crypto/pem/pem_lib.c:768: error: INTEGER_OVERFLOW_L2
  ([2, +oo] - [1, 2147483644]):unsigned64 by call to `BUF_MEM_grow_clean`.
Showing all 10 steps of the trace


crypto/pem/pem_lib.c:705:18: Call
703.               if (strncmp(&(buf[11 + i - 6]), "-----\n", 6) != 0)
704.                   continue;
705.               if (!BUF_MEM_grow(nameB, i + 9)) {
                        ^
706.                   PEMerr(PEM_F_PEM_READ_BIO, ERR_R_MALLOC_FAILURE);
707.                   goto err;

crypto/buffer/buffer.c:72:1: Parameter `len`
  70.   }
  71.   
  72. > size_t BUF_MEM_grow(BUF_MEM *str, size_t len)
  73.   {
  74.       char *ret;

crypto/pem/pem_lib.c:768:18: Call
766.               if (i > 65)
767.                   break;
768.               if (!BUF_MEM_grow_clean(dataB, i + bl + 9)) {
                        ^
769.                   PEMerr(PEM_F_PEM_READ_BIO, ERR_R_MALLOC_FAILURE);
770.                   goto err;

crypto/buffer/buffer.c:109:1: Parameter `len`
  107.   }
  108.   
  109. > size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
  110.   {
  111.       char *ret;

crypto/buffer/buffer.c:134:15: Call
  132.           ret = sec_alloc_realloc(str, n);
  133.       else
  134.           ret = OPENSSL_clear_realloc(str->data, str->max, n);
                       ^
  135.       if (ret == NULL) {
  136.           BUFerr(BUF_F_BUF_MEM_GROW_CLEAN, ERR_R_MALLOC_FAILURE);

crypto/mem.c:136:1: <LHS trace>
134.   }
135.   
136. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
137.                              const char *file, int line)
138.   {

crypto/mem.c:136:1: Parameter `num`
    134.   }
    135.   
    136. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
    137.                              const char *file, int line)
    138.   {

crypto/mem.c:136:1: <RHS trace>
134.   }
135.   
136. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
137.                              const char *file, int line)
138.   {

crypto/mem.c:136:1: Parameter `num`
    134.   }
    135.   
    136. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
    137.                              const char *file, int line)
    138.   {

crypto/mem.c:151:9: Binary operation: ([2, +oo] - [1, 2147483644]):unsigned64 by call to `BUF_MEM_grow_clean` 
    149.       /* Can't shrink the buffer since memcpy below copies |old_len| bytes. */
    150.       if (num < old_len) {
    151.           OPENSSL_cleanse((char*)str + num, old_len - num);
                   ^
    152.           return str;
    153.       }

void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
                           const char *file, int line)
{
    void *ret = NULL;
    if (str == NULL)
        return CRYPTO_malloc(num, file, line);
    if (num == 0) {
        CRYPTO_clear_free(str, old_len, file, line);
        return NULL;
    }
    if (num < old_len) {
        OPENSSL_cleanse((char*)str + num, old_len - num);
        return str;
    }
    ret = CRYPTO_malloc(num, file, line);
    if (ret != NULL) {
        memcpy(ret, str, old_len);
        CRYPTO_clear_free(str, old_len, file, line);
    }
    return ret;
}
['int PEM_read_bio(BIO *bp, char **name, char **header, unsigned char **data,\n                 long *len)\n{\n    EVP_ENCODE_CTX *ctx = EVP_ENCODE_CTX_new();\n    int end = 0, i, k, bl = 0, hl = 0, nohead = 0;\n    char buf[256];\n    BUF_MEM *nameB;\n    BUF_MEM *headerB;\n    BUF_MEM *dataB, *tmpB;\n    if (ctx == NULL) {\n        PEMerr(PEM_F_PEM_READ_BIO, ERR_R_MALLOC_FAILURE);\n        return (0);\n    }\n    nameB = BUF_MEM_new();\n    headerB = BUF_MEM_new();\n    dataB = BUF_MEM_new();\n    if ((nameB == NULL) || (headerB == NULL) || (dataB == NULL)) {\n        goto err;\n    }\n    buf[254] = \'\\0\';\n    for (;;) {\n        i = BIO_gets(bp, buf, 254);\n        if (i <= 0) {\n            PEMerr(PEM_F_PEM_READ_BIO, PEM_R_NO_START_LINE);\n            goto err;\n        }\n        while ((i >= 0) && (buf[i] <= \' \'))\n            i--;\n        buf[++i] = \'\\n\';\n        buf[++i] = \'\\0\';\n        if (strncmp(buf, "-----BEGIN ", 11) == 0) {\n            i = strlen(&(buf[11]));\n            if (strncmp(&(buf[11 + i - 6]), "-----\\n", 6) != 0)\n                continue;\n            if (!BUF_MEM_grow(nameB, i + 9)) {\n                PEMerr(PEM_F_PEM_READ_BIO, ERR_R_MALLOC_FAILURE);\n                goto err;\n            }\n            memcpy(nameB->data, &(buf[11]), i - 6);\n            nameB->data[i - 6] = \'\\0\';\n            break;\n        }\n    }\n    hl = 0;\n    if (!BUF_MEM_grow(headerB, 256)) {\n        PEMerr(PEM_F_PEM_READ_BIO, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    headerB->data[0] = \'\\0\';\n    for (;;) {\n        i = BIO_gets(bp, buf, 254);\n        if (i <= 0)\n            break;\n        while ((i >= 0) && (buf[i] <= \' \'))\n            i--;\n        buf[++i] = \'\\n\';\n        buf[++i] = \'\\0\';\n        if (buf[0] == \'\\n\')\n            break;\n        if (!BUF_MEM_grow(headerB, hl + i + 9)) {\n            PEMerr(PEM_F_PEM_READ_BIO, ERR_R_MALLOC_FAILURE);\n            goto err;\n        }\n        if (strncmp(buf, "-----END ", 9) == 0) {\n            nohead = 1;\n            break;\n        }\n        memcpy(&(headerB->data[hl]), buf, i);\n        headerB->data[hl + i] = \'\\0\';\n        hl += i;\n    }\n    bl = 0;\n    if (!BUF_MEM_grow(dataB, 1024)) {\n        PEMerr(PEM_F_PEM_READ_BIO, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    dataB->data[0] = \'\\0\';\n    if (!nohead) {\n        for (;;) {\n            i = BIO_gets(bp, buf, 254);\n            if (i <= 0)\n                break;\n            while ((i >= 0) && (buf[i] <= \' \'))\n                i--;\n            buf[++i] = \'\\n\';\n            buf[++i] = \'\\0\';\n            if (i != 65)\n                end = 1;\n            if (strncmp(buf, "-----END ", 9) == 0)\n                break;\n            if (i > 65)\n                break;\n            if (!BUF_MEM_grow_clean(dataB, i + bl + 9)) {\n                PEMerr(PEM_F_PEM_READ_BIO, ERR_R_MALLOC_FAILURE);\n                goto err;\n            }\n            memcpy(&(dataB->data[bl]), buf, i);\n            dataB->data[bl + i] = \'\\0\';\n            bl += i;\n            if (end) {\n                buf[0] = \'\\0\';\n                i = BIO_gets(bp, buf, 254);\n                if (i <= 0)\n                    break;\n                while ((i >= 0) && (buf[i] <= \' \'))\n                    i--;\n                buf[++i] = \'\\n\';\n                buf[++i] = \'\\0\';\n                break;\n            }\n        }\n    } else {\n        tmpB = headerB;\n        headerB = dataB;\n        dataB = tmpB;\n        bl = hl;\n    }\n    i = strlen(nameB->data);\n    if ((strncmp(buf, "-----END ", 9) != 0) ||\n        (strncmp(nameB->data, &(buf[9]), i) != 0) ||\n        (strncmp(&(buf[9 + i]), "-----\\n", 6) != 0)) {\n        PEMerr(PEM_F_PEM_READ_BIO, PEM_R_BAD_END_LINE);\n        goto err;\n    }\n    EVP_DecodeInit(ctx);\n    i = EVP_DecodeUpdate(ctx,\n                         (unsigned char *)dataB->data, &bl,\n                         (unsigned char *)dataB->data, bl);\n    if (i < 0) {\n        PEMerr(PEM_F_PEM_READ_BIO, PEM_R_BAD_BASE64_DECODE);\n        goto err;\n    }\n    i = EVP_DecodeFinal(ctx, (unsigned char *)&(dataB->data[bl]), &k);\n    if (i < 0) {\n        PEMerr(PEM_F_PEM_READ_BIO, PEM_R_BAD_BASE64_DECODE);\n        goto err;\n    }\n    bl += k;\n    if (bl == 0)\n        goto err;\n    *name = nameB->data;\n    *header = headerB->data;\n    *data = (unsigned char *)dataB->data;\n    *len = bl;\n    OPENSSL_free(nameB);\n    OPENSSL_free(headerB);\n    OPENSSL_free(dataB);\n    EVP_ENCODE_CTX_free(ctx);\n    return (1);\n err:\n    BUF_MEM_free(nameB);\n    BUF_MEM_free(headerB);\n    BUF_MEM_free(dataB);\n    EVP_ENCODE_CTX_free(ctx);\n    return (0);\n}', 'size_t BUF_MEM_grow(BUF_MEM *str, size_t len)\n{\n    char *ret;\n    size_t n;\n    if (str->length >= len) {\n        str->length = len;\n        return (len);\n    }\n    if (str->max >= len) {\n        if (str->data != NULL)\n            memset(&str->data[str->length], 0, len - str->length);\n        str->length = len;\n        return (len);\n    }\n    if (len > LIMIT_BEFORE_EXPANSION) {\n        BUFerr(BUF_F_BUF_MEM_GROW, ERR_R_MALLOC_FAILURE);\n        return 0;\n    }\n    n = (len + 3) / 3 * 4;\n    if ((str->flags & BUF_MEM_FLAG_SECURE))\n        ret = sec_alloc_realloc(str, n);\n    else\n        ret = OPENSSL_realloc(str->data, n);\n    if (ret == NULL) {\n        BUFerr(BUF_F_BUF_MEM_GROW, ERR_R_MALLOC_FAILURE);\n        len = 0;\n    } else {\n        str->data = ret;\n        str->max = n;\n        memset(&str->data[str->length], 0, len - str->length);\n        str->length = len;\n    }\n    return (len);\n}', 'size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)\n{\n    char *ret;\n    size_t n;\n    if (str->length >= len) {\n        if (str->data != NULL)\n            memset(&str->data[len], 0, str->length - len);\n        str->length = len;\n        return (len);\n    }\n    if (str->max >= len) {\n        memset(&str->data[str->length], 0, len - str->length);\n        str->length = len;\n        return (len);\n    }\n    if (len > LIMIT_BEFORE_EXPANSION) {\n        BUFerr(BUF_F_BUF_MEM_GROW_CLEAN, ERR_R_MALLOC_FAILURE);\n        return 0;\n    }\n    n = (len + 3) / 3 * 4;\n    if ((str->flags & BUF_MEM_FLAG_SECURE))\n        ret = sec_alloc_realloc(str, n);\n    else\n        ret = OPENSSL_clear_realloc(str->data, str->max, n);\n    if (ret == NULL) {\n        BUFerr(BUF_F_BUF_MEM_GROW_CLEAN, ERR_R_MALLOC_FAILURE);\n        len = 0;\n    } else {\n        str->data = ret;\n        str->max = n;\n        memset(&str->data[str->length], 0, len - str->length);\n        str->length = len;\n    }\n    return (len);\n}', 'void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,\n                           const char *file, int line)\n{\n    void *ret = NULL;\n    if (str == NULL)\n        return CRYPTO_malloc(num, file, line);\n    if (num == 0) {\n        CRYPTO_clear_free(str, old_len, file, line);\n        return NULL;\n    }\n    if (num < old_len) {\n        OPENSSL_cleanse((char*)str + num, old_len - num);\n        return str;\n    }\n    ret = CRYPTO_malloc(num, file, line);\n    if (ret != NULL) {\n        memcpy(ret, str, old_len);\n        CRYPTO_clear_free(str, old_len, file, line);\n    }\n    return ret;\n}']