crypto/jpake/jpake.c:401: error: INTEGER_OVERFLOW_L2
  ([0, `ctx->p.p->top`] - 1):unsigned64 by call to `verify_zkp`.
Showing all 21 steps of the trace


crypto/jpake/jpake.c:385:1: Parameter `ctx->p.p->top`
383.       }
384.   
385. > int JPAKE_STEP2_process(JPAKE_CTX *ctx, const JPAKE_STEP2 *received)
386.       {
387.       BIGNUM *t1 = BN_new();

crypto/jpake/jpake.c:397:5: Call
395.       BN_mod_add(t1, ctx->xa, ctx->xb, ctx->p.q, ctx->ctx);
396.      /* t2 = g^{t1} = g^{xa+xb} */
397.       BN_mod_exp(t2, ctx->p.g, t1, ctx->p.p, ctx->ctx);
           ^
398.      /* t1 = g^{xc} * t2 = g^{xc + xa + xb} */
399.       BN_mod_mul(t1, ctx->p.gxc, t2, ctx->p.p, ctx->ctx);

crypto/bn/bn_exp.c:163:1: Parameter `m->top`
  161.   
  162.   
  163. > int BN_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, const BIGNUM *m,
  164.   	       BN_CTX *ctx)
  165.   	{

crypto/bn/bn_exp.c:219:8: Call
  217.   			{
  218.   			BN_ULONG A = a->d[0];
  219.   			ret=BN_mod_exp_mont_word(r,A,p,m,ctx,NULL);
                ^
  220.   			}
  221.   		else

crypto/bn/bn_exp.c:727:1: Parameter `m->top`
    725.   	}
    726.   
    727. > int BN_mod_exp_mont_word(BIGNUM *rr, BN_ULONG a, const BIGNUM *p,
    728.                            const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *in_mont)
    729.   	{

crypto/jpake/jpake.c:399:5: Call
397.       BN_mod_exp(t2, ctx->p.g, t1, ctx->p.p, ctx->ctx);
398.      /* t1 = g^{xc} * t2 = g^{xc + xa + xb} */
399.       BN_mod_mul(t1, ctx->p.gxc, t2, ctx->p.p, ctx->ctx);
           ^
400.   
401.       if(verify_zkp(received, t1, ctx))

crypto/bn/bn_mod.c:178:1: Parameter `m->top`
  176.   
  177.   /* slow but works */
  178. > int BN_mod_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *m,
  179.   	BN_CTX *ctx)
  180.   	{

crypto/jpake/jpake.c:401:8: Call
399.       BN_mod_mul(t1, ctx->p.gxc, t2, ctx->p.p, ctx->ctx);
400.   
401.       if(verify_zkp(received, t1, ctx))
              ^
402.   	ret = 1;
403.       else

crypto/jpake/jpake.c:214:1: Parameter `ctx->p.p->top`
  212.       }
  213.   
  214. > static int verify_zkp(const JPAKE_STEP_PART *p, const BIGNUM *zkpg,
  215.   		      JPAKE_CTX *ctx)
  216.       {

crypto/jpake/jpake.c:226:5: Call
  224.   
  225.      /* t1 = g^b */
  226.       BN_mod_exp(t1, zkpg, p->zkpx.b, ctx->p.p, ctx->ctx);
             ^
  227.      /* t2 = (g^x)^h = g^{hx} */
  228.       BN_mod_exp(t2, p->gx, h, ctx->p.p, ctx->ctx);

crypto/bn/bn_exp.c:163:1: Parameter `m->top`
    161.   
    162.   
    163. > int BN_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, const BIGNUM *m,
    164.   	       BN_CTX *ctx)
    165.   	{

crypto/bn/bn_exp.c:228:9: Call
    226.   #endif
    227.   #ifdef RECP_MUL_MOD
    228.   		{ ret=BN_mod_exp_recp(r,a,p,m,ctx); }
                   ^
    229.   #else
    230.   		{ ret=BN_mod_exp_simple(r,a,p,m,ctx); }

crypto/bn/bn_exp.c:238:1: Parameter `m->top`
      236.   
      237.   
      238. > int BN_mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
      239.   		    const BIGNUM *m, BN_CTX *ctx)
      240.   	{

crypto/bn/bn_exp.c:278:7: Call
      276.   	else
      277.   		{
      278.   		if (BN_RECP_CTX_set(&recp,m,ctx) <= 0) goto err;
                   ^
      279.   		}
      280.   

crypto/bn/bn_recp.c:94:1: Parameter `d->top`
        92.   	}
        93.   
        94. > int BN_RECP_CTX_set(BN_RECP_CTX *recp, const BIGNUM *d, BN_CTX *ctx)
        95.   	{
        96.   	if (!BN_copy(&(recp->N),d)) return 0;

crypto/bn/bn_recp.c:96:7: Call
        94.   int BN_RECP_CTX_set(BN_RECP_CTX *recp, const BIGNUM *d, BN_CTX *ctx)
        95.   	{
        96.   	if (!BN_copy(&(recp->N),d)) return 0;
                    ^
        97.   	BN_zero(&(recp->Nr));
        98.   	recp->num_bits=BN_num_bits(d);

crypto/bn/bn_lib.c:497:1: Parameter `a->dmax`
          495.   	}
          496.   
          497. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
          498.   	{
          499.   	int i;

crypto/bn/bn_recp.c:98:17: Call
        96.   	if (!BN_copy(&(recp->N),d)) return 0;
        97.   	BN_zero(&(recp->Nr));
        98.   	recp->num_bits=BN_num_bits(d);
                               ^
        99.   	recp->shift=0;
        100.   	return(1);

crypto/bn/bn_lib.c:248:1: <LHS trace>
246.   	}
247.   
248. > int BN_num_bits(const BIGNUM *a)
249.   	{
250.   	int i = a->top - 1;

crypto/bn/bn_lib.c:248:1: Parameter `a->top`
          246.   	}
          247.   
          248. > int BN_num_bits(const BIGNUM *a)
          249.   	{
          250.   	int i = a->top - 1;

crypto/bn/bn_lib.c:250:2: Binary operation: ([0, ctx->p.p->top] - 1):unsigned64 by call to `verify_zkp` 
          248.   int BN_num_bits(const BIGNUM *a)
          249.   	{
          250.   	int i = a->top - 1;
                  ^
          251.   	bn_check_top(a);
          252.   

int BN_num_bits(const BIGNUM *a)
	{
	int i = a->top - 1;
	bn_check_top(a);
	if (BN_is_zero(a)) return 0;
	return ((i*BN_BITS2) + BN_num_bits_word(a->d[i]));
	}
['int JPAKE_STEP2_process(JPAKE_CTX *ctx, const JPAKE_STEP2 *received)\n    {\n    BIGNUM *t1 = BN_new();\n    BIGNUM *t2 = BN_new();\n    int ret = 0;\n    BN_mod_add(t1, ctx->xa, ctx->xb, ctx->p.q, ctx->ctx);\n    BN_mod_exp(t2, ctx->p.g, t1, ctx->p.p, ctx->ctx);\n    BN_mod_mul(t1, ctx->p.gxc, t2, ctx->p.p, ctx->ctx);\n    if(verify_zkp(received, t1, ctx))\n\tret = 1;\n    else\n\tJPAKEerr(JPAKE_F_JPAKE_STEP2_PROCESS, JPAKE_R_VERIFY_B_FAILED);\n    compute_key(ctx, received->gx);\n    BN_free(t2);\n    BN_free(t1);\n    return ret;\n    }', 'int BN_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, const BIGNUM *m,\n\t       BN_CTX *ctx)\n\t{\n\tint ret;\n\tbn_check_top(a);\n\tbn_check_top(p);\n\tbn_check_top(m);\n#define MONT_MUL_MOD\n#define MONT_EXP_WORD\n#define RECP_MUL_MOD\n#ifdef MONT_MUL_MOD\n\tif (BN_is_odd(m))\n\t\t{\n#  ifdef MONT_EXP_WORD\n\t\tif (a->top == 1 && !a->neg && (BN_get_flags(p, BN_FLG_CONSTTIME) == 0))\n\t\t\t{\n\t\t\tBN_ULONG A = a->d[0];\n\t\t\tret=BN_mod_exp_mont_word(r,A,p,m,ctx,NULL);\n\t\t\t}\n\t\telse\n#  endif\n\t\t\tret=BN_mod_exp_mont(r,a,p,m,ctx,NULL);\n\t\t}\n\telse\n#endif\n#ifdef RECP_MUL_MOD\n\t\t{ ret=BN_mod_exp_recp(r,a,p,m,ctx); }\n#else\n\t\t{ ret=BN_mod_exp_simple(r,a,p,m,ctx); }\n#endif\n\tbn_check_top(r);\n\treturn(ret);\n\t}', 'int BN_mod_exp_mont_word(BIGNUM *rr, BN_ULONG a, const BIGNUM *p,\n                         const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *in_mont)\n\t{\n\tBN_MONT_CTX *mont = NULL;\n\tint b, bits, ret=0;\n\tint r_is_one;\n\tBN_ULONG w, next_w;\n\tBIGNUM *d, *r, *t;\n\tBIGNUM *swap_tmp;\n#define BN_MOD_MUL_WORD(r, w, m) \\\n\t\t(BN_mul_word(r, (w)) && \\\n\t\t(   \\\n\t\t\t(BN_mod(t, r, m, ctx) && (swap_tmp = r, r = t, t = swap_tmp, 1))))\n#define BN_TO_MONTGOMERY_WORD(r, w, mont) \\\n\t\t(BN_set_word(r, (w)) && BN_to_montgomery(r, r, (mont), ctx))\n\tif (BN_get_flags(p, BN_FLG_CONSTTIME) != 0)\n\t\t{\n\t\tBNerr(BN_F_BN_MOD_EXP_MONT_WORD,ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);\n\t\treturn -1;\n\t\t}\n\tbn_check_top(p);\n\tbn_check_top(m);\n\tif (!BN_is_odd(m))\n\t\t{\n\t\tBNerr(BN_F_BN_MOD_EXP_MONT_WORD,BN_R_CALLED_WITH_EVEN_MODULUS);\n\t\treturn(0);\n\t\t}\n\tif (m->top == 1)\n\t\ta %= m->d[0];\n\tbits = BN_num_bits(p);\n\tif (bits == 0)\n\t\t{\n\t\tret = BN_one(rr);\n\t\treturn ret;\n\t\t}\n\tif (a == 0)\n\t\t{\n\t\tBN_zero(rr);\n\t\tret = 1;\n\t\treturn ret;\n\t\t}\n\tBN_CTX_start(ctx);\n\td = BN_CTX_get(ctx);\n\tr = BN_CTX_get(ctx);\n\tt = BN_CTX_get(ctx);\n\tif (d == NULL || r == NULL || t == NULL) goto err;\n\tif (in_mont != NULL)\n\t\tmont=in_mont;\n\telse\n\t\t{\n\t\tif ((mont = BN_MONT_CTX_new()) == NULL) goto err;\n\t\tif (!BN_MONT_CTX_set(mont, m, ctx)) goto err;\n\t\t}\n\tr_is_one = 1;\n\tw = a;\n\tfor (b = bits-2; b >= 0; b--)\n\t\t{\n\t\tnext_w = w*w;\n\t\tif ((next_w/w) != w)\n\t\t\t{\n\t\t\tif (r_is_one)\n\t\t\t\t{\n\t\t\t\tif (!BN_TO_MONTGOMERY_WORD(r, w, mont)) goto err;\n\t\t\t\tr_is_one = 0;\n\t\t\t\t}\n\t\t\telse\n\t\t\t\t{\n\t\t\t\tif (!BN_MOD_MUL_WORD(r, w, m)) goto err;\n\t\t\t\t}\n\t\t\tnext_w = 1;\n\t\t\t}\n\t\tw = next_w;\n\t\tif (!r_is_one)\n\t\t\t{\n\t\t\tif (!BN_mod_mul_montgomery(r, r, r, mont, ctx)) goto err;\n\t\t\t}\n\t\tif (BN_is_bit_set(p, b))\n\t\t\t{\n\t\t\tnext_w = w*a;\n\t\t\tif ((next_w/a) != w)\n\t\t\t\t{\n\t\t\t\tif (r_is_one)\n\t\t\t\t\t{\n\t\t\t\t\tif (!BN_TO_MONTGOMERY_WORD(r, w, mont)) goto err;\n\t\t\t\t\tr_is_one = 0;\n\t\t\t\t\t}\n\t\t\t\telse\n\t\t\t\t\t{\n\t\t\t\t\tif (!BN_MOD_MUL_WORD(r, w, m)) goto err;\n\t\t\t\t\t}\n\t\t\t\tnext_w = a;\n\t\t\t\t}\n\t\t\tw = next_w;\n\t\t\t}\n\t\t}\n\tif (w != 1)\n\t\t{\n\t\tif (r_is_one)\n\t\t\t{\n\t\t\tif (!BN_TO_MONTGOMERY_WORD(r, w, mont)) goto err;\n\t\t\tr_is_one = 0;\n\t\t\t}\n\t\telse\n\t\t\t{\n\t\t\tif (!BN_MOD_MUL_WORD(r, w, m)) goto err;\n\t\t\t}\n\t\t}\n\tif (r_is_one)\n\t\t{\n\t\tif (!BN_one(rr)) goto err;\n\t\t}\n\telse\n\t\t{\n\t\tif (!BN_from_montgomery(rr, r, mont, ctx)) goto err;\n\t\t}\n\tret = 1;\nerr:\n\tif ((in_mont == NULL) && (mont != NULL)) BN_MONT_CTX_free(mont);\n\tBN_CTX_end(ctx);\n\tbn_check_top(rr);\n\treturn(ret);\n\t}', 'int BN_mod_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *m,\n\tBN_CTX *ctx)\n\t{\n\tBIGNUM *t;\n\tint ret=0;\n\tbn_check_top(a);\n\tbn_check_top(b);\n\tbn_check_top(m);\n\tBN_CTX_start(ctx);\n\tif ((t = BN_CTX_get(ctx)) == NULL) goto err;\n\tif (a == b)\n\t\t{ if (!BN_sqr(t,a,ctx)) goto err; }\n\telse\n\t\t{ if (!BN_mul(t,a,b,ctx)) goto err; }\n\tif (!BN_nnmod(r,t,m,ctx)) goto err;\n\tbn_check_top(r);\n\tret=1;\nerr:\n\tBN_CTX_end(ctx);\n\treturn(ret);\n\t}', 'static int verify_zkp(const JPAKE_STEP_PART *p, const BIGNUM *zkpg,\n\t\t      JPAKE_CTX *ctx)\n    {\n    BIGNUM *h = BN_new();\n    BIGNUM *t1 = BN_new();\n    BIGNUM *t2 = BN_new();\n    BIGNUM *t3 = BN_new();\n    int ret = 0;\n    zkp_hash(h, zkpg, p, ctx->p.peer_name);\n    BN_mod_exp(t1, zkpg, p->zkpx.b, ctx->p.p, ctx->ctx);\n    BN_mod_exp(t2, p->gx, h, ctx->p.p, ctx->ctx);\n    BN_mod_mul(t3, t1, t2, ctx->p.p, ctx->ctx);\n    if(BN_cmp(t3, p->zkpx.gr) == 0)\n\tret = 1;\n    else\n\tJPAKEerr(JPAKE_F_VERIFY_ZKP, JPAKE_R_ZKP_VERIFY_FAILED);\n    BN_free(t3);\n    BN_free(t2);\n    BN_free(t1);\n    BN_free(h);\n    return ret;\n    }', 'int BN_mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,\n\t\t    const BIGNUM *m, BN_CTX *ctx)\n\t{\n\tint i,j,bits,ret=0,wstart,wend,window,wvalue;\n\tint start=1;\n\tBIGNUM *aa;\n\tBIGNUM *val[TABLE_SIZE];\n\tBN_RECP_CTX recp;\n\tif (BN_get_flags(p, BN_FLG_CONSTTIME) != 0)\n\t\t{\n\t\tBNerr(BN_F_BN_MOD_EXP_RECP,ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);\n\t\treturn -1;\n\t\t}\n\tbits=BN_num_bits(p);\n\tif (bits == 0)\n\t\t{\n\t\tret = BN_one(r);\n\t\treturn ret;\n\t\t}\n\tBN_CTX_start(ctx);\n\taa = BN_CTX_get(ctx);\n\tval[0] = BN_CTX_get(ctx);\n\tif(!aa || !val[0]) goto err;\n\tBN_RECP_CTX_init(&recp);\n\tif (m->neg)\n\t\t{\n\t\tif (!BN_copy(aa, m)) goto err;\n\t\taa->neg = 0;\n\t\tif (BN_RECP_CTX_set(&recp,aa,ctx) <= 0) goto err;\n\t\t}\n\telse\n\t\t{\n\t\tif (BN_RECP_CTX_set(&recp,m,ctx) <= 0) goto err;\n\t\t}\n\tif (!BN_nnmod(val[0],a,m,ctx)) goto err;\n\tif (BN_is_zero(val[0]))\n\t\t{\n\t\tBN_zero(r);\n\t\tret = 1;\n\t\tgoto err;\n\t\t}\n\twindow = BN_window_bits_for_exponent_size(bits);\n\tif (window > 1)\n\t\t{\n\t\tif (!BN_mod_mul_reciprocal(aa,val[0],val[0],&recp,ctx))\n\t\t\tgoto err;\n\t\tj=1<<(window-1);\n\t\tfor (i=1; i<j; i++)\n\t\t\t{\n\t\t\tif(((val[i] = BN_CTX_get(ctx)) == NULL) ||\n\t\t\t\t\t!BN_mod_mul_reciprocal(val[i],val[i-1],\n\t\t\t\t\t\taa,&recp,ctx))\n\t\t\t\tgoto err;\n\t\t\t}\n\t\t}\n\tstart=1;\n\twvalue=0;\n\twstart=bits-1;\n\twend=0;\n\tif (!BN_one(r)) goto err;\n\tfor (;;)\n\t\t{\n\t\tif (BN_is_bit_set(p,wstart) == 0)\n\t\t\t{\n\t\t\tif (!start)\n\t\t\t\tif (!BN_mod_mul_reciprocal(r,r,r,&recp,ctx))\n\t\t\t\tgoto err;\n\t\t\tif (wstart == 0) break;\n\t\t\twstart--;\n\t\t\tcontinue;\n\t\t\t}\n\t\tj=wstart;\n\t\twvalue=1;\n\t\twend=0;\n\t\tfor (i=1; i<window; i++)\n\t\t\t{\n\t\t\tif (wstart-i < 0) break;\n\t\t\tif (BN_is_bit_set(p,wstart-i))\n\t\t\t\t{\n\t\t\t\twvalue<<=(i-wend);\n\t\t\t\twvalue|=1;\n\t\t\t\twend=i;\n\t\t\t\t}\n\t\t\t}\n\t\tj=wend+1;\n\t\tif (!start)\n\t\t\tfor (i=0; i<j; i++)\n\t\t\t\t{\n\t\t\t\tif (!BN_mod_mul_reciprocal(r,r,r,&recp,ctx))\n\t\t\t\t\tgoto err;\n\t\t\t\t}\n\t\tif (!BN_mod_mul_reciprocal(r,r,val[wvalue>>1],&recp,ctx))\n\t\t\tgoto err;\n\t\twstart-=wend+1;\n\t\twvalue=0;\n\t\tstart=0;\n\t\tif (wstart < 0) break;\n\t\t}\n\tret=1;\nerr:\n\tBN_CTX_end(ctx);\n\tBN_RECP_CTX_free(&recp);\n\tbn_check_top(r);\n\treturn(ret);\n\t}', 'int BN_RECP_CTX_set(BN_RECP_CTX *recp, const BIGNUM *d, BN_CTX *ctx)\n\t{\n\tif (!BN_copy(&(recp->N),d)) return 0;\n\tBN_zero(&(recp->Nr));\n\trecp->num_bits=BN_num_bits(d);\n\trecp->shift=0;\n\treturn(1);\n\t}', 'BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)\n\t{\n\tint i;\n\tBN_ULONG *A;\n\tconst BN_ULONG *B;\n\tbn_check_top(b);\n\tif (a == b) return(a);\n\tif (bn_wexpand(a,b->top) == NULL) return(NULL);\n#if 1\n\tA=a->d;\n\tB=b->d;\n\tfor (i=b->top>>2; i>0; i--,A+=4,B+=4)\n\t\t{\n\t\tBN_ULONG a0,a1,a2,a3;\n\t\ta0=B[0]; a1=B[1]; a2=B[2]; a3=B[3];\n\t\tA[0]=a0; A[1]=a1; A[2]=a2; A[3]=a3;\n\t\t}\n\tswitch (b->top&3)\n\t\t{\n\t\tcase 3: A[2]=B[2];\n\t\tcase 2: A[1]=B[1];\n\t\tcase 1: A[0]=B[0];\n\t\tcase 0: ;\n\t\t}\n#else\n\tmemcpy(a->d,b->d,sizeof(b->d[0])*b->top);\n#endif\n\ta->top=b->top;\n\ta->neg=b->neg;\n\tbn_check_top(a);\n\treturn(a);\n\t}', 'int BN_num_bits(const BIGNUM *a)\n\t{\n\tint i = a->top - 1;\n\tbn_check_top(a);\n\tif (BN_is_zero(a)) return 0;\n\treturn ((i*BN_BITS2) + BN_num_bits_word(a->d[i]));\n\t}']