crypto/dsa/dsa_gen.c:169: error: UNINITIALIZED_VALUE
  The value read from buf[_] was never initialized.
Showing all 1 steps of the trace


crypto/dsa/dsa_gen.c:169:6: 
167.   				for (i=SHA_DIGEST_LENGTH-1; i >= 0; i--)
168.   					{
169. > 					buf[i]++;
170.   					if (buf[i] != 0) break;
171.   					}

DSA *DSA_generate_parameters(int bits, unsigned char *seed_in, int seed_len,
	     int *counter_ret, unsigned long *h_ret, void (*callback)(),
	     char *cb_arg)
	{
	int ok=0;
	unsigned char seed[SHA_DIGEST_LENGTH];
	unsigned char md[SHA_DIGEST_LENGTH];
	unsigned char buf[SHA_DIGEST_LENGTH],buf2[SHA_DIGEST_LENGTH];
	BIGNUM *r0,*W,*X,*c,*test;
	BIGNUM *g=NULL,*q=NULL,*p=NULL;
	BN_MONT_CTX *mont=NULL;
	int k,n=0,i,b,m=0;
	int counter=0;
	BN_CTX *ctx=NULL,*ctx2=NULL;
	unsigned int h=2;
	DSA *ret=NULL;
	if (bits < 512) bits=512;
	bits=(bits+63)/64*64;
	if ((seed_in != NULL) && (seed_len == 20))
		memcpy(seed,seed_in,seed_len);
	if ((ctx=BN_CTX_new()) == NULL) goto err;
	if ((ctx2=BN_CTX_new()) == NULL) goto err;
	if ((ret=DSA_new()) == NULL) goto err;
	if ((mont=BN_MONT_CTX_new()) == NULL) goto err;
	r0= &(ctx2->bn[0]);
	g= &(ctx2->bn[1]);
	W= &(ctx2->bn[2]);
	q= &(ctx2->bn[3]);
	X= &(ctx2->bn[4]);
	c= &(ctx2->bn[5]);
	p= &(ctx2->bn[6]);
	test= &(ctx2->bn[7]);
	BN_lshift(test,BN_value_one(),bits-1);
	for (;;)
		{
		for (;;)
			{
			if (callback != NULL) callback(0,m++,cb_arg);
			if (!seed_len)
				RAND_bytes(seed,SHA_DIGEST_LENGTH);
			else
				seed_len=0;
			memcpy(buf,seed,SHA_DIGEST_LENGTH);
			memcpy(buf2,seed,SHA_DIGEST_LENGTH);
			for (i=SHA_DIGEST_LENGTH-1; i >= 0; i--)
				{
				buf[i]++;
				if (buf[i] != 0) break;
				}
			HASH(seed,SHA_DIGEST_LENGTH,md);
			HASH(buf,SHA_DIGEST_LENGTH,buf2);
			for (i=0; i<SHA_DIGEST_LENGTH; i++)
				md[i]^=buf2[i];
			md[0]|=0x80;
			md[SHA_DIGEST_LENGTH-1]|=0x01;
			if (!BN_bin2bn(md,SHA_DIGEST_LENGTH,q)) abort();
			if (DSA_is_prime(q,callback,cb_arg) > 0) break;
			}
		if (callback != NULL) callback(2,0,cb_arg);
		if (callback != NULL) callback(3,0,cb_arg);
		counter=0;
		n=(bits-1)/160;
		b=(bits-1)-n*160;
		for (;;)
			{
			BN_zero(W);
			for (k=0; k<=n; k++)
				{
				for (i=SHA_DIGEST_LENGTH-1; i >= 0; i--)
					{
					buf[i]++;
					if (buf[i] != 0) break;
					}
				HASH(buf,SHA_DIGEST_LENGTH,md);
				if (!BN_bin2bn(md,SHA_DIGEST_LENGTH,r0)) abort();
				BN_lshift(r0,r0,160*k);
				BN_add(W,W,r0);
				}
			BN_mask_bits(W,bits-1);
			BN_copy(X,W);
			BN_add(X,X,test);
			BN_lshift1(r0,q);
			BN_mod(c,X,r0,ctx);
			BN_sub(r0,c,BN_value_one());
			BN_sub(p,X,r0);
			if (BN_cmp(p,test) >= 0)
				{
				if (DSA_is_prime(p,callback,cb_arg) > 0)
					goto end;
				}
			counter++;
			if (counter >= 4096) break;
			if (callback != NULL) callback(0,counter,cb_arg);
			}
		}
end:
	if (callback != NULL) callback(2,1,cb_arg);
        BN_sub(test,p,BN_value_one());
        BN_div(r0,NULL,test,q,ctx);
	BN_set_word(test,h);
	BN_MONT_CTX_set(mont,p,ctx);
	for (;;)
		{
		BN_mod_exp_mont(g,test,r0,p,ctx,mont);
		if (!BN_is_one(g)) break;
		BN_add(test,test,BN_value_one());
		h++;
		}
	if (callback != NULL) callback(3,1,cb_arg);
	ok=1;
err:
	if (!ok)
		{
		if (ret != NULL) DSA_free(ret);
		}
	else
		{
		ret->p=BN_dup(p);
		ret->q=BN_dup(q);
		ret->g=BN_dup(g);
		if ((m > 1) && (seed_in != NULL)) memcpy(seed_in,seed,20);
		if (counter_ret != NULL) *counter_ret=counter;
		if (h_ret != NULL) *h_ret=h;
		}
	if (ctx != NULL) BN_CTX_free(ctx);
	if (ctx != NULL) BN_CTX_free(ctx2);
	if (mont != NULL) BN_MONT_CTX_free(mont);
	return(ok?ret:NULL);
	}
['DSA *DSA_generate_parameters(int bits, unsigned char *seed_in, int seed_len,\n\t     int *counter_ret, unsigned long *h_ret, void (*callback)(),\n\t     char *cb_arg)\n\t{\n\tint ok=0;\n\tunsigned char seed[SHA_DIGEST_LENGTH];\n\tunsigned char md[SHA_DIGEST_LENGTH];\n\tunsigned char buf[SHA_DIGEST_LENGTH],buf2[SHA_DIGEST_LENGTH];\n\tBIGNUM *r0,*W,*X,*c,*test;\n\tBIGNUM *g=NULL,*q=NULL,*p=NULL;\n\tBN_MONT_CTX *mont=NULL;\n\tint k,n=0,i,b,m=0;\n\tint counter=0;\n\tBN_CTX *ctx=NULL,*ctx2=NULL;\n\tunsigned int h=2;\n\tDSA *ret=NULL;\n\tif (bits < 512) bits=512;\n\tbits=(bits+63)/64*64;\n\tif ((seed_in != NULL) && (seed_len == 20))\n\t\tmemcpy(seed,seed_in,seed_len);\n\tif ((ctx=BN_CTX_new()) == NULL) goto err;\n\tif ((ctx2=BN_CTX_new()) == NULL) goto err;\n\tif ((ret=DSA_new()) == NULL) goto err;\n\tif ((mont=BN_MONT_CTX_new()) == NULL) goto err;\n\tr0= &(ctx2->bn[0]);\n\tg= &(ctx2->bn[1]);\n\tW= &(ctx2->bn[2]);\n\tq= &(ctx2->bn[3]);\n\tX= &(ctx2->bn[4]);\n\tc= &(ctx2->bn[5]);\n\tp= &(ctx2->bn[6]);\n\ttest= &(ctx2->bn[7]);\n\tBN_lshift(test,BN_value_one(),bits-1);\n\tfor (;;)\n\t\t{\n\t\tfor (;;)\n\t\t\t{\n\t\t\tif (callback != NULL) callback(0,m++,cb_arg);\n\t\t\tif (!seed_len)\n\t\t\t\tRAND_bytes(seed,SHA_DIGEST_LENGTH);\n\t\t\telse\n\t\t\t\tseed_len=0;\n\t\t\tmemcpy(buf,seed,SHA_DIGEST_LENGTH);\n\t\t\tmemcpy(buf2,seed,SHA_DIGEST_LENGTH);\n\t\t\tfor (i=SHA_DIGEST_LENGTH-1; i >= 0; i--)\n\t\t\t\t{\n\t\t\t\tbuf[i]++;\n\t\t\t\tif (buf[i] != 0) break;\n\t\t\t\t}\n\t\t\tHASH(seed,SHA_DIGEST_LENGTH,md);\n\t\t\tHASH(buf,SHA_DIGEST_LENGTH,buf2);\n\t\t\tfor (i=0; i<SHA_DIGEST_LENGTH; i++)\n\t\t\t\tmd[i]^=buf2[i];\n\t\t\tmd[0]|=0x80;\n\t\t\tmd[SHA_DIGEST_LENGTH-1]|=0x01;\n\t\t\tif (!BN_bin2bn(md,SHA_DIGEST_LENGTH,q)) abort();\n\t\t\tif (DSA_is_prime(q,callback,cb_arg) > 0) break;\n\t\t\t}\n\t\tif (callback != NULL) callback(2,0,cb_arg);\n\t\tif (callback != NULL) callback(3,0,cb_arg);\n\t\tcounter=0;\n\t\tn=(bits-1)/160;\n\t\tb=(bits-1)-n*160;\n\t\tfor (;;)\n\t\t\t{\n\t\t\tBN_zero(W);\n\t\t\tfor (k=0; k<=n; k++)\n\t\t\t\t{\n\t\t\t\tfor (i=SHA_DIGEST_LENGTH-1; i >= 0; i--)\n\t\t\t\t\t{\n\t\t\t\t\tbuf[i]++;\n\t\t\t\t\tif (buf[i] != 0) break;\n\t\t\t\t\t}\n\t\t\t\tHASH(buf,SHA_DIGEST_LENGTH,md);\n\t\t\t\tif (!BN_bin2bn(md,SHA_DIGEST_LENGTH,r0)) abort();\n\t\t\t\tBN_lshift(r0,r0,160*k);\n\t\t\t\tBN_add(W,W,r0);\n\t\t\t\t}\n\t\t\tBN_mask_bits(W,bits-1);\n\t\t\tBN_copy(X,W);\n\t\t\tBN_add(X,X,test);\n\t\t\tBN_lshift1(r0,q);\n\t\t\tBN_mod(c,X,r0,ctx);\n\t\t\tBN_sub(r0,c,BN_value_one());\n\t\t\tBN_sub(p,X,r0);\n\t\t\tif (BN_cmp(p,test) >= 0)\n\t\t\t\t{\n\t\t\t\tif (DSA_is_prime(p,callback,cb_arg) > 0)\n\t\t\t\t\tgoto end;\n\t\t\t\t}\n\t\t\tcounter++;\n\t\t\tif (counter >= 4096) break;\n\t\t\tif (callback != NULL) callback(0,counter,cb_arg);\n\t\t\t}\n\t\t}\nend:\n\tif (callback != NULL) callback(2,1,cb_arg);\n        BN_sub(test,p,BN_value_one());\n        BN_div(r0,NULL,test,q,ctx);\n\tBN_set_word(test,h);\n\tBN_MONT_CTX_set(mont,p,ctx);\n\tfor (;;)\n\t\t{\n\t\tBN_mod_exp_mont(g,test,r0,p,ctx,mont);\n\t\tif (!BN_is_one(g)) break;\n\t\tBN_add(test,test,BN_value_one());\n\t\th++;\n\t\t}\n\tif (callback != NULL) callback(3,1,cb_arg);\n\tok=1;\nerr:\n\tif (!ok)\n\t\t{\n\t\tif (ret != NULL) DSA_free(ret);\n\t\t}\n\telse\n\t\t{\n\t\tret->p=BN_dup(p);\n\t\tret->q=BN_dup(q);\n\t\tret->g=BN_dup(g);\n\t\tif ((m > 1) && (seed_in != NULL)) memcpy(seed_in,seed,20);\n\t\tif (counter_ret != NULL) *counter_ret=counter;\n\t\tif (h_ret != NULL) *h_ret=h;\n\t\t}\n\tif (ctx != NULL) BN_CTX_free(ctx);\n\tif (ctx != NULL) BN_CTX_free(ctx2);\n\tif (mont != NULL) BN_MONT_CTX_free(mont);\n\treturn(ok?ret:NULL);\n\t}']