providers/fips/fipsprov.c:84: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: [1, +oo] by call to `BN_CTX_end`.
Showing all 10 steps of the trace


providers/fips/fipsprov.c:71:5: Call
69.       if (bnctx == NULL)
70.           goto err;
71.       BN_CTX_start(bnctx);
          ^
72.       a = BN_CTX_get(bnctx);
73.       b = BN_CTX_get(bnctx);

crypto/bn/bn_ctx.c:188:1: Parameter `*ctx->stack.indexes`
  186.   }
  187.   
  188. > void BN_CTX_start(BN_CTX *ctx)
  189.   {
  190.       CTXDBG("ENTER BN_CTX_start()", ctx);

providers/fips/fipsprov.c:84:5: Call
82.       ret = 1;
83.    err:
84.       BN_CTX_end(bnctx);
          ^
85.       BN_CTX_free(bnctx);
86.       

crypto/bn/bn_ctx.c:202:1: Parameter `*ctx->stack.indexes`
  200.   }
  201.   
  202. > void BN_CTX_end(BN_CTX *ctx)
  203.   {
  204.       if (ctx == NULL)

crypto/bn/bn_ctx.c:210:27: Call
  208.           ctx->err_stack--;
  209.       else {
  210.           unsigned int fp = BN_STACK_pop(&ctx->stack);
                                   ^
  211.           /* Does this stack frame have anything to release? */
  212.           if (fp < ctx->used)

crypto/bn/bn_ctx.c:290:1: <Offset trace>
288.   }
289.   
290. > static unsigned int BN_STACK_pop(BN_STACK *st)
291.   {
292.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:290:1: Parameter `st->depth`
    288.   }
    289.   
    290. > static unsigned int BN_STACK_pop(BN_STACK *st)
    291.   {
    292.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:290:1: <Length trace>
288.   }
289.   
290. > static unsigned int BN_STACK_pop(BN_STACK *st)
291.   {
292.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:290:1: Parameter `*st->indexes`
    288.   }
    289.   
    290. > static unsigned int BN_STACK_pop(BN_STACK *st)
    291.   {
    292.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:292:12: Array access: Offset: [-1, +oo] Size: [1, +oo] by call to `BN_CTX_end` 
    290.   static unsigned int BN_STACK_pop(BN_STACK *st)
    291.   {
    292.       return st->indexes[--(st->depth)];
                      ^
    293.   }
    294.   

static unsigned int BN_STACK_pop(BN_STACK *st)
{
    return st->indexes[--(st->depth)];
}
['static int dummy_evp_call(OPENSSL_CTX *libctx)\n{\n    EVP_MD_CTX *ctx = EVP_MD_CTX_new();\n    EVP_MD *sha256 = EVP_MD_fetch(libctx, "SHA256", NULL);\n    char msg[] = "Hello World!";\n    const unsigned char exptd[] = {\n        0x7f, 0x83, 0xb1, 0x65, 0x7f, 0xf1, 0xfc, 0x53, 0xb9, 0x2d, 0xc1, 0x81,\n        0x48, 0xa1, 0xd6, 0x5d, 0xfc, 0x2d, 0x4b, 0x1f, 0xa3, 0xd6, 0x77, 0x28,\n        0x4a, 0xdd, 0xd2, 0x00, 0x12, 0x6d, 0x90, 0x69\n    };\n    unsigned int dgstlen = 0;\n    unsigned char dgst[SHA256_DIGEST_LENGTH];\n    int ret = 0;\n    BN_CTX *bnctx = NULL;\n    BIGNUM *a = NULL, *b = NULL;\n    if (ctx == NULL || sha256 == NULL)\n        goto err;\n    if (!EVP_DigestInit_ex(ctx, sha256, NULL))\n        goto err;\n    if (!EVP_DigestUpdate(ctx, msg, sizeof(msg) - 1))\n        goto err;\n    if (!EVP_DigestFinal(ctx, dgst, &dgstlen))\n        goto err;\n    if (dgstlen != sizeof(exptd) || memcmp(dgst, exptd, sizeof(exptd)) != 0)\n        goto err;\n    bnctx = BN_CTX_new_ex(libctx);\n    if (bnctx == NULL)\n        goto err;\n    BN_CTX_start(bnctx);\n    a = BN_CTX_get(bnctx);\n    b = BN_CTX_get(bnctx);\n    if (b == NULL)\n        goto err;\n    BN_zero(a);\n    if (!BN_one(b)\n        || !BN_add(a, a, b)\n        || BN_cmp(a, b) != 0)\n        goto err;\n    ret = 1;\n err:\n    BN_CTX_end(bnctx);\n    BN_CTX_free(bnctx);\n    EVP_MD_CTX_free(ctx);\n    EVP_MD_meth_free(sha256);\n    return ret;\n}', 'void BN_CTX_start(BN_CTX *ctx)\n{\n    CTXDBG("ENTER BN_CTX_start()", ctx);\n    if (ctx->err_stack || ctx->too_many)\n        ctx->err_stack++;\n    else if (!BN_STACK_push(&ctx->stack, ctx->used)) {\n        BNerr(BN_F_BN_CTX_START, BN_R_TOO_MANY_TEMPORARY_VARIABLES);\n        ctx->err_stack++;\n    }\n    CTXDBG("LEAVE BN_CTX_start()", ctx);\n}', 'void BN_CTX_end(BN_CTX *ctx)\n{\n    if (ctx == NULL)\n        return;\n    CTXDBG("ENTER BN_CTX_end()", ctx);\n    if (ctx->err_stack)\n        ctx->err_stack--;\n    else {\n        unsigned int fp = BN_STACK_pop(&ctx->stack);\n        if (fp < ctx->used)\n            BN_POOL_release(&ctx->pool, ctx->used - fp);\n        ctx->used = fp;\n        ctx->too_many = 0;\n    }\n    CTXDBG("LEAVE BN_CTX_end()", ctx);\n}', 'static unsigned int BN_STACK_pop(BN_STACK *st)\n{\n    return st->indexes[--(st->depth)];\n}']