crypto/srp/srp_vfy.c:384: error: INTEGER_OVERFLOW_L2
  ([-oo, 2147483647] + 1):signed32 by call to `SRP_gN_place_bn`.
Showing all 11 steps of the trace


crypto/srp/srp_vfy.c:365:18: Call
363.       error_code = SRP_ERR_VBASE_INCOMPLETE_FILE;
364.   
365.       if ((tmpdb = TXT_DB_read(in, DB_NUMBER)) == NULL)
                        ^
366.           goto err;
367.   

crypto/txt_db/txt_db.c:55:5: Assignment
  53.       add = (num + 1) * sizeof(char *);
  54.       buf->data[size - 1] = '\0';
  55.       offset = 0;
            ^
  56.       for (;;) {
  57.           if (offset != 0) {

crypto/srp/srp_vfy.c:384:29: Call
382.   
383.               if ((gN->id = OPENSSL_strdup(pp[DB_srpid])) == NULL
384.                   || (gN->N = SRP_gN_place_bn(vb->gN_cache, pp[DB_srpverifier]))
                                   ^
385.                           == NULL
386.                   || (gN->g = SRP_gN_place_bn(vb->gN_cache, pp[DB_srpsalt]))

crypto/srp/srp_vfy.c:315:1: Parameter `ch->strlen`
  313.   }
  314.   
  315. > static BIGNUM *SRP_gN_place_bn(STACK_OF(SRP_gN_cache) *gN_cache, char *ch)
  316.   {
  317.       int i;

crypto/srp/srp_vfy.c:328:31: Call
  326.       }
  327.       {                           /* it is the first time that we find it */
  328.           SRP_gN_cache *newgN = SRP_gN_new_init(ch);
                                       ^
  329.           if (newgN) {
  330.               if (sk_SRP_gN_cache_insert(gN_cache, newgN, 0) > 0)

crypto/srp/srp_vfy.c:266:1: Parameter `ch->strlen`
    264.   }
    265.   
    266. > static SRP_gN_cache *SRP_gN_new_init(const char *ch)
    267.   {
    268.       unsigned char tmp[MAX_LEN];

crypto/srp/srp_vfy.c:275:11: Call
    273.           return NULL;
    274.   
    275.       len = t_fromb64(tmp, sizeof(tmp), ch);
                     ^
    276.       if (len < 0)
    277.           goto err;

crypto/srp/srp_vfy.c:33:1: <LHS trace>
31.    * Convert a base64 string into raw byte array representation.
32.    */
33. > static int t_fromb64(unsigned char *a, size_t alen, const char *src)
34.   {
35.       char *loc;

crypto/srp/srp_vfy.c:33:1: Parameter `alen`
      31.    * Convert a base64 string into raw byte array representation.
      32.    */
      33. > static int t_fromb64(unsigned char *a, size_t alen, const char *src)
      34.   {
      35.       char *loc;

crypto/srp/srp_vfy.c:57:5: Assignment
      55.       if (i == 0)
      56.           return 0;
      57.       size = i;
                ^
      58.       i = size - 1;
      59.       j = size;

crypto/srp/srp_vfy.c:81:9: Binary operation: ([-oo, 2147483647] + 1):signed32 by call to `SRP_gN_place_bn` 
      79.       }
      80.       while (a[j] == 0 && j <= size)
      81.           ++j;
                    ^
      82.       i = 0;
      83.       while (j <= size)

static int t_fromb64(unsigned char *a, size_t alen, const char *src)
{
    char *loc;
    int i, j;
    int size;
    while (*src && (*src == ' ' || *src == '\t' || *src == '\n'))
        ++src;
    size = strlen(src);
    if (alen > INT_MAX || size > (int)alen)
        return -1;
    i = 0;
    while (i < size) {
        loc = strchr(b64table, src[i]);
        if (loc == (char *)0)
            break;
        else
            a[i] = loc - b64table;
        ++i;
    }
    if (i == 0)
        return 0;
    size = i;
    i = size - 1;
    j = size;
    while (1) {
        a[j] = a[i];
        if (--i < 0)
            break;
        a[j] |= (a[i] & 3) << 6;
        --j;
        a[j] = (unsigned char)((a[i] & 0x3c) >> 2);
        if (--i < 0)
            break;
        a[j] |= (a[i] & 0xf) << 4;
        --j;
        a[j] = (unsigned char)((a[i] & 0x30) >> 4);
        if (--i < 0)
            break;
        a[j] |= (a[i] << 2);
        a[--j] = 0;
        if (--i < 0)
            break;
    }
    while (a[j] == 0 && j <= size)
        ++j;
    i = 0;
    while (j <= size)
        a[i++] = a[j++];
    return i;
}
['int SRP_VBASE_init(SRP_VBASE *vb, char *verifier_file)\n{\n    int error_code;\n    STACK_OF(SRP_gN) *SRP_gN_tab = sk_SRP_gN_new_null();\n    char *last_index = NULL;\n    int i;\n    char **pp;\n    SRP_gN *gN = NULL;\n    SRP_user_pwd *user_pwd = NULL;\n    TXT_DB *tmpdb = NULL;\n    BIO *in = BIO_new(BIO_s_file());\n    error_code = SRP_ERR_OPEN_FILE;\n    if (in == NULL || BIO_read_filename(in, verifier_file) <= 0)\n        goto err;\n    error_code = SRP_ERR_VBASE_INCOMPLETE_FILE;\n    if ((tmpdb = TXT_DB_read(in, DB_NUMBER)) == NULL)\n        goto err;\n    error_code = SRP_ERR_MEMORY;\n    if (vb->seed_key) {\n        last_index = SRP_get_default_gN(NULL)->id;\n    }\n    for (i = 0; i < sk_OPENSSL_PSTRING_num(tmpdb->data); i++) {\n        pp = sk_OPENSSL_PSTRING_value(tmpdb->data, i);\n        if (pp[DB_srptype][0] == DB_SRP_INDEX) {\n            if ((gN = OPENSSL_malloc(sizeof(*gN))) == NULL)\n                goto err;\n            if ((gN->id = OPENSSL_strdup(pp[DB_srpid])) == NULL\n                || (gN->N = SRP_gN_place_bn(vb->gN_cache, pp[DB_srpverifier]))\n                        == NULL\n                || (gN->g = SRP_gN_place_bn(vb->gN_cache, pp[DB_srpsalt]))\n                        == NULL\n                || sk_SRP_gN_insert(SRP_gN_tab, gN, 0) == 0)\n                goto err;\n            gN = NULL;\n            if (vb->seed_key != NULL) {\n                last_index = pp[DB_srpid];\n            }\n        } else if (pp[DB_srptype][0] == DB_SRP_VALID) {\n            const SRP_gN *lgN;\n            if ((lgN = SRP_get_gN_by_id(pp[DB_srpgN], SRP_gN_tab)) != NULL) {\n                error_code = SRP_ERR_MEMORY;\n                if ((user_pwd = SRP_user_pwd_new()) == NULL)\n                    goto err;\n                SRP_user_pwd_set_gN(user_pwd, lgN->g, lgN->N);\n                if (!SRP_user_pwd_set_ids\n                    (user_pwd, pp[DB_srpid], pp[DB_srpinfo]))\n                    goto err;\n                error_code = SRP_ERR_VBASE_BN_LIB;\n                if (!SRP_user_pwd_set_sv\n                    (user_pwd, pp[DB_srpsalt], pp[DB_srpverifier]))\n                    goto err;\n                if (sk_SRP_user_pwd_insert(vb->users_pwd, user_pwd, 0) == 0)\n                    goto err;\n                user_pwd = NULL;\n            }\n        }\n    }\n    if (last_index != NULL) {\n        if (((gN = SRP_get_gN_by_id(last_index, SRP_gN_tab)) == NULL)) {\n            error_code = SRP_ERR_VBASE_BN_LIB;\n            goto err;\n        }\n        vb->default_g = gN->g;\n        vb->default_N = gN->N;\n        gN = NULL;\n    }\n    error_code = SRP_NO_ERROR;\n err:\n    if (gN != NULL) {\n        OPENSSL_free(gN->id);\n        OPENSSL_free(gN);\n    }\n    SRP_user_pwd_free(user_pwd);\n    TXT_DB_free(tmpdb);\n    BIO_free_all(in);\n    sk_SRP_gN_free(SRP_gN_tab);\n    return error_code;\n}', "TXT_DB *TXT_DB_read(BIO *in, int num)\n{\n    TXT_DB *ret = NULL;\n    int esc = 0;\n    long ln = 0;\n    int i, add, n;\n    int size = BUFSIZE;\n    int offset = 0;\n    char *p, *f;\n    OPENSSL_STRING *pp;\n    BUF_MEM *buf = NULL;\n    if ((buf = BUF_MEM_new()) == NULL)\n        goto err;\n    if (!BUF_MEM_grow(buf, size))\n        goto err;\n    if ((ret = OPENSSL_malloc(sizeof(*ret))) == NULL)\n        goto err;\n    ret->num_fields = num;\n    ret->index = NULL;\n    ret->qual = NULL;\n    if ((ret->data = sk_OPENSSL_PSTRING_new_null()) == NULL)\n        goto err;\n    if ((ret->index = OPENSSL_malloc(sizeof(*ret->index) * num)) == NULL)\n        goto err;\n    if ((ret->qual = OPENSSL_malloc(sizeof(*(ret->qual)) * num)) == NULL)\n        goto err;\n    for (i = 0; i < num; i++) {\n        ret->index[i] = NULL;\n        ret->qual[i] = NULL;\n    }\n    add = (num + 1) * sizeof(char *);\n    buf->data[size - 1] = '\\0';\n    offset = 0;\n    for (;;) {\n        if (offset != 0) {\n            size += BUFSIZE;\n            if (!BUF_MEM_grow_clean(buf, size))\n                goto err;\n        }\n        buf->data[offset] = '\\0';\n        BIO_gets(in, &(buf->data[offset]), size - offset);\n        ln++;\n        if (buf->data[offset] == '\\0')\n            break;\n        if ((offset == 0) && (buf->data[0] == '#'))\n            continue;\n        i = strlen(&(buf->data[offset]));\n        offset += i;\n        if (buf->data[offset - 1] != '\\n')\n            continue;\n        else {\n            buf->data[offset - 1] = '\\0';\n            if ((p = OPENSSL_malloc(add + offset)) == NULL)\n                goto err;\n            offset = 0;\n        }\n        pp = (char **)p;\n        p += add;\n        n = 0;\n        pp[n++] = p;\n        i = 0;\n        f = buf->data;\n        esc = 0;\n        for (;;) {\n            if (*f == '\\0')\n                break;\n            if (*f == '\\t') {\n                if (esc)\n                    p--;\n                else {\n                    *(p++) = '\\0';\n                    f++;\n                    if (n >= num)\n                        break;\n                    pp[n++] = p;\n                    continue;\n                }\n            }\n            esc = (*f == '\\\\');\n            *(p++) = *(f++);\n        }\n        *(p++) = '\\0';\n        if ((n != num) || (*f != '\\0')) {\n            ret->error = DB_ERROR_WRONG_NUM_FIELDS;\n            goto err;\n        }\n        pp[n] = p;\n        if (!sk_OPENSSL_PSTRING_push(ret->data, pp))\n            goto err;\n    }\n    BUF_MEM_free(buf);\n    return ret;\n err:\n    BUF_MEM_free(buf);\n    if (ret != NULL) {\n        sk_OPENSSL_PSTRING_free(ret->data);\n        OPENSSL_free(ret->index);\n        OPENSSL_free(ret->qual);\n        OPENSSL_free(ret);\n    }\n    return (NULL);\n}", 'static BIGNUM *SRP_gN_place_bn(STACK_OF(SRP_gN_cache) *gN_cache, char *ch)\n{\n    int i;\n    if (gN_cache == NULL)\n        return NULL;\n    for (i = 0; i < sk_SRP_gN_cache_num(gN_cache); i++) {\n        SRP_gN_cache *cache = sk_SRP_gN_cache_value(gN_cache, i);\n        if (strcmp(cache->b64_bn, ch) == 0)\n            return cache->bn;\n    }\n    {\n        SRP_gN_cache *newgN = SRP_gN_new_init(ch);\n        if (newgN) {\n            if (sk_SRP_gN_cache_insert(gN_cache, newgN, 0) > 0)\n                return newgN->bn;\n            SRP_gN_free(newgN);\n        }\n    }\n    return NULL;\n}', 'static SRP_gN_cache *SRP_gN_new_init(const char *ch)\n{\n    unsigned char tmp[MAX_LEN];\n    int len;\n    SRP_gN_cache *newgN = OPENSSL_malloc(sizeof(*newgN));\n    if (newgN == NULL)\n        return NULL;\n    len = t_fromb64(tmp, sizeof(tmp), ch);\n    if (len < 0)\n        goto err;\n    if ((newgN->b64_bn = OPENSSL_strdup(ch)) == NULL)\n        goto err;\n    if ((newgN->bn = BN_bin2bn(tmp, len, NULL)))\n        return newgN;\n    OPENSSL_free(newgN->b64_bn);\n err:\n    OPENSSL_free(newgN);\n    return NULL;\n}', "static int t_fromb64(unsigned char *a, size_t alen, const char *src)\n{\n    char *loc;\n    int i, j;\n    int size;\n    while (*src && (*src == ' ' || *src == '\\t' || *src == '\\n'))\n        ++src;\n    size = strlen(src);\n    if (alen > INT_MAX || size > (int)alen)\n        return -1;\n    i = 0;\n    while (i < size) {\n        loc = strchr(b64table, src[i]);\n        if (loc == (char *)0)\n            break;\n        else\n            a[i] = loc - b64table;\n        ++i;\n    }\n    if (i == 0)\n        return 0;\n    size = i;\n    i = size - 1;\n    j = size;\n    while (1) {\n        a[j] = a[i];\n        if (--i < 0)\n            break;\n        a[j] |= (a[i] & 3) << 6;\n        --j;\n        a[j] = (unsigned char)((a[i] & 0x3c) >> 2);\n        if (--i < 0)\n            break;\n        a[j] |= (a[i] & 0xf) << 4;\n        --j;\n        a[j] = (unsigned char)((a[i] & 0x30) >> 4);\n        if (--i < 0)\n            break;\n        a[j] |= (a[i] << 2);\n        a[--j] = 0;\n        if (--i < 0)\n            break;\n    }\n    while (a[j] == 0 && j <= size)\n        ++j;\n    i = 0;\n    while (j <= size)\n        a[i++] = a[j++];\n    return i;\n}"]