crypto/pkcs12/p12_key.c:162: error: BUFFER_OVERRUN_L3
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `BN_bin2bn`.
Showing all 9 steps of the trace


crypto/pkcs12/p12_key.c:125:9: Call
123.   	I = Malloc (Ilen);
124.   	Ij = BN_new();
125.   	Bpl1 = BN_new();
               ^
126.   	if (!D || !Ai || !B || !I || !Ij || !Bpl1) {
127.   		PKCS12err(PKCS12_F_PKCS12_KEY_GEN_UNI,ERR_R_MALLOC_FAILURE);

crypto/bn/bn_lib.c:303:2: Assignment
  301.   	ret->neg=0;
  302.   	ret->max=0;
  303.   	ret->d=NULL;
          ^
  304.   	return(ret);
  305.   	}

crypto/pkcs12/p12_key.c:162:3: Call
160.   		for (j = 0; j < v; j++) B[j] = Ai[j % u];
161.   		/* Work out B + 1 first then can use B as tmp space */
162.   		BN_bin2bn (B, v, Bpl1);
         ^
163.   		BN_add_word (Bpl1, 1);
164.   		for (j = 0; j < Ilen ; j+=v) {

crypto/bn/bn_lib.c:595:1: Parameter `*ret->d`
  593.   
  594.   /* ignore negative */
  595. > BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)
  596.   	{
  597.   	unsigned int i,m;

crypto/bn/bn_lib.c:610:6: Call
  608.   		return(ret);
  609.   		}
  610.   	if (bn_expand(ret,(int)(n+2)*8) == NULL)
              ^
  611.   		return(NULL);
  612.   	i=((n-1)/BN_BYTES)+1;

crypto/bn/bn_lib.c:344:1: <Length trace>
342.   	}
343.   
344. > BIGNUM *bn_expand2(BIGNUM *b, int words)
345.   	{
346.   	BN_ULONG *A,*a;

crypto/bn/bn_lib.c:344:1: Parameter `*b->d`
    342.   	}
    343.   
    344. > BIGNUM *bn_expand2(BIGNUM *b, int words)
    345.   	{
    346.   	BN_ULONG *A,*a;

crypto/bn/bn_lib.c:367:3: Assignment
    365.   			}
    366.   #if 1
    367.   		B=b->d;
             ^
    368.   		/* Check if the previous number needs to be copied */
    369.   		if (B != NULL)

crypto/bn/bn_lib.c:447:35: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `BN_bin2bn` 
    445.   				 */
    446.   				BN_ULONG a0,a1,a2,a3;
    447.   				a0=B[0]; a1=B[1]; a2=B[2]; a3=B[3];
                                             ^
    448.   				A[0]=a0; A[1]=a1; A[2]=a2; A[3]=a3;
    449.   				}

BIGNUM *bn_expand2(BIGNUM *b, int words)
	{
	BN_ULONG *A,*a;
	const BN_ULONG *B;
	int i;
	bn_check_top(b);
	if (words > b->max)
		{
		bn_check_top(b);
		if (BN_get_flags(b,BN_FLG_STATIC_DATA))
			{
			BNerr(BN_F_BN_EXPAND2,BN_R_EXPAND_ON_STATIC_BIGNUM_DATA);
			return(NULL);
			}
		a=A=(BN_ULONG *)Malloc(sizeof(BN_ULONG)*(words+1));
		if (A == NULL)
			{
			BNerr(BN_F_BN_EXPAND2,ERR_R_MALLOC_FAILURE);
			return(NULL);
			}
#if 1
		B=b->d;
		if (B != NULL)
			{
#if 0
			for (i=b->top&(~7); i>0; i-=8)
				{
				A[0]=B[0]; A[1]=B[1]; A[2]=B[2]; A[3]=B[3];
				A[4]=B[4]; A[5]=B[5]; A[6]=B[6]; A[7]=B[7];
				A+=8;
				B+=8;
				}
			switch (b->top&7)
				{
			case 7:
				A[6]=B[6];
			case 6:
				A[5]=B[5];
			case 5:
				A[4]=B[4];
			case 4:
				A[3]=B[3];
			case 3:
				A[2]=B[2];
			case 2:
				A[1]=B[1];
			case 1:
				A[0]=B[0];
			case 0:
				;
				}
#else
			for (i=b->top>>2; i>0; i--,A+=4,B+=4)
				{
				BN_ULONG a0,a1,a2,a3;
				a0=B[0]; a1=B[1]; a2=B[2]; a3=B[3];
				A[0]=a0; A[1]=a1; A[2]=a2; A[3]=a3;
				}
			switch (b->top&3)
				{
				case 3:	A[2]=B[2];
				case 2:	A[1]=B[1];
				case 1:	A[0]=B[0];
				case 0:	;
				}
#endif
			Free(b->d);
			}
		b->d=a;
		b->max=words;
		A= &(b->d[b->top]);
		for (i=(b->max - b->top)>>3; i>0; i--,A+=8)
			{
			A[0]=0; A[1]=0; A[2]=0; A[3]=0;
			A[4]=0; A[5]=0; A[6]=0; A[7]=0;
			}
		for (i=(b->max - b->top)&7; i>0; i--,A++)
			A[0]=0;
#else
			memset(A,0,sizeof(BN_ULONG)*(words+1));
			memcpy(A,b->d,sizeof(b->d[0])*b->top);
			b->d=a;
			b->max=words;
#endif
		}
	return(b);
	}
['int PKCS12_key_gen_uni (unsigned char *pass, int passlen, unsigned char *salt,\n\t     int saltlen, int id, int iter, int n, unsigned char *out,\n\t     const EVP_MD *md_type)\n{\n\tunsigned char *B, *D, *I, *p, *Ai;\n\tint Slen, Plen, Ilen;\n\tint i, j, u, v;\n\tBIGNUM *Ij, *Bpl1;\n\tEVP_MD_CTX ctx;\n#ifdef  DEBUG_KEYGEN\n\tunsigned char *tmpout = out;\n\tint tmpn = n;\n\tBIO_printf (bio_err, "KEYGEN DEBUG\\n");\n\tBIO_printf (bio_err, "ID %d, ITER %d\\n", id, iter);\n\tBIO_printf (bio_err, "Password (length %d):\\n", passlen);\n\th__dump (pass, passlen);\n\tBIO_printf (bio_err, "Salt (length %d):\\n", saltlen);\n\th__dump (salt, saltlen);\n\tBIO_printf (bio_err, "ID %d, ITER %d\\n\\n", id, iter);\n#endif\n\tv = EVP_MD_block_size (md_type);\n\tu = EVP_MD_size (md_type);\n\tD = Malloc (v);\n\tAi = Malloc (u);\n\tB = Malloc (v + 1);\n\tSlen = v * ((saltlen+v-1)/v);\n\tPlen = v * ((passlen+v-1)/v);\n\tIlen = Slen + Plen;\n\tI = Malloc (Ilen);\n\tIj = BN_new();\n\tBpl1 = BN_new();\n\tif (!D || !Ai || !B || !I || !Ij || !Bpl1) {\n\t\tPKCS12err(PKCS12_F_PKCS12_KEY_GEN_UNI,ERR_R_MALLOC_FAILURE);\n\t\treturn 0;\n\t}\n\tfor (i = 0; i < v; i++) D[i] = id;\n\tp = I;\n\tfor (i = 0; i < Slen; i++) *p++ = salt[i % saltlen];\n\tfor (i = 0; i < Plen; i++) *p++ = pass[i % passlen];\n\tfor (;;) {\n\t\tEVP_DigestInit (&ctx, md_type);\n\t\tEVP_DigestUpdate (&ctx, D, v);\n\t\tEVP_DigestUpdate (&ctx, I, Ilen);\n\t\tEVP_DigestFinal (&ctx, Ai, NULL);\n\t\tfor (j = 1; j < iter; j++) {\n\t\t\tEVP_DigestInit (&ctx, md_type);\n\t\t\tEVP_DigestUpdate (&ctx, Ai, u);\n\t\t\tEVP_DigestFinal (&ctx, Ai, NULL);\n\t\t}\n\t\tmemcpy (out, Ai, min (n, u));\n\t\tif (u >= n) {\n\t\t\tFree (Ai);\n\t\t\tFree (B);\n\t\t\tFree (D);\n\t\t\tFree (I);\n\t\t\tBN_free (Ij);\n\t\t\tBN_free (Bpl1);\n#ifdef DEBUG_KEYGEN\n\t\t\tBIO_printf (bio_err, "Output KEY (length %d)\\n", tmpn);\n\t\t\th__dump (tmpout, tmpn);\n#endif\n\t\t\treturn 1;\n\t\t}\n\t\tn -= u;\n\t\tout += u;\n\t\tfor (j = 0; j < v; j++) B[j] = Ai[j % u];\n\t\tBN_bin2bn (B, v, Bpl1);\n\t\tBN_add_word (Bpl1, 1);\n\t\tfor (j = 0; j < Ilen ; j+=v) {\n\t\t\tBN_bin2bn (I + j, v, Ij);\n\t\t\tBN_add (Ij, Ij, Bpl1);\n\t\t\tBN_bn2bin (Ij, B);\n\t\t\tif (BN_num_bytes (Ij) > v) {\n\t\t\t\tBN_bn2bin (Ij, B);\n\t\t\t\tmemcpy (I + j, B + 1, v);\n\t\t\t} else BN_bn2bin (Ij, I + j);\n\t\t}\n\t}\n}', 'BIGNUM *BN_new(void)\n\t{\n\tBIGNUM *ret;\n\tif ((ret=(BIGNUM *)Malloc(sizeof(BIGNUM))) == NULL)\n\t\t{\n\t\tBNerr(BN_F_BN_NEW,ERR_R_MALLOC_FAILURE);\n\t\treturn(NULL);\n\t\t}\n\tret->flags=BN_FLG_MALLOCED;\n\tret->top=0;\n\tret->neg=0;\n\tret->max=0;\n\tret->d=NULL;\n\treturn(ret);\n\t}', 'BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)\n\t{\n\tunsigned int i,m;\n\tunsigned int n;\n\tBN_ULONG l;\n\tif (ret == NULL) ret=BN_new();\n\tif (ret == NULL) return(NULL);\n\tl=0;\n\tn=len;\n\tif (n == 0)\n\t\t{\n\t\tret->top=0;\n\t\treturn(ret);\n\t\t}\n\tif (bn_expand(ret,(int)(n+2)*8) == NULL)\n\t\treturn(NULL);\n\ti=((n-1)/BN_BYTES)+1;\n\tm=((n-1)%(BN_BYTES));\n\tret->top=i;\n\twhile (n-- > 0)\n\t\t{\n\t\tl=(l<<8L)| *(s++);\n\t\tif (m-- == 0)\n\t\t\t{\n\t\t\tret->d[--i]=l;\n\t\t\tl=0;\n\t\t\tm=BN_BYTES-1;\n\t\t\t}\n\t\t}\n\tbn_fix_top(ret);\n\treturn(ret);\n\t}', 'BIGNUM *bn_expand2(BIGNUM *b, int words)\n\t{\n\tBN_ULONG *A,*a;\n\tconst BN_ULONG *B;\n\tint i;\n\tbn_check_top(b);\n\tif (words > b->max)\n\t\t{\n\t\tbn_check_top(b);\n\t\tif (BN_get_flags(b,BN_FLG_STATIC_DATA))\n\t\t\t{\n\t\t\tBNerr(BN_F_BN_EXPAND2,BN_R_EXPAND_ON_STATIC_BIGNUM_DATA);\n\t\t\treturn(NULL);\n\t\t\t}\n\t\ta=A=(BN_ULONG *)Malloc(sizeof(BN_ULONG)*(words+1));\n\t\tif (A == NULL)\n\t\t\t{\n\t\t\tBNerr(BN_F_BN_EXPAND2,ERR_R_MALLOC_FAILURE);\n\t\t\treturn(NULL);\n\t\t\t}\n#if 1\n\t\tB=b->d;\n\t\tif (B != NULL)\n\t\t\t{\n#if 0\n\t\t\tfor (i=b->top&(~7); i>0; i-=8)\n\t\t\t\t{\n\t\t\t\tA[0]=B[0]; A[1]=B[1]; A[2]=B[2]; A[3]=B[3];\n\t\t\t\tA[4]=B[4]; A[5]=B[5]; A[6]=B[6]; A[7]=B[7];\n\t\t\t\tA+=8;\n\t\t\t\tB+=8;\n\t\t\t\t}\n\t\t\tswitch (b->top&7)\n\t\t\t\t{\n\t\t\tcase 7:\n\t\t\t\tA[6]=B[6];\n\t\t\tcase 6:\n\t\t\t\tA[5]=B[5];\n\t\t\tcase 5:\n\t\t\t\tA[4]=B[4];\n\t\t\tcase 4:\n\t\t\t\tA[3]=B[3];\n\t\t\tcase 3:\n\t\t\t\tA[2]=B[2];\n\t\t\tcase 2:\n\t\t\t\tA[1]=B[1];\n\t\t\tcase 1:\n\t\t\t\tA[0]=B[0];\n\t\t\tcase 0:\n\t\t\t\t;\n\t\t\t\t}\n#else\n\t\t\tfor (i=b->top>>2; i>0; i--,A+=4,B+=4)\n\t\t\t\t{\n\t\t\t\tBN_ULONG a0,a1,a2,a3;\n\t\t\t\ta0=B[0]; a1=B[1]; a2=B[2]; a3=B[3];\n\t\t\t\tA[0]=a0; A[1]=a1; A[2]=a2; A[3]=a3;\n\t\t\t\t}\n\t\t\tswitch (b->top&3)\n\t\t\t\t{\n\t\t\t\tcase 3:\tA[2]=B[2];\n\t\t\t\tcase 2:\tA[1]=B[1];\n\t\t\t\tcase 1:\tA[0]=B[0];\n\t\t\t\tcase 0:\t;\n\t\t\t\t}\n#endif\n\t\t\tFree(b->d);\n\t\t\t}\n\t\tb->d=a;\n\t\tb->max=words;\n\t\tA= &(b->d[b->top]);\n\t\tfor (i=(b->max - b->top)>>3; i>0; i--,A+=8)\n\t\t\t{\n\t\t\tA[0]=0; A[1]=0; A[2]=0; A[3]=0;\n\t\t\tA[4]=0; A[5]=0; A[6]=0; A[7]=0;\n\t\t\t}\n\t\tfor (i=(b->max - b->top)&7; i>0; i--,A++)\n\t\t\tA[0]=0;\n#else\n\t\t\tmemset(A,0,sizeof(BN_ULONG)*(words+1));\n\t\t\tmemcpy(A,b->d,sizeof(b->d[0])*b->top);\n\t\t\tb->d=a;\n\t\t\tb->max=words;\n#endif\n\t\t}\n\treturn(b);\n\t}']