crypto/rsa/rsa_ossl.c:423: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: [1, +oo] by call to `rsa_blinding_convert`.
Showing all 19 steps of the trace


crypto/rsa/rsa_ossl.c:380:5: Call
378.       if ((ctx = BN_CTX_new()) == NULL)
379.           goto err;
380.       BN_CTX_start(ctx);
           ^
381.       f = BN_CTX_get(ctx);
382.       ret = BN_CTX_get(ctx);

crypto/bn/bn_ctx.c:171:1: Parameter `ctx->stack.depth`
  169.   }
  170.   
  171. > void BN_CTX_start(BN_CTX *ctx)
  172.   {
  173.       CTXDBG("ENTER BN_CTX_start()", ctx);

crypto/rsa/rsa_ossl.c:423:14: Call
421.               goto err;
422.           }
423.           if (!rsa_blinding_convert(blinding, f, unblind, ctx))
                    ^
424.               goto err;
425.       }

crypto/rsa/rsa_ossl.c:196:1: Parameter `ctx->stack.depth`
  194.   }
  195.   
  196. > static int rsa_blinding_convert(BN_BLINDING *b, BIGNUM *f, BIGNUM *unblind,
  197.                                   BN_CTX *ctx)
  198.   {

crypto/rsa/rsa_ossl.c:203:16: Call
  201.            * Local blinding: store the unblinding factor in BN_BLINDING.
  202.            */
  203.           return BN_BLINDING_convert_ex(f, NULL, b, ctx);
                        ^
  204.       } else {
  205.           /*

crypto/bn/bn_blind.c:134:1: Parameter `ctx->stack.depth`
    132.   }
    133.   
    134. > int BN_BLINDING_convert_ex(BIGNUM *n, BIGNUM *r, BN_BLINDING *b, BN_CTX *ctx)
    135.   {
    136.       int ret = 1;

crypto/bn/bn_blind.c:148:15: Call
    146.           /* Fresh blinding, doesn't need updating. */
    147.           b->counter = 0;
    148.       else if (!BN_BLINDING_update(b, ctx))
                         ^
    149.           return 0;
    150.   

crypto/bn/bn_blind.c:93:1: Parameter `ctx->stack.depth`
      91.   }
      92.   
      93. > int BN_BLINDING_update(BN_BLINDING *b, BN_CTX *ctx)
      94.   {
      95.       int ret = 0;

crypto/bn/bn_blind.c:116:18: Call
      114.                   goto err;
      115.           } else {
      116.               if (!BN_mod_mul(b->Ai, b->Ai, b->Ai, b->mod, ctx)
                              ^
      117.                   || !BN_mod_mul(b->A, b->A, b->A, b->mod, ctx))
      118.                   goto err;

crypto/bn/bn_mod.c:203:5: Call
        201.       bn_check_top(m);
        202.   
        203.       BN_CTX_start(ctx);
                   ^
        204.       if ((t = BN_CTX_get(ctx)) == NULL)
        205.           goto err;

crypto/bn/bn_ctx.c:171:1: Parameter `*ctx->stack.indexes`
          169.   }
          170.   
          171. > void BN_CTX_start(BN_CTX *ctx)
          172.   {
          173.       CTXDBG("ENTER BN_CTX_start()", ctx);

crypto/bn/bn_mod.c:218:5: Call
        216.       ret = 1;
        217.    err:
        218.       BN_CTX_end(ctx);
                   ^
        219.       return ret;
        220.   }

crypto/bn/bn_ctx.c:185:1: Parameter `*ctx->stack.indexes`
          183.   }
          184.   
          185. > void BN_CTX_end(BN_CTX *ctx)
          186.   {
          187.       if (ctx == NULL)

crypto/bn/bn_ctx.c:193:27: Call
          191.           ctx->err_stack--;
          192.       else {
          193.           unsigned int fp = BN_STACK_pop(&ctx->stack);
                                           ^
          194.           /* Does this stack frame have anything to release? */
          195.           if (fp < ctx->used)

crypto/bn/bn_ctx.c:268:1: <Offset trace>
266.   }
267.   
268. > static unsigned int BN_STACK_pop(BN_STACK *st)
269.   {
270.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:268:1: Parameter `st->depth`
            266.   }
            267.   
            268. > static unsigned int BN_STACK_pop(BN_STACK *st)
            269.   {
            270.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:268:1: <Length trace>
266.   }
267.   
268. > static unsigned int BN_STACK_pop(BN_STACK *st)
269.   {
270.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:268:1: Parameter `*st->indexes`
            266.   }
            267.   
            268. > static unsigned int BN_STACK_pop(BN_STACK *st)
            269.   {
            270.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:270:12: Array access: Offset: [-1, +oo] Size: [1, +oo] by call to `rsa_blinding_convert` 
            268.   static unsigned int BN_STACK_pop(BN_STACK *st)
            269.   {
            270.       return st->indexes[--(st->depth)];
                              ^
            271.   }
            272.   

static unsigned int BN_STACK_pop(BN_STACK *st)
{
    return st->indexes[--(st->depth)];
}
['static int rsa_ossl_private_decrypt(int flen, const unsigned char *from,\n                                   unsigned char *to, RSA *rsa, int padding)\n{\n    BIGNUM *f, *ret;\n    int j, num = 0, r = -1;\n    unsigned char *buf = NULL;\n    BN_CTX *ctx = NULL;\n    int local_blinding = 0;\n    BIGNUM *unblind = NULL;\n    BN_BLINDING *blinding = NULL;\n    if ((ctx = BN_CTX_new()) == NULL)\n        goto err;\n    BN_CTX_start(ctx);\n    f = BN_CTX_get(ctx);\n    ret = BN_CTX_get(ctx);\n    num = BN_num_bytes(rsa->n);\n    buf = OPENSSL_malloc(num);\n    if (ret == NULL || buf == NULL) {\n        RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    if (flen > num) {\n        RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT,\n               RSA_R_DATA_GREATER_THAN_MOD_LEN);\n        goto err;\n    }\n    if (BN_bin2bn(from, (int)flen, f) == NULL)\n        goto err;\n    if (BN_ucmp(f, rsa->n) >= 0) {\n        RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT,\n               RSA_R_DATA_TOO_LARGE_FOR_MODULUS);\n        goto err;\n    }\n    if (!(rsa->flags & RSA_FLAG_NO_BLINDING)) {\n        blinding = rsa_get_blinding(rsa, &local_blinding, ctx);\n        if (blinding == NULL) {\n            RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT, ERR_R_INTERNAL_ERROR);\n            goto err;\n        }\n    }\n    if (blinding != NULL) {\n        if (!local_blinding && ((unblind = BN_CTX_get(ctx)) == NULL)) {\n            RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT, ERR_R_MALLOC_FAILURE);\n            goto err;\n        }\n        if (!rsa_blinding_convert(blinding, f, unblind, ctx))\n            goto err;\n    }\n    if ((rsa->flags & RSA_FLAG_EXT_PKEY) ||\n        (rsa->version == RSA_ASN1_VERSION_MULTI) ||\n        ((rsa->p != NULL) &&\n         (rsa->q != NULL) &&\n         (rsa->dmp1 != NULL) && (rsa->dmq1 != NULL) && (rsa->iqmp != NULL))) {\n        if (!rsa->meth->rsa_mod_exp(ret, f, rsa, ctx))\n            goto err;\n    } else {\n        BIGNUM *d = BN_new();\n        if (d == NULL) {\n            RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT, ERR_R_MALLOC_FAILURE);\n            goto err;\n        }\n        BN_with_flags(d, rsa->d, BN_FLG_CONSTTIME);\n        if (rsa->flags & RSA_FLAG_CACHE_PUBLIC)\n            if (!BN_MONT_CTX_set_locked(&rsa->_method_mod_n, rsa->lock,\n                                        rsa->n, ctx)) {\n                BN_free(d);\n                goto err;\n            }\n        if (!rsa->meth->bn_mod_exp(ret, f, d, rsa->n, ctx,\n                                   rsa->_method_mod_n)) {\n            BN_free(d);\n            goto err;\n        }\n        BN_free(d);\n    }\n    if (blinding)\n        if (!rsa_blinding_invert(blinding, ret, unblind, ctx))\n            goto err;\n    j = BN_bn2binpad(ret, buf, num);\n    switch (padding) {\n    case RSA_PKCS1_PADDING:\n        r = RSA_padding_check_PKCS1_type_2(to, num, buf, j, num);\n        break;\n    case RSA_PKCS1_OAEP_PADDING:\n        r = RSA_padding_check_PKCS1_OAEP(to, num, buf, j, num, NULL, 0);\n        break;\n    case RSA_SSLV23_PADDING:\n        r = RSA_padding_check_SSLv23(to, num, buf, j, num);\n        break;\n    case RSA_NO_PADDING:\n        memcpy(to, buf, (r = j));\n        break;\n    default:\n        RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT, RSA_R_UNKNOWN_PADDING_TYPE);\n        goto err;\n    }\n    RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT, RSA_R_PADDING_CHECK_FAILED);\n    err_clear_last_constant_time(r >= 0);\n err:\n    BN_CTX_end(ctx);\n    BN_CTX_free(ctx);\n    OPENSSL_clear_free(buf, num);\n    return r;\n}', 'void BN_CTX_start(BN_CTX *ctx)\n{\n    CTXDBG("ENTER BN_CTX_start()", ctx);\n    if (ctx->err_stack || ctx->too_many)\n        ctx->err_stack++;\n    else if (!BN_STACK_push(&ctx->stack, ctx->used)) {\n        BNerr(BN_F_BN_CTX_START, BN_R_TOO_MANY_TEMPORARY_VARIABLES);\n        ctx->err_stack++;\n    }\n    CTXDBG("LEAVE BN_CTX_start()", ctx);\n}', 'static int rsa_blinding_convert(BN_BLINDING *b, BIGNUM *f, BIGNUM *unblind,\n                                BN_CTX *ctx)\n{\n    if (unblind == NULL) {\n        return BN_BLINDING_convert_ex(f, NULL, b, ctx);\n    } else {\n        int ret;\n        BN_BLINDING_lock(b);\n        ret = BN_BLINDING_convert_ex(f, unblind, b, ctx);\n        BN_BLINDING_unlock(b);\n        return ret;\n    }\n}', 'int BN_BLINDING_convert_ex(BIGNUM *n, BIGNUM *r, BN_BLINDING *b, BN_CTX *ctx)\n{\n    int ret = 1;\n    bn_check_top(n);\n    if ((b->A == NULL) || (b->Ai == NULL)) {\n        BNerr(BN_F_BN_BLINDING_CONVERT_EX, BN_R_NOT_INITIALIZED);\n        return 0;\n    }\n    if (b->counter == -1)\n        b->counter = 0;\n    else if (!BN_BLINDING_update(b, ctx))\n        return 0;\n    if (r != NULL && (BN_copy(r, b->Ai) == NULL))\n        return 0;\n    if (b->m_ctx != NULL)\n        ret = BN_mod_mul_montgomery(n, n, b->A, b->m_ctx, ctx);\n    else\n        ret = BN_mod_mul(n, n, b->A, b->mod, ctx);\n    return ret;\n}', 'int BN_BLINDING_update(BN_BLINDING *b, BN_CTX *ctx)\n{\n    int ret = 0;\n    if ((b->A == NULL) || (b->Ai == NULL)) {\n        BNerr(BN_F_BN_BLINDING_UPDATE, BN_R_NOT_INITIALIZED);\n        goto err;\n    }\n    if (b->counter == -1)\n        b->counter = 0;\n    if (++b->counter == BN_BLINDING_COUNTER && b->e != NULL &&\n        !(b->flags & BN_BLINDING_NO_RECREATE)) {\n        if (!BN_BLINDING_create_param(b, NULL, NULL, ctx, NULL, NULL))\n            goto err;\n    } else if (!(b->flags & BN_BLINDING_NO_UPDATE)) {\n        if (b->m_ctx != NULL) {\n            if (!bn_mul_mont_fixed_top(b->Ai, b->Ai, b->Ai, b->m_ctx, ctx)\n                || !bn_mul_mont_fixed_top(b->A, b->A, b->A, b->m_ctx, ctx))\n                goto err;\n        } else {\n            if (!BN_mod_mul(b->Ai, b->Ai, b->Ai, b->mod, ctx)\n                || !BN_mod_mul(b->A, b->A, b->A, b->mod, ctx))\n                goto err;\n        }\n    }\n    ret = 1;\n err:\n    if (b->counter == BN_BLINDING_COUNTER)\n        b->counter = 0;\n    return ret;\n}', 'int BN_mod_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *m,\n               BN_CTX *ctx)\n{\n    BIGNUM *t;\n    int ret = 0;\n    bn_check_top(a);\n    bn_check_top(b);\n    bn_check_top(m);\n    BN_CTX_start(ctx);\n    if ((t = BN_CTX_get(ctx)) == NULL)\n        goto err;\n    if (a == b) {\n        if (!BN_sqr(t, a, ctx))\n            goto err;\n    } else {\n        if (!BN_mul(t, a, b, ctx))\n            goto err;\n    }\n    if (!BN_nnmod(r, t, m, ctx))\n        goto err;\n    bn_check_top(r);\n    ret = 1;\n err:\n    BN_CTX_end(ctx);\n    return ret;\n}', 'void BN_CTX_end(BN_CTX *ctx)\n{\n    if (ctx == NULL)\n        return;\n    CTXDBG("ENTER BN_CTX_end()", ctx);\n    if (ctx->err_stack)\n        ctx->err_stack--;\n    else {\n        unsigned int fp = BN_STACK_pop(&ctx->stack);\n        if (fp < ctx->used)\n            BN_POOL_release(&ctx->pool, ctx->used - fp);\n        ctx->used = fp;\n        ctx->too_many = 0;\n    }\n    CTXDBG("LEAVE BN_CTX_end()", ctx);\n}', 'static unsigned int BN_STACK_pop(BN_STACK *st)\n{\n    return st->indexes[--(st->depth)];\n}']