crypto/pkcs12/p12_crpt.c:93: error: INTEGER_OVERFLOW_L2
  ([1, 9223372036854775806] + 1):signed32 by call to `PKCS12_key_gen_asc`.
Showing all 7 steps of the trace


crypto/pkcs12/p12_crpt.c:88:9: Assignment
86.   
87.       if (!pbe->iter)
88.           iter = 1;
              ^
89.       else
90.           iter = ASN1_INTEGER_get(pbe->iter);

crypto/pkcs12/p12_crpt.c:93:10: Call
91.       salt = pbe->salt->data;
92.       saltlen = pbe->salt->length;
93.       if (!PKCS12_key_gen(pass, passlen, salt, saltlen, PKCS12_KEY_ID,
               ^
94.                           iter, EVP_CIPHER_key_length(cipher), key, md)) {
95.           PKCS12err(PKCS12_F_PKCS12_PBE_KEYIVGEN, PKCS12_R_KEY_GEN_ERROR);

crypto/pkcs12/p12_key.c:80:1: Parameter `iter`
  78.   #endif
  79.   
  80. > int PKCS12_key_gen_asc(const char *pass, int passlen, unsigned char *salt,
  81.                          int saltlen, int id, int iter, int n,
  82.                          unsigned char *out, const EVP_MD *md_type)

crypto/pkcs12/p12_key.c:95:11: Call
  93.           return 0;
  94.       }
  95.       ret = PKCS12_key_gen_uni(unipass, uniplen, salt, saltlen,
                  ^
  96.                                id, iter, n, out, md_type);
  97.       if (ret <= 0)

crypto/pkcs12/p12_key.c:103:1: <LHS trace>
101.   }
102.   
103. > int PKCS12_key_gen_uni(unsigned char *pass, int passlen, unsigned char *salt,
104.                          int saltlen, int id, int iter, int n,
105.                          unsigned char *out, const EVP_MD *md_type)

crypto/pkcs12/p12_key.c:103:1: Parameter `iter`
    101.   }
    102.   
    103. > int PKCS12_key_gen_uni(unsigned char *pass, int passlen, unsigned char *salt,
    104.                          int saltlen, int id, int iter, int n,
    105.                          unsigned char *out, const EVP_MD *md_type)

crypto/pkcs12/p12_key.c:158:31: Binary operation: ([1, 9223372036854775806] + 1):signed32 by call to `PKCS12_key_gen_asc` 
    156.               || !EVP_DigestFinal_ex(&ctx, Ai, NULL))
    157.               goto err;
    158.           for (j = 1; j < iter; j++) {
                                         ^
    159.               if (!EVP_DigestInit_ex(&ctx, md_type, NULL)
    160.                   || !EVP_DigestUpdate(&ctx, Ai, u)

int PKCS12_key_gen_uni(unsigned char *pass, int passlen, unsigned char *salt,
                       int saltlen, int id, int iter, int n,
                       unsigned char *out, const EVP_MD *md_type)
{
    unsigned char *B, *D, *I, *p, *Ai;
    int Slen, Plen, Ilen, Ijlen;
    int i, j, u, v;
    int ret = 0;
    BIGNUM *Ij, *Bpl1;
    EVP_MD_CTX ctx;
#ifdef  DEBUG_KEYGEN
    unsigned char *tmpout = out;
    int tmpn = n;
#endif
    EVP_MD_CTX_init(&ctx);
#ifdef  DEBUG_KEYGEN
    fprintf(stderr, "KEYGEN DEBUG\n");
    fprintf(stderr, "ID %d, ITER %d\n", id, iter);
    fprintf(stderr, "Password (length %d):\n", passlen);
    h__dump(pass, passlen);
    fprintf(stderr, "Salt (length %d):\n", saltlen);
    h__dump(salt, saltlen);
#endif
    v = EVP_MD_block_size(md_type);
    u = EVP_MD_size(md_type);
    if (u < 0)
        return 0;
    D = OPENSSL_malloc(v);
    Ai = OPENSSL_malloc(u);
    B = OPENSSL_malloc(v + 1);
    Slen = v * ((saltlen + v - 1) / v);
    if (passlen)
        Plen = v * ((passlen + v - 1) / v);
    else
        Plen = 0;
    Ilen = Slen + Plen;
    I = OPENSSL_malloc(Ilen);
    Ij = BN_new();
    Bpl1 = BN_new();
    if (!D || !Ai || !B || !I || !Ij || !Bpl1)
        goto err;
    for (i = 0; i < v; i++)
        D[i] = id;
    p = I;
    for (i = 0; i < Slen; i++)
        *p++ = salt[i % saltlen];
    for (i = 0; i < Plen; i++)
        *p++ = pass[i % passlen];
    for (;;) {
        if (!EVP_DigestInit_ex(&ctx, md_type, NULL)
            || !EVP_DigestUpdate(&ctx, D, v)
            || !EVP_DigestUpdate(&ctx, I, Ilen)
            || !EVP_DigestFinal_ex(&ctx, Ai, NULL))
            goto err;
        for (j = 1; j < iter; j++) {
            if (!EVP_DigestInit_ex(&ctx, md_type, NULL)
                || !EVP_DigestUpdate(&ctx, Ai, u)
                || !EVP_DigestFinal_ex(&ctx, Ai, NULL))
                goto err;
        }
        memcpy(out, Ai, min(n, u));
        if (u >= n) {
#ifdef DEBUG_KEYGEN
            fprintf(stderr, "Output KEY (length %d)\n", tmpn);
            h__dump(tmpout, tmpn);
#endif
            ret = 1;
            goto end;
        }
        n -= u;
        out += u;
        for (j = 0; j < v; j++)
            B[j] = Ai[j % u];
        if (!BN_bin2bn(B, v, Bpl1))
            goto err;
        if (!BN_add_word(Bpl1, 1))
            goto err;
        for (j = 0; j < Ilen; j += v) {
            if (!BN_bin2bn(I + j, v, Ij))
                goto err;
            if (!BN_add(Ij, Ij, Bpl1))
                goto err;
            if (!BN_bn2bin(Ij, B))
                goto err;
            Ijlen = BN_num_bytes(Ij);
            if (Ijlen > v) {
                if (!BN_bn2bin(Ij, B))
                    goto err;
                memcpy(I + j, B + 1, v);
#ifndef PKCS12_BROKEN_KEYGEN
            } else if (Ijlen < v) {
                memset(I + j, 0, v - Ijlen);
                if (!BN_bn2bin(Ij, I + j + v - Ijlen))
                    goto err;
#endif
            } else if (!BN_bn2bin(Ij, I + j))
                goto err;
        }
    }
 err:
    PKCS12err(PKCS12_F_PKCS12_KEY_GEN_UNI, ERR_R_MALLOC_FAILURE);
 end:
    OPENSSL_free(Ai);
    OPENSSL_free(B);
    OPENSSL_free(D);
    OPENSSL_free(I);
    BN_free(Ij);
    BN_free(Bpl1);
    EVP_MD_CTX_cleanup(&ctx);
    return ret;
}
['int PKCS12_PBE_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass, int passlen,\n                        ASN1_TYPE *param, const EVP_CIPHER *cipher,\n                        const EVP_MD *md, int en_de)\n{\n    PBEPARAM *pbe;\n    int saltlen, iter, ret;\n    unsigned char *salt;\n    unsigned char key[EVP_MAX_KEY_LENGTH], iv[EVP_MAX_IV_LENGTH];\n    pbe = ASN1_TYPE_unpack_sequence(ASN1_ITEM_rptr(PBEPARAM), param);\n    if (pbe == NULL) {\n        PKCS12err(PKCS12_F_PKCS12_PBE_KEYIVGEN, PKCS12_R_DECODE_ERROR);\n        return 0;\n    }\n    if (!pbe->iter)\n        iter = 1;\n    else\n        iter = ASN1_INTEGER_get(pbe->iter);\n    salt = pbe->salt->data;\n    saltlen = pbe->salt->length;\n    if (!PKCS12_key_gen(pass, passlen, salt, saltlen, PKCS12_KEY_ID,\n                        iter, EVP_CIPHER_key_length(cipher), key, md)) {\n        PKCS12err(PKCS12_F_PKCS12_PBE_KEYIVGEN, PKCS12_R_KEY_GEN_ERROR);\n        PBEPARAM_free(pbe);\n        return 0;\n    }\n    if (!PKCS12_key_gen(pass, passlen, salt, saltlen, PKCS12_IV_ID,\n                        iter, EVP_CIPHER_iv_length(cipher), iv, md)) {\n        PKCS12err(PKCS12_F_PKCS12_PBE_KEYIVGEN, PKCS12_R_IV_GEN_ERROR);\n        PBEPARAM_free(pbe);\n        return 0;\n    }\n    PBEPARAM_free(pbe);\n    ret = EVP_CipherInit_ex(ctx, cipher, NULL, key, iv, en_de);\n    OPENSSL_cleanse(key, EVP_MAX_KEY_LENGTH);\n    OPENSSL_cleanse(iv, EVP_MAX_IV_LENGTH);\n    return ret;\n}', 'int PKCS12_key_gen_asc(const char *pass, int passlen, unsigned char *salt,\n                       int saltlen, int id, int iter, int n,\n                       unsigned char *out, const EVP_MD *md_type)\n{\n    int ret;\n    unsigned char *unipass;\n    int uniplen;\n    if (!pass) {\n        unipass = NULL;\n        uniplen = 0;\n    } else if (!OPENSSL_asc2uni(pass, passlen, &unipass, &uniplen)) {\n        PKCS12err(PKCS12_F_PKCS12_KEY_GEN_ASC, ERR_R_MALLOC_FAILURE);\n        return 0;\n    }\n    ret = PKCS12_key_gen_uni(unipass, uniplen, salt, saltlen,\n                             id, iter, n, out, md_type);\n    if (ret <= 0)\n        return 0;\n    OPENSSL_clear_free(unipass, uniplen);\n    return ret;\n}', 'int PKCS12_key_gen_uni(unsigned char *pass, int passlen, unsigned char *salt,\n                       int saltlen, int id, int iter, int n,\n                       unsigned char *out, const EVP_MD *md_type)\n{\n    unsigned char *B, *D, *I, *p, *Ai;\n    int Slen, Plen, Ilen, Ijlen;\n    int i, j, u, v;\n    int ret = 0;\n    BIGNUM *Ij, *Bpl1;\n    EVP_MD_CTX ctx;\n#ifdef  DEBUG_KEYGEN\n    unsigned char *tmpout = out;\n    int tmpn = n;\n#endif\n    EVP_MD_CTX_init(&ctx);\n#ifdef  DEBUG_KEYGEN\n    fprintf(stderr, "KEYGEN DEBUG\\n");\n    fprintf(stderr, "ID %d, ITER %d\\n", id, iter);\n    fprintf(stderr, "Password (length %d):\\n", passlen);\n    h__dump(pass, passlen);\n    fprintf(stderr, "Salt (length %d):\\n", saltlen);\n    h__dump(salt, saltlen);\n#endif\n    v = EVP_MD_block_size(md_type);\n    u = EVP_MD_size(md_type);\n    if (u < 0)\n        return 0;\n    D = OPENSSL_malloc(v);\n    Ai = OPENSSL_malloc(u);\n    B = OPENSSL_malloc(v + 1);\n    Slen = v * ((saltlen + v - 1) / v);\n    if (passlen)\n        Plen = v * ((passlen + v - 1) / v);\n    else\n        Plen = 0;\n    Ilen = Slen + Plen;\n    I = OPENSSL_malloc(Ilen);\n    Ij = BN_new();\n    Bpl1 = BN_new();\n    if (!D || !Ai || !B || !I || !Ij || !Bpl1)\n        goto err;\n    for (i = 0; i < v; i++)\n        D[i] = id;\n    p = I;\n    for (i = 0; i < Slen; i++)\n        *p++ = salt[i % saltlen];\n    for (i = 0; i < Plen; i++)\n        *p++ = pass[i % passlen];\n    for (;;) {\n        if (!EVP_DigestInit_ex(&ctx, md_type, NULL)\n            || !EVP_DigestUpdate(&ctx, D, v)\n            || !EVP_DigestUpdate(&ctx, I, Ilen)\n            || !EVP_DigestFinal_ex(&ctx, Ai, NULL))\n            goto err;\n        for (j = 1; j < iter; j++) {\n            if (!EVP_DigestInit_ex(&ctx, md_type, NULL)\n                || !EVP_DigestUpdate(&ctx, Ai, u)\n                || !EVP_DigestFinal_ex(&ctx, Ai, NULL))\n                goto err;\n        }\n        memcpy(out, Ai, min(n, u));\n        if (u >= n) {\n#ifdef DEBUG_KEYGEN\n            fprintf(stderr, "Output KEY (length %d)\\n", tmpn);\n            h__dump(tmpout, tmpn);\n#endif\n            ret = 1;\n            goto end;\n        }\n        n -= u;\n        out += u;\n        for (j = 0; j < v; j++)\n            B[j] = Ai[j % u];\n        if (!BN_bin2bn(B, v, Bpl1))\n            goto err;\n        if (!BN_add_word(Bpl1, 1))\n            goto err;\n        for (j = 0; j < Ilen; j += v) {\n            if (!BN_bin2bn(I + j, v, Ij))\n                goto err;\n            if (!BN_add(Ij, Ij, Bpl1))\n                goto err;\n            if (!BN_bn2bin(Ij, B))\n                goto err;\n            Ijlen = BN_num_bytes(Ij);\n            if (Ijlen > v) {\n                if (!BN_bn2bin(Ij, B))\n                    goto err;\n                memcpy(I + j, B + 1, v);\n#ifndef PKCS12_BROKEN_KEYGEN\n            } else if (Ijlen < v) {\n                memset(I + j, 0, v - Ijlen);\n                if (!BN_bn2bin(Ij, I + j + v - Ijlen))\n                    goto err;\n#endif\n            } else if (!BN_bn2bin(Ij, I + j))\n                goto err;\n        }\n    }\n err:\n    PKCS12err(PKCS12_F_PKCS12_KEY_GEN_UNI, ERR_R_MALLOC_FAILURE);\n end:\n    OPENSSL_free(Ai);\n    OPENSSL_free(B);\n    OPENSSL_free(D);\n    OPENSSL_free(I);\n    BN_free(Ij);\n    BN_free(Bpl1);\n    EVP_MD_CTX_cleanup(&ctx);\n    return ret;\n}']