a->d);\n#endif\n    } else {\n#if defined(BN_RECURSION)\n        if (al < BN_SQR_RECURSIVE_SIZE_NORMAL) {\n            BN_ULONG t[BN_SQR_RECURSIVE_SIZE_NORMAL * 2];\n            bn_sqr_normal(rr->d, a->d, al, t);\n        } else {\n            int j, k;\n            j = BN_num_bits_word((BN_ULONG)al);\n            j = 1 << (j - 1);\n            k = j + j;\n            if (al == j) {\n                if (bn_wexpand(tmp, k * 2) == NULL)\n                    goto err;\n                bn_sqr_recursive(rr->d, a->d, al, tmp->d);\n            } else {\n                if (bn_wexpand(tmp, max) == NULL)\n                    goto err;\n                bn_sqr_normal(rr->d, a->d, al, tmp->d);\n            }\n        }\n#else\n        if (bn_wexpand(tmp, max) == NULL)\n            goto err;\n        bn_sqr_normal(rr->d, a->d, al, tmp->d);\n#endif\n    }\n    rr->neg = 0;\n    if (a->d[al - 1] == (a->d[al - 1] & BN_MASK2l))\n        rr->top = max - 1;\n    else\n        rr->top = max;\n    if (rr != r)\n        BN_copy(r, rr);\n    ret = 1;\n err:\n    bn_check_top(rr);\n    bn_check_top(tmp);\n    BN_CTX_end(ctx);\n    return (ret);\n}', 'void bn_sqr_normal(BN_ULONG *r, const BN_ULONG *a, int n, BN_ULONG *tmp)\n{\n    int i, j, max;\n    const BN_ULONG *ap;\n    BN_ULONG *rp;\n    max = n * 2;\n    ap = a;\n    rp = r;\n    rp[0] = rp[max - 1] = 0;\n    rp++;\n    j = n;\n    if (--j > 0) {\n        ap++;\n        rp[j] = bn_mul_words(rp, ap, j, ap[-1]);\n        rp += 2;\n    }\n    for (i = n - 2; i > 0; i--) {\n        j--;\n        ap++;\n        rp[j] = bn_mul_add_words(rp, ap, j, ap[-1]);\n        rp += 2;\n    }\n    bn_add_words(r, r, r, max);\n    bn_sqr_words(tmp, a, n);\n    bn_add_words(r, r, tmp, max);\n}']