crypto/pkcs12/p12_key.c:194: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned64 by call to `BN_bn2bin`.
Showing all 16 steps of the trace


crypto/pkcs12/p12_key.c:182:4: Call
180.   		BN_add_word (Bpl1, 1);
181.   		for (j = 0; j < Ilen ; j+=v) {
182.   			BN_bin2bn (I + j, v, Ij);
          ^
183.   			BN_add (Ij, Ij, Bpl1);
184.   			BN_bn2bin (Ij, B);

crypto/bn/bn_lib.c:597:1: Parameter `ret->top`
  595.   	}
  596.   
  597. > BIGNUM *BN_bin2bn(const unsigned char *s, size_t len, BIGNUM *ret)
  598.   	{
  599.   	unsigned int i,m;

crypto/pkcs12/p12_key.c:183:4: Call
181.   		for (j = 0; j < Ilen ; j+=v) {
182.   			BN_bin2bn (I + j, v, Ij);
183.   			BN_add (Ij, Ij, Bpl1);
          ^
184.   			BN_bn2bin (Ij, B);
185.   			Ijlen = BN_num_bytes (Ij);

crypto/bn/bn_add.c:64:1: Parameter `a->top`
  62.   
  63.   /* r can == a or b */
  64. > int BN_add(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
  65.   	{
  66.   	const BIGNUM *tmp;

crypto/pkcs12/p12_key.c:184:4: Call
182.   			BN_bin2bn (I + j, v, Ij);
183.   			BN_add (Ij, Ij, Bpl1);
184.   			BN_bn2bin (Ij, B);
          ^
185.   			Ijlen = BN_num_bytes (Ij);
186.   			/* If more than 2^(v*8) - 1 cut off MSB */

crypto/bn/bn_lib.c:641:1: Parameter `a->top`
  639.   
  640.   /* ignore negative */
  641. > int BN_bn2bin(const BIGNUM *a, unsigned char *to)
  642.   	{
  643.   	int n,i;

crypto/bn/bn_lib.c:647:6: Call
  645.   
  646.   	bn_check_top(a);
  647.   	n=i=BN_num_bytes(a);
              ^
  648.   	while (i--)
  649.   		{

crypto/bn/bn_lib.c:248:1: Parameter `a->top`
    246.   	}
    247.   
    248. > int BN_num_bits(const BIGNUM *a)
    249.   	{
    250.   	int i = a->top - 1;

crypto/pkcs12/p12_key.c:185:12: Call
183.   			BN_add (Ij, Ij, Bpl1);
184.   			BN_bn2bin (Ij, B);
185.   			Ijlen = BN_num_bytes (Ij);
                  ^
186.   			/* If more than 2^(v*8) - 1 cut off MSB */
187.   			if (Ijlen > v) {

crypto/bn/bn_lib.c:248:1: Parameter `a->top`
  246.   	}
  247.   
  248. > int BN_num_bits(const BIGNUM *a)
  249.   	{
  250.   	int i = a->top - 1;

crypto/pkcs12/p12_key.c:194:5: Call
192.   			} else if (Ijlen < v) {
193.   				memset(I + j, 0, v - Ijlen);
194.   				BN_bn2bin(Ij, I + j + v - Ijlen); 
           ^
195.   #endif
196.   			} else BN_bn2bin (Ij, I + j);

crypto/bn/bn_lib.c:641:1: Parameter `a->top`
  639.   
  640.   /* ignore negative */
  641. > int BN_bn2bin(const BIGNUM *a, unsigned char *to)
  642.   	{
  643.   	int n,i;

crypto/bn/bn_lib.c:647:6: Call
  645.   
  646.   	bn_check_top(a);
  647.   	n=i=BN_num_bytes(a);
              ^
  648.   	while (i--)
  649.   		{

crypto/bn/bn_lib.c:248:1: <LHS trace>
246.   	}
247.   
248. > int BN_num_bits(const BIGNUM *a)
249.   	{
250.   	int i = a->top - 1;

crypto/bn/bn_lib.c:248:1: Parameter `a->top`
    246.   	}
    247.   
    248. > int BN_num_bits(const BIGNUM *a)
    249.   	{
    250.   	int i = a->top - 1;

crypto/bn/bn_lib.c:250:2: Binary operation: ([0, +oo] - 1):unsigned64 by call to `BN_bn2bin` 
    248.   int BN_num_bits(const BIGNUM *a)
    249.   	{
    250.   	int i = a->top - 1;
            ^
    251.   	bn_check_top(a);
    252.   

int BN_num_bits(const BIGNUM *a)
	{
	int i = a->top - 1;
	bn_check_top(a);
	if (BN_is_zero(a)) return 0;
	return ((i*BN_BITS2) + BN_num_bits_word(a->d[i]));
	}
['int PKCS12_key_gen_uni(unsigned char *pass, int passlen, unsigned char *salt,\n\t     int saltlen, int id, int iter, int n, unsigned char *out,\n\t     const EVP_MD *md_type)\n{\n\tunsigned char *B, *D, *I, *p, *Ai;\n\tint Slen, Plen, Ilen, Ijlen;\n\tint i, j, u, v;\n\tBIGNUM *Ij, *Bpl1;\n\tEVP_MD_CTX ctx;\n#ifdef  DEBUG_KEYGEN\n\tunsigned char *tmpout = out;\n\tint tmpn = n;\n#endif\n#if 0\n\tif (!pass) {\n\t\tPKCS12err(PKCS12_F_PKCS12_KEY_GEN_UNI,ERR_R_PASSED_NULL_PARAMETER);\n\t\treturn 0;\n\t}\n#endif\n\tEVP_MD_CTX_init(&ctx);\n#ifdef  DEBUG_KEYGEN\n\tfprintf(stderr, "KEYGEN DEBUG\\n");\n\tfprintf(stderr, "ID %d, ITER %d\\n", id, iter);\n\tfprintf(stderr, "Password (length %d):\\n", passlen);\n\th__dump(pass, passlen);\n\tfprintf(stderr, "Salt (length %d):\\n", saltlen);\n\th__dump(salt, saltlen);\n#endif\n\tv = EVP_MD_block_size (md_type);\n\tu = EVP_MD_size (md_type);\n\tD = OPENSSL_malloc (v);\n\tAi = OPENSSL_malloc (u);\n\tB = OPENSSL_malloc (v + 1);\n\tSlen = v * ((saltlen+v-1)/v);\n\tif(passlen) Plen = v * ((passlen+v-1)/v);\n\telse Plen = 0;\n\tIlen = Slen + Plen;\n\tI = OPENSSL_malloc (Ilen);\n\tIj = BN_new();\n\tBpl1 = BN_new();\n\tif (!D || !Ai || !B || !I || !Ij || !Bpl1) {\n\t\tPKCS12err(PKCS12_F_PKCS12_KEY_GEN_UNI,ERR_R_MALLOC_FAILURE);\n\t\treturn 0;\n\t}\n\tfor (i = 0; i < v; i++) D[i] = id;\n\tp = I;\n\tfor (i = 0; i < Slen; i++) *p++ = salt[i % saltlen];\n\tfor (i = 0; i < Plen; i++) *p++ = pass[i % passlen];\n\tfor (;;) {\n\t\tEVP_DigestInit_ex(&ctx, md_type, NULL);\n\t\tEVP_DigestUpdate(&ctx, D, v);\n\t\tEVP_DigestUpdate(&ctx, I, Ilen);\n\t\tEVP_DigestFinal_ex(&ctx, Ai, NULL);\n\t\tfor (j = 1; j < iter; j++) {\n\t\t\tEVP_DigestInit_ex(&ctx, md_type, NULL);\n\t\t\tEVP_DigestUpdate(&ctx, Ai, u);\n\t\t\tEVP_DigestFinal_ex(&ctx, Ai, NULL);\n\t\t}\n\t\tmemcpy (out, Ai, min (n, u));\n\t\tif (u >= n) {\n\t\t\tOPENSSL_free (Ai);\n\t\t\tOPENSSL_free (B);\n\t\t\tOPENSSL_free (D);\n\t\t\tOPENSSL_free (I);\n\t\t\tBN_free (Ij);\n\t\t\tBN_free (Bpl1);\n\t\t\tEVP_MD_CTX_cleanup(&ctx);\n#ifdef DEBUG_KEYGEN\n\t\t\tfprintf(stderr, "Output KEY (length %d)\\n", tmpn);\n\t\t\th__dump(tmpout, tmpn);\n#endif\n\t\t\treturn 1;\n\t\t}\n\t\tn -= u;\n\t\tout += u;\n\t\tfor (j = 0; j < v; j++) B[j] = Ai[j % u];\n\t\tBN_bin2bn (B, v, Bpl1);\n\t\tBN_add_word (Bpl1, 1);\n\t\tfor (j = 0; j < Ilen ; j+=v) {\n\t\t\tBN_bin2bn (I + j, v, Ij);\n\t\t\tBN_add (Ij, Ij, Bpl1);\n\t\t\tBN_bn2bin (Ij, B);\n\t\t\tIjlen = BN_num_bytes (Ij);\n\t\t\tif (Ijlen > v) {\n\t\t\t\tBN_bn2bin (Ij, B);\n\t\t\t\tmemcpy (I + j, B + 1, v);\n#ifndef PKCS12_BROKEN_KEYGEN\n\t\t\t} else if (Ijlen < v) {\n\t\t\t\tmemset(I + j, 0, v - Ijlen);\n\t\t\t\tBN_bn2bin(Ij, I + j + v - Ijlen);\n#endif\n\t\t\t} else BN_bn2bin (Ij, I + j);\n\t\t}\n\t}\n}', 'BIGNUM *BN_bin2bn(const unsigned char *s, size_t len, BIGNUM *ret)\n\t{\n\tunsigned int i,m;\n\tunsigned int n;\n\tBN_ULONG l;\n\tBIGNUM  *bn = NULL;\n\tif (ret == NULL)\n\t\tret = bn = BN_new();\n\tif (ret == NULL) return(NULL);\n\tbn_check_top(ret);\n\tl=0;\n\tn=len;\n\tif (n == 0)\n\t\t{\n\t\tret->top=0;\n\t\treturn(ret);\n\t\t}\n\ti=((n-1)/BN_BYTES)+1;\n\tm=((n-1)%(BN_BYTES));\n\tif (bn_wexpand(ret, i) == NULL)\n\t\t{\n\t\tif (bn) BN_free(bn);\n\t\treturn NULL;\n\t\t}\n\tret->top=i;\n\tret->neg=0;\n\twhile (n--)\n\t\t{\n\t\tl=(l<<8L)| *(s++);\n\t\tif (m-- == 0)\n\t\t\t{\n\t\t\tret->d[--i]=l;\n\t\t\tl=0;\n\t\t\tm=BN_BYTES-1;\n\t\t\t}\n\t\t}\n\tbn_correct_top(ret);\n\treturn(ret);\n\t}', 'int BN_add(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)\n\t{\n\tconst BIGNUM *tmp;\n\tint a_neg = a->neg, ret;\n\tbn_check_top(a);\n\tbn_check_top(b);\n\tif (a_neg ^ b->neg)\n\t\t{\n\t\tif (a_neg)\n\t\t\t{ tmp=a; a=b; b=tmp; }\n\t\tif (BN_ucmp(a,b) < 0)\n\t\t\t{\n\t\t\tif (!BN_usub(r,b,a)) return(0);\n\t\t\tr->neg=1;\n\t\t\t}\n\t\telse\n\t\t\t{\n\t\t\tif (!BN_usub(r,a,b)) return(0);\n\t\t\tr->neg=0;\n\t\t\t}\n\t\treturn(1);\n\t\t}\n\tret = BN_uadd(r,a,b);\n\tr->neg = a_neg;\n\tbn_check_top(r);\n\treturn ret;\n\t}', 'int BN_bn2bin(const BIGNUM *a, unsigned char *to)\n\t{\n\tint n,i;\n\tBN_ULONG l;\n\tbn_check_top(a);\n\tn=i=BN_num_bytes(a);\n\twhile (i--)\n\t\t{\n\t\tl=a->d[i/BN_BYTES];\n\t\t*(to++)=(unsigned char)(l>>(8*(i%BN_BYTES)))&0xff;\n\t\t}\n\treturn(n);\n\t}', 'int BN_num_bits(const BIGNUM *a)\n\t{\n\tint i = a->top - 1;\n\tbn_check_top(a);\n\tif (BN_is_zero(a)) return 0;\n\treturn ((i*BN_BITS2) + BN_num_bits_word(a->d[i]));\n\t}']