crypto/asn1/a_d2i_fp.c:241: error: INTEGER_OVERFLOW_L2
  ([1, 2147483647] - [1, 2147483647]):unsigned64.
Showing all 7 steps of the trace


crypto/asn1/a_d2i_fp.c:147:5: <LHS trace>
145.       unsigned char *p;
146.       int i;
147.       size_t want = HEADER_SIZE;
           ^
148.       int eos = 0;
149.       size_t off = 0;

crypto/asn1/a_d2i_fp.c:147:5: Assignment
145.       unsigned char *p;
146.       int i;
147.       size_t want = HEADER_SIZE;
           ^
148.       int eos = 0;
149.       size_t off = 0;

crypto/asn1/a_d2i_fp.c:147:5: <RHS trace>
145.       unsigned char *p;
146.       int i;
147.       size_t want = HEADER_SIZE;
           ^
148.       int eos = 0;
149.       size_t off = 0;

crypto/asn1/a_d2i_fp.c:147:5: Assignment
145.       unsigned char *p;
146.       int i;
147.       size_t want = HEADER_SIZE;
           ^
148.       int eos = 0;
149.       size_t off = 0;

crypto/asn1/a_d2i_fp.c:235:36: Assignment
233.                        * in one go.
234.                        */
235.                       size_t chunk = want > chunk_max ? chunk_max : want;
                                          ^
236.   
237.                       if (!BUF_MEM_grow_clean(b, len + chunk)) {

crypto/asn1/a_d2i_fp.c:235:21: Assignment
233.                        * in one go.
234.                        */
235.                       size_t chunk = want > chunk_max ? chunk_max : want;
                           ^
236.   
237.                       if (!BUF_MEM_grow_clean(b, len + chunk)) {

crypto/asn1/a_d2i_fp.c:241:21: Binary operation: ([1, 2147483647] - [1, 2147483647]):unsigned64
239.                           goto err;
240.                       }
241.                       want -= chunk;
                           ^
242.                       while (chunk > 0) {
243.                           i = BIO_read(in, &(b->data[len]), chunk);

static int asn1_d2i_read_bio(BIO *in, BUF_MEM **pb)
{
    BUF_MEM *b;
    unsigned char *p;
    int i;
    size_t want = HEADER_SIZE;
    int eos = 0;
    size_t off = 0;
    size_t len = 0;
    const unsigned char *q;
    long slen;
    int inf, tag, xclass;
    b = BUF_MEM_new();
    if (b == NULL) {
        ASN1err(ASN1_F_ASN1_D2I_READ_BIO, ERR_R_MALLOC_FAILURE);
        return -1;
    }
    ERR_clear_error();
    for (;;) {
        if (want >= (len - off)) {
            want -= (len - off);
            if (len + want < len || !BUF_MEM_grow_clean(b, len + want)) {
                ASN1err(ASN1_F_ASN1_D2I_READ_BIO, ERR_R_MALLOC_FAILURE);
                goto err;
            }
            i = BIO_read(in, &(b->data[len]), want);
            if ((i < 0) && ((len - off) == 0)) {
                ASN1err(ASN1_F_ASN1_D2I_READ_BIO, ASN1_R_NOT_ENOUGH_DATA);
                goto err;
            }
            if (i > 0) {
                if (len + i < len) {
                    ASN1err(ASN1_F_ASN1_D2I_READ_BIO, ASN1_R_TOO_LONG);
                    goto err;
                }
                len += i;
            }
        }
        p = (unsigned char *)&(b->data[off]);
        q = p;
        inf = ASN1_get_object(&q, &slen, &tag, &xclass, len - off);
        if (inf & 0x80) {
            unsigned long e;
            e = ERR_GET_REASON(ERR_peek_error());
            if (e != ASN1_R_TOO_LONG)
                goto err;
            else
                ERR_clear_error();
        }
        i = q - p;
        off += i;
        if (inf & 1) {
            eos++;
            if (eos < 0) {
                ASN1err(ASN1_F_ASN1_D2I_READ_BIO, ASN1_R_HEADER_TOO_LONG);
                goto err;
            }
            want = HEADER_SIZE;
        } else if (eos && (slen == 0) && (tag == V_ASN1_EOC)) {
            eos--;
            if (eos <= 0)
                break;
            else
                want = HEADER_SIZE;
        } else {
            want = slen;
            if (want > (len - off)) {
                size_t chunk_max = ASN1_CHUNK_INITIAL_SIZE;
                want -= (len - off);
                if (want > INT_MAX    ||
                    len + want < len) {
                    ASN1err(ASN1_F_ASN1_D2I_READ_BIO, ASN1_R_TOO_LONG);
                    goto err;
                }
                while (want > 0) {
                    size_t chunk = want > chunk_max ? chunk_max : want;
                    if (!BUF_MEM_grow_clean(b, len + chunk)) {
                        ASN1err(ASN1_F_ASN1_D2I_READ_BIO, ERR_R_MALLOC_FAILURE);
                        goto err;
                    }
                    want -= chunk;
                    while (chunk > 0) {
                        i = BIO_read(in, &(b->data[len]), chunk);
                        if (i <= 0) {
                            ASN1err(ASN1_F_ASN1_D2I_READ_BIO,
                                    ASN1_R_NOT_ENOUGH_DATA);
                            goto err;
                        }
                        len += i;
                        chunk -= i;
                    }
                    if (chunk_max < INT_MAX/2)
                        chunk_max *= 2;
                }
            }
            if (off + slen < off) {
                ASN1err(ASN1_F_ASN1_D2I_READ_BIO, ASN1_R_TOO_LONG);
                goto err;
            }
            off += slen;
            if (eos <= 0) {
                break;
            } else
                want = HEADER_SIZE;
        }
    }
    if (off > INT_MAX) {
        ASN1err(ASN1_F_ASN1_D2I_READ_BIO, ASN1_R_TOO_LONG);
        goto err;
    }
    *pb = b;
    return off;
 err:
    BUF_MEM_free(b);
    return -1;
}
['static int asn1_d2i_read_bio(BIO *in, BUF_MEM **pb)\n{\n    BUF_MEM *b;\n    unsigned char *p;\n    int i;\n    size_t want = HEADER_SIZE;\n    int eos = 0;\n    size_t off = 0;\n    size_t len = 0;\n    const unsigned char *q;\n    long slen;\n    int inf, tag, xclass;\n    b = BUF_MEM_new();\n    if (b == NULL) {\n        ASN1err(ASN1_F_ASN1_D2I_READ_BIO, ERR_R_MALLOC_FAILURE);\n        return -1;\n    }\n    ERR_clear_error();\n    for (;;) {\n        if (want >= (len - off)) {\n            want -= (len - off);\n            if (len + want < len || !BUF_MEM_grow_clean(b, len + want)) {\n                ASN1err(ASN1_F_ASN1_D2I_READ_BIO, ERR_R_MALLOC_FAILURE);\n                goto err;\n            }\n            i = BIO_read(in, &(b->data[len]), want);\n            if ((i < 0) && ((len - off) == 0)) {\n                ASN1err(ASN1_F_ASN1_D2I_READ_BIO, ASN1_R_NOT_ENOUGH_DATA);\n                goto err;\n            }\n            if (i > 0) {\n                if (len + i < len) {\n                    ASN1err(ASN1_F_ASN1_D2I_READ_BIO, ASN1_R_TOO_LONG);\n                    goto err;\n                }\n                len += i;\n            }\n        }\n        p = (unsigned char *)&(b->data[off]);\n        q = p;\n        inf = ASN1_get_object(&q, &slen, &tag, &xclass, len - off);\n        if (inf & 0x80) {\n            unsigned long e;\n            e = ERR_GET_REASON(ERR_peek_error());\n            if (e != ASN1_R_TOO_LONG)\n                goto err;\n            else\n                ERR_clear_error();\n        }\n        i = q - p;\n        off += i;\n        if (inf & 1) {\n            eos++;\n            if (eos < 0) {\n                ASN1err(ASN1_F_ASN1_D2I_READ_BIO, ASN1_R_HEADER_TOO_LONG);\n                goto err;\n            }\n            want = HEADER_SIZE;\n        } else if (eos && (slen == 0) && (tag == V_ASN1_EOC)) {\n            eos--;\n            if (eos <= 0)\n                break;\n            else\n                want = HEADER_SIZE;\n        } else {\n            want = slen;\n            if (want > (len - off)) {\n                size_t chunk_max = ASN1_CHUNK_INITIAL_SIZE;\n                want -= (len - off);\n                if (want > INT_MAX    ||\n                    len + want < len) {\n                    ASN1err(ASN1_F_ASN1_D2I_READ_BIO, ASN1_R_TOO_LONG);\n                    goto err;\n                }\n                while (want > 0) {\n                    size_t chunk = want > chunk_max ? chunk_max : want;\n                    if (!BUF_MEM_grow_clean(b, len + chunk)) {\n                        ASN1err(ASN1_F_ASN1_D2I_READ_BIO, ERR_R_MALLOC_FAILURE);\n                        goto err;\n                    }\n                    want -= chunk;\n                    while (chunk > 0) {\n                        i = BIO_read(in, &(b->data[len]), chunk);\n                        if (i <= 0) {\n                            ASN1err(ASN1_F_ASN1_D2I_READ_BIO,\n                                    ASN1_R_NOT_ENOUGH_DATA);\n                            goto err;\n                        }\n                        len += i;\n                        chunk -= i;\n                    }\n                    if (chunk_max < INT_MAX/2)\n                        chunk_max *= 2;\n                }\n            }\n            if (off + slen < off) {\n                ASN1err(ASN1_F_ASN1_D2I_READ_BIO, ASN1_R_TOO_LONG);\n                goto err;\n            }\n            off += slen;\n            if (eos <= 0) {\n                break;\n            } else\n                want = HEADER_SIZE;\n        }\n    }\n    if (off > INT_MAX) {\n        ASN1err(ASN1_F_ASN1_D2I_READ_BIO, ASN1_R_TOO_LONG);\n        goto err;\n    }\n    *pb = b;\n    return off;\n err:\n    BUF_MEM_free(b);\n    return -1;\n}']