crypto/dsa/dsa_ameth.c:183: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_mod_exp`.
Showing all 19 steps of the trace


crypto/dsa/dsa_ameth.c:168:13: Call
166.       /* We have parameters now set private key */
167.       if ((dsa->priv_key = BN_secure_new()) == NULL
168.           || !ASN1_INTEGER_to_BN(privkey, dsa->priv_key)) {
                   ^
169.           DSAerr(DSA_F_DSA_PRIV_DECODE, DSA_R_BN_ERROR);
170.           goto dsaerr;

crypto/asn1/a_int.c:559:12: Call
  557.   BIGNUM *ASN1_INTEGER_to_BN(const ASN1_INTEGER *ai, BIGNUM *bn)
  558.   {
  559.       return asn1_string_to_bn(ai, bn, V_ASN1_INTEGER);
                    ^
  560.   }
  561.   

crypto/asn1/a_int.c:493:1: Parameter `bn->d`
    491.   }
    492.   
    493. > static BIGNUM *asn1_string_to_bn(const ASN1_INTEGER *ai, BIGNUM *bn,
    494.                                    int itype)
    495.   {

crypto/dsa/dsa_ameth.c:183:10: Call
181.   
182.       BN_set_flags(dsa->priv_key, BN_FLG_CONSTTIME);
183.       if (!BN_mod_exp(dsa->pub_key, dsa->g, dsa->priv_key, dsa->p, ctx)) {
                ^
184.           DSAerr(DSA_F_DSA_PRIV_DECODE, DSA_R_BN_ERROR);
185.           goto dsaerr;

crypto/bn/bn_exp.c:89:1: Parameter `*r->d`
  87.   }
  88.   
  89. > int BN_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, const BIGNUM *m,
  90.                  BN_CTX *ctx)
  91.   {

crypto/bn/bn_exp.c:141:19: Call
  139.               && (BN_get_flags(m, BN_FLG_CONSTTIME) == 0)) {
  140.               BN_ULONG A = a->d[0];
  141.               ret = BN_mod_exp_mont_word(r, A, p, m, ctx, NULL);
                           ^
  142.           } else
  143.   # endif

crypto/bn/bn_exp.c:1127:1: Parameter `*rr->d`
    1125.   }
    1126.   
    1127. > int BN_mod_exp_mont_word(BIGNUM *rr, BN_ULONG a, const BIGNUM *p,
    1128.                            const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *in_mont)
    1129.   {

crypto/bn/bn_exp.c:1175:13: Call
    1173.           if (BN_abs_is_word(m, 1)) {
    1174.               ret = 1;
    1175.               BN_zero(rr);
                        ^
    1176.           } else {
    1177.               ret = BN_one(rr);

crypto/bn/bn_lib.c:358:1: Parameter `*a->d`
      356.   }
      357.   
      358. > int BN_set_word(BIGNUM *a, BN_ULONG w)
      359.   {
      360.       bn_check_top(a);

crypto/bn/bn_lib.c:361:9: Call
      359.   {
      360.       bn_check_top(a);
      361.       if (bn_expand(a, (int)sizeof(BN_ULONG) * 8) == NULL)
                     ^
      362.           return 0;
      363.       a->neg = 0;

crypto/bn/bn_lcl.h:660:1: Parameter `*a->d`
        658.                            const BIGNUM *add, const BIGNUM *rem, BN_CTX *ctx);
        659.   
        660. > static ossl_inline BIGNUM *bn_expand(BIGNUM *a, int bits)
        661.   {
        662.       if (bits > (INT_MAX - BN_BITS2 + 1))

crypto/bn/bn_lcl.h:668:12: Call
        666.           return a;
        667.   
        668.       return bn_expand2((a),(bits+BN_BITS2-1)/BN_BITS2);
                          ^
        669.   }
        670.   

crypto/bn/bn_lib.c:244:1: Parameter `*b->d`
          242.    */
          243.   
          244. > BIGNUM *bn_expand2(BIGNUM *b, int words)
          245.   {
          246.       if (words > b->dmax) {

crypto/bn/bn_lib.c:247:23: Call
          245.   {
          246.       if (words > b->dmax) {
          247.           BN_ULONG *a = bn_expand_internal(b, words);
                                       ^
          248.           if (!a)
          249.               return NULL;

crypto/bn/bn_lib.c:208:1: <Offset trace>
206.   /* This is used by bn_expand2() */
207.   /* The caller MUST check that words > b->dmax before calling this */
208. > static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
209.   {
210.       BN_ULONG *a = NULL;

crypto/bn/bn_lib.c:208:1: Parameter `b->top`
            206.   /* This is used by bn_expand2() */
            207.   /* The caller MUST check that words > b->dmax before calling this */
            208. > static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
            209.   {
            210.       BN_ULONG *a = NULL;

crypto/bn/bn_lib.c:208:1: <Length trace>
206.   /* This is used by bn_expand2() */
207.   /* The caller MUST check that words > b->dmax before calling this */
208. > static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
209.   {
210.       BN_ULONG *a = NULL;

crypto/bn/bn_lib.c:208:1: Parameter `*b->d`
            206.   /* This is used by bn_expand2() */
            207.   /* The caller MUST check that words > b->dmax before calling this */
            208. > static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
            209.   {
            210.       BN_ULONG *a = NULL;

crypto/bn/bn_lib.c:231:9: Array access: Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_mod_exp` 
            229.       assert(b->top <= words);
            230.       if (b->top > 0)
            231.           memcpy(a, b->d, sizeof(*a) * b->top);
                           ^
            232.   
            233.       return a;

static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
{
    BN_ULONG *a = NULL;
    if (words > (INT_MAX / (4 * BN_BITS2))) {
        BNerr(BN_F_BN_EXPAND_INTERNAL, BN_R_BIGNUM_TOO_LONG);
        return NULL;
    }
    if (BN_get_flags(b, BN_FLG_STATIC_DATA)) {
        BNerr(BN_F_BN_EXPAND_INTERNAL, BN_R_EXPAND_ON_STATIC_BIGNUM_DATA);
        return NULL;
    }
    if (BN_get_flags(b, BN_FLG_SECURE))
        a = OPENSSL_secure_zalloc(words * sizeof(*a));
    else
        a = OPENSSL_zalloc(words * sizeof(*a));
    if (a == NULL) {
        BNerr(BN_F_BN_EXPAND_INTERNAL, ERR_R_MALLOC_FAILURE);
        return NULL;
    }
    assert(b->top <= words);
    if (b->top > 0)
        memcpy(a, b->d, sizeof(*a) * b->top);
    return a;
}
['static int dsa_priv_decode(EVP_PKEY *pkey, const PKCS8_PRIV_KEY_INFO *p8)\n{\n    const unsigned char *p, *pm;\n    int pklen, pmlen;\n    int ptype;\n    const void *pval;\n    const ASN1_STRING *pstr;\n    const X509_ALGOR *palg;\n    ASN1_INTEGER *privkey = NULL;\n    BN_CTX *ctx = NULL;\n    DSA *dsa = NULL;\n    int ret = 0;\n    if (!PKCS8_pkey_get0(NULL, &p, &pklen, &palg, p8))\n        return 0;\n    X509_ALGOR_get0(NULL, &ptype, &pval, palg);\n    if ((privkey = d2i_ASN1_INTEGER(NULL, &p, pklen)) == NULL)\n        goto decerr;\n    if (privkey->type == V_ASN1_NEG_INTEGER || ptype != V_ASN1_SEQUENCE)\n        goto decerr;\n    pstr = pval;\n    pm = pstr->data;\n    pmlen = pstr->length;\n    if ((dsa = d2i_DSAparams(NULL, &pm, pmlen)) == NULL)\n        goto decerr;\n    if ((dsa->priv_key = BN_secure_new()) == NULL\n        || !ASN1_INTEGER_to_BN(privkey, dsa->priv_key)) {\n        DSAerr(DSA_F_DSA_PRIV_DECODE, DSA_R_BN_ERROR);\n        goto dsaerr;\n    }\n    if ((dsa->pub_key = BN_new()) == NULL) {\n        DSAerr(DSA_F_DSA_PRIV_DECODE, ERR_R_MALLOC_FAILURE);\n        goto dsaerr;\n    }\n    if ((ctx = BN_CTX_new()) == NULL) {\n        DSAerr(DSA_F_DSA_PRIV_DECODE, ERR_R_MALLOC_FAILURE);\n        goto dsaerr;\n    }\n    BN_set_flags(dsa->priv_key, BN_FLG_CONSTTIME);\n    if (!BN_mod_exp(dsa->pub_key, dsa->g, dsa->priv_key, dsa->p, ctx)) {\n        DSAerr(DSA_F_DSA_PRIV_DECODE, DSA_R_BN_ERROR);\n        goto dsaerr;\n    }\n    EVP_PKEY_assign_DSA(pkey, dsa);\n    ret = 1;\n    goto done;\n decerr:\n    DSAerr(DSA_F_DSA_PRIV_DECODE, DSA_R_DECODE_ERROR);\n dsaerr:\n    DSA_free(dsa);\n done:\n    BN_CTX_free(ctx);\n    ASN1_STRING_clear_free(privkey);\n    return ret;\n}', 'BIGNUM *ASN1_INTEGER_to_BN(const ASN1_INTEGER *ai, BIGNUM *bn)\n{\n    return asn1_string_to_bn(ai, bn, V_ASN1_INTEGER);\n}', 'static BIGNUM *asn1_string_to_bn(const ASN1_INTEGER *ai, BIGNUM *bn,\n                                 int itype)\n{\n    BIGNUM *ret;\n    if ((ai->type & ~V_ASN1_NEG) != itype) {\n        ASN1err(ASN1_F_ASN1_STRING_TO_BN, ASN1_R_WRONG_INTEGER_TYPE);\n        return NULL;\n    }\n    ret = BN_bin2bn(ai->data, ai->length, bn);\n    if (ret == NULL) {\n        ASN1err(ASN1_F_ASN1_STRING_TO_BN, ASN1_R_BN_LIB);\n        return NULL;\n    }\n    if (ai->type & V_ASN1_NEG)\n        BN_set_negative(ret, 1);\n    return ret;\n}', 'int BN_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, const BIGNUM *m,\n               BN_CTX *ctx)\n{\n    int ret;\n    bn_check_top(a);\n    bn_check_top(p);\n    bn_check_top(m);\n#define MONT_MUL_MOD\n#define MONT_EXP_WORD\n#define RECP_MUL_MOD\n#ifdef MONT_MUL_MOD\n    if (BN_is_odd(m)) {\n# ifdef MONT_EXP_WORD\n        if (a->top == 1 && !a->neg\n            && (BN_get_flags(p, BN_FLG_CONSTTIME) == 0)\n            && (BN_get_flags(a, BN_FLG_CONSTTIME) == 0)\n            && (BN_get_flags(m, BN_FLG_CONSTTIME) == 0)) {\n            BN_ULONG A = a->d[0];\n            ret = BN_mod_exp_mont_word(r, A, p, m, ctx, NULL);\n        } else\n# endif\n            ret = BN_mod_exp_mont(r, a, p, m, ctx, NULL);\n    } else\n#endif\n#ifdef RECP_MUL_MOD\n    {\n        ret = BN_mod_exp_recp(r, a, p, m, ctx);\n    }\n#else\n    {\n        ret = BN_mod_exp_simple(r, a, p, m, ctx);\n    }\n#endif\n    bn_check_top(r);\n    return ret;\n}', 'int BN_mod_exp_mont_word(BIGNUM *rr, BN_ULONG a, const BIGNUM *p,\n                         const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *in_mont)\n{\n    BN_MONT_CTX *mont = NULL;\n    int b, bits, ret = 0;\n    int r_is_one;\n    BN_ULONG w, next_w;\n    BIGNUM *r, *t;\n    BIGNUM *swap_tmp;\n#define BN_MOD_MUL_WORD(r, w, m) \\\n                (BN_mul_word(r, (w)) && \\\n                (   \\\n                        (BN_mod(t, r, m, ctx) && (swap_tmp = r, r = t, t = swap_tmp, 1))))\n#define BN_TO_MONTGOMERY_WORD(r, w, mont) \\\n                (BN_set_word(r, (w)) && BN_to_montgomery(r, r, (mont), ctx))\n    if (BN_get_flags(p, BN_FLG_CONSTTIME) != 0\n            || BN_get_flags(m, BN_FLG_CONSTTIME) != 0) {\n        BNerr(BN_F_BN_MOD_EXP_MONT_WORD, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);\n        return 0;\n    }\n    bn_check_top(p);\n    bn_check_top(m);\n    if (!BN_is_odd(m)) {\n        BNerr(BN_F_BN_MOD_EXP_MONT_WORD, BN_R_CALLED_WITH_EVEN_MODULUS);\n        return 0;\n    }\n    if (m->top == 1)\n        a %= m->d[0];\n    bits = BN_num_bits(p);\n    if (bits == 0) {\n        if (BN_abs_is_word(m, 1)) {\n            ret = 1;\n            BN_zero(rr);\n        } else {\n            ret = BN_one(rr);\n        }\n        return ret;\n    }\n    if (a == 0) {\n        BN_zero(rr);\n        ret = 1;\n        return ret;\n    }\n    BN_CTX_start(ctx);\n    r = BN_CTX_get(ctx);\n    t = BN_CTX_get(ctx);\n    if (t == NULL)\n        goto err;\n    if (in_mont != NULL)\n        mont = in_mont;\n    else {\n        if ((mont = BN_MONT_CTX_new()) == NULL)\n            goto err;\n        if (!BN_MONT_CTX_set(mont, m, ctx))\n            goto err;\n    }\n    r_is_one = 1;\n    w = a;\n    for (b = bits - 2; b >= 0; b--) {\n        next_w = w * w;\n        if ((next_w / w) != w) {\n            if (r_is_one) {\n                if (!BN_TO_MONTGOMERY_WORD(r, w, mont))\n                    goto err;\n                r_is_one = 0;\n            } else {\n                if (!BN_MOD_MUL_WORD(r, w, m))\n                    goto err;\n            }\n            next_w = 1;\n        }\n        w = next_w;\n        if (!r_is_one) {\n            if (!BN_mod_mul_montgomery(r, r, r, mont, ctx))\n                goto err;\n        }\n        if (BN_is_bit_set(p, b)) {\n            next_w = w * a;\n            if ((next_w / a) != w) {\n                if (r_is_one) {\n                    if (!BN_TO_MONTGOMERY_WORD(r, w, mont))\n                        goto err;\n                    r_is_one = 0;\n                } else {\n                    if (!BN_MOD_MUL_WORD(r, w, m))\n                        goto err;\n                }\n                next_w = a;\n            }\n            w = next_w;\n        }\n    }\n    if (w != 1) {\n        if (r_is_one) {\n            if (!BN_TO_MONTGOMERY_WORD(r, w, mont))\n                goto err;\n            r_is_one = 0;\n        } else {\n            if (!BN_MOD_MUL_WORD(r, w, m))\n                goto err;\n        }\n    }\n    if (r_is_one) {\n        if (!BN_one(rr))\n            goto err;\n    } else {\n        if (!BN_from_montgomery(rr, r, mont, ctx))\n            goto err;\n    }\n    ret = 1;\n err:\n    if (in_mont == NULL)\n        BN_MONT_CTX_free(mont);\n    BN_CTX_end(ctx);\n    bn_check_top(rr);\n    return ret;\n}', 'int BN_set_word(BIGNUM *a, BN_ULONG w)\n{\n    bn_check_top(a);\n    if (bn_expand(a, (int)sizeof(BN_ULONG) * 8) == NULL)\n        return 0;\n    a->neg = 0;\n    a->d[0] = w;\n    a->top = (w ? 1 : 0);\n    a->flags &= ~BN_FLG_FIXED_TOP;\n    bn_check_top(a);\n    return 1;\n}', 'static ossl_inline BIGNUM *bn_expand(BIGNUM *a, int bits)\n{\n    if (bits > (INT_MAX - BN_BITS2 + 1))\n        return NULL;\n    if (((bits+BN_BITS2-1)/BN_BITS2) <= (a)->dmax)\n        return a;\n    return bn_expand2((a),(bits+BN_BITS2-1)/BN_BITS2);\n}', 'BIGNUM *bn_expand2(BIGNUM *b, int words)\n{\n    if (words > b->dmax) {\n        BN_ULONG *a = bn_expand_internal(b, words);\n        if (!a)\n            return NULL;\n        if (b->d) {\n            OPENSSL_cleanse(b->d, b->dmax * sizeof(b->d[0]));\n            bn_free_d(b);\n        }\n        b->d = a;\n        b->dmax = words;\n    }\n    return b;\n}', 'static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)\n{\n    BN_ULONG *a = NULL;\n    if (words > (INT_MAX / (4 * BN_BITS2))) {\n        BNerr(BN_F_BN_EXPAND_INTERNAL, BN_R_BIGNUM_TOO_LONG);\n        return NULL;\n    }\n    if (BN_get_flags(b, BN_FLG_STATIC_DATA)) {\n        BNerr(BN_F_BN_EXPAND_INTERNAL, BN_R_EXPAND_ON_STATIC_BIGNUM_DATA);\n        return NULL;\n    }\n    if (BN_get_flags(b, BN_FLG_SECURE))\n        a = OPENSSL_secure_zalloc(words * sizeof(*a));\n    else\n        a = OPENSSL_zalloc(words * sizeof(*a));\n    if (a == NULL) {\n        BNerr(BN_F_BN_EXPAND_INTERNAL, ERR_R_MALLOC_FAILURE);\n        return NULL;\n    }\n    assert(b->top <= words);\n    if (b->top > 0)\n        memcpy(a, b->d, sizeof(*a) * b->top);\n    return a;\n}']