crypto/rsa/rsa_eay.c:133: error: BUFFER_OVERRUN_L3
  Offset added: [10, +oo] (⇐ [2, +oo] + 8) Size: [0, +oo] by call to `RSA_padding_add_SSLv23`.
Showing all 12 steps of the trace


crypto/rsa/rsa_eay.c:117:6: Call
115.   	BN_init(&ret);
116.   	if ((ctx=BN_CTX_new()) == NULL) goto err;
117.   	num=BN_num_bytes(rsa->n);
            ^
118.   	if ((buf=(unsigned char *)Malloc(num)) == NULL)
119.   		{

crypto/bn/bn_lib.c:245:19: Assignment
  243.   	bn_check_top(a);
  244.   
  245.   	if (a->top == 0) return(0);
                           ^
  246.   	l=a->d[a->top-1];
  247.   	i=(a->top-1)*BN_BITS2;

crypto/rsa/rsa_eay.c:117:2: Assignment
115.   	BN_init(&ret);
116.   	if ((ctx=BN_CTX_new()) == NULL) goto err;
117.   	num=BN_num_bytes(rsa->n);
        ^
118.   	if ((buf=(unsigned char *)Malloc(num)) == NULL)
119.   		{

crypto/rsa/rsa_eay.c:118:28: Array declaration
116.   	if ((ctx=BN_CTX_new()) == NULL) goto err;
117.   	num=BN_num_bytes(rsa->n);
118.   	if ((buf=(unsigned char *)Malloc(num)) == NULL)
                                  ^
119.   		{
120.   		RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT,ERR_R_MALLOC_FAILURE);

crypto/rsa/rsa_eay.c:118:7: Assignment
116.   	if ((ctx=BN_CTX_new()) == NULL) goto err;
117.   	num=BN_num_bytes(rsa->n);
118.   	if ((buf=(unsigned char *)Malloc(num)) == NULL)
             ^
119.   		{
120.   		RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT,ERR_R_MALLOC_FAILURE);

crypto/rsa/rsa_eay.c:133:5: Call
131.   		break;
132.   	case RSA_SSLV23_PADDING:
133.   		i=RSA_padding_add_SSLv23(buf,num,from,flen);
           ^
134.   		break;
135.   	case RSA_NO_PADDING:

crypto/rsa/rsa_ssl.c:65:1: <Length trace>
63.   #include "rand.h"
64.   
65. > int RSA_padding_add_SSLv23(unsigned char *to, int tlen, unsigned char *from,
66.   	     int flen)
67.   	{

crypto/rsa/rsa_ssl.c:65:1: Parameter `*to`
  63.   #include "rand.h"
  64.   
  65. > int RSA_padding_add_SSLv23(unsigned char *to, int tlen, unsigned char *from,
  66.   	     int flen)
  67.   	{

crypto/rsa/rsa_ssl.c:77:2: Assignment
  75.   		}
  76.   	
  77.   	p=(unsigned char *)to;
         ^
  78.   
  79.   	*(p++)=0;

crypto/rsa/rsa_ssl.c:79:4: Assignment
  77.   	p=(unsigned char *)to;
  78.   
  79.   	*(p++)=0;
           ^
  80.   	*(p++)=2; /* Public Key BT (Block Type) */
  81.   

crypto/rsa/rsa_ssl.c:80:4: Assignment
  78.   
  79.   	*(p++)=0;
  80.   	*(p++)=2; /* Public Key BT (Block Type) */
           ^
  81.   
  82.   	/* pad out with non-zero random data */

crypto/rsa/rsa_ssl.c:95:2: Array access: Offset added: [10, +oo] (⇐ [2, +oo] + 8) Size: [0, +oo] by call to `RSA_padding_add_SSLv23` 
  93.   		}
  94.   
  95.   	memset(p,3,8);
         ^
  96.   	p+=8;
  97.   	*(p++)='\0';

int RSA_padding_add_SSLv23(unsigned char *to, int tlen, unsigned char *from,
	     int flen)
	{
	int i,j;
	unsigned char *p;
	if (flen > (tlen-11))
		{
		RSAerr(RSA_F_RSA_PADDING_ADD_SSLV23,RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE);
		return(0);
		}
	p=(unsigned char *)to;
	*(p++)=0;
	*(p++)=2;
	j=tlen-3-8-flen;
	RAND_bytes(p,j);
	for (i=0; i<j; i++)
		{
		if (*p == '\0')
			do	{
				RAND_bytes(p,1);
				} while (*p == '\0');
		p++;
		}
	memset(p,3,8);
	p+=8;
	*(p++)='\0';
	memcpy(p,from,(unsigned int)flen);
	return(1);
	}
['static int RSA_eay_public_encrypt(int flen, unsigned char *from,\n\t     unsigned char *to, RSA *rsa, int padding)\n\t{\n\tBIGNUM f,ret;\n\tint i,j,k,num=0,r= -1;\n\tunsigned char *buf=NULL;\n\tBN_CTX *ctx=NULL;\n\tBN_init(&f);\n\tBN_init(&ret);\n\tif ((ctx=BN_CTX_new()) == NULL) goto err;\n\tnum=BN_num_bytes(rsa->n);\n\tif ((buf=(unsigned char *)Malloc(num)) == NULL)\n\t\t{\n\t\tRSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT,ERR_R_MALLOC_FAILURE);\n\t\tgoto err;\n\t\t}\n\tswitch (padding)\n\t\t{\n\tcase RSA_PKCS1_PADDING:\n\t\ti=RSA_padding_add_PKCS1_type_2(buf,num,from,flen);\n\t\tbreak;\n\tcase RSA_PKCS1_OAEP_PADDING:\n\t        i=RSA_padding_add_PKCS1_OAEP(buf,num,from,flen,NULL,0);\n\t\tbreak;\n\tcase RSA_SSLV23_PADDING:\n\t\ti=RSA_padding_add_SSLv23(buf,num,from,flen);\n\t\tbreak;\n\tcase RSA_NO_PADDING:\n\t\ti=RSA_padding_add_none(buf,num,from,flen);\n\t\tbreak;\n\tdefault:\n\t\tRSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT,RSA_R_UNKNOWN_PADDING_TYPE);\n\t\tgoto err;\n\t\t}\n\tif (i <= 0) goto err;\n\tif (BN_bin2bn(buf,num,&f) == NULL) goto err;\n\tif ((rsa->_method_mod_n == NULL) && (rsa->flags & RSA_FLAG_CACHE_PUBLIC))\n\t\t{\n\t\tif ((rsa->_method_mod_n=BN_MONT_CTX_new()) != NULL)\n\t\t\tif (!BN_MONT_CTX_set(rsa->_method_mod_n,rsa->n,ctx))\n\t\t\t    goto err;\n\t\t}\n\tif (!rsa->meth->bn_mod_exp(&ret,&f,rsa->e,rsa->n,ctx,\n\t\trsa->_method_mod_n)) goto err;\n\tj=BN_num_bytes(&ret);\n\ti=BN_bn2bin(&ret,&(to[num-j]));\n\tfor (k=0; k<(num-i); k++)\n\t\tto[k]=0;\n\tr=num;\nerr:\n\tif (ctx != NULL) BN_CTX_free(ctx);\n\tBN_clear_free(&f);\n\tBN_clear_free(&ret);\n\tif (buf != NULL)\n\t\t{\n\t\tmemset(buf,0,num);\n\t\tFree(buf);\n\t\t}\n\treturn(r);\n\t}', 'int BN_num_bits(BIGNUM *a)\n\t{\n\tBN_ULONG l;\n\tint i;\n\tbn_check_top(a);\n\tif (a->top == 0) return(0);\n\tl=a->d[a->top-1];\n\ti=(a->top-1)*BN_BITS2;\n\tif (l == 0)\n\t\t{\n#if !defined(NO_STDIO) && !defined(WIN16)\n\t\tfprintf(stderr,"BAD TOP VALUE\\n");\n#endif\n\t\tabort();\n\t\t}\n\treturn(i+BN_num_bits_word(l));\n\t}', "int RSA_padding_add_SSLv23(unsigned char *to, int tlen, unsigned char *from,\n\t     int flen)\n\t{\n\tint i,j;\n\tunsigned char *p;\n\tif (flen > (tlen-11))\n\t\t{\n\t\tRSAerr(RSA_F_RSA_PADDING_ADD_SSLV23,RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE);\n\t\treturn(0);\n\t\t}\n\tp=(unsigned char *)to;\n\t*(p++)=0;\n\t*(p++)=2;\n\tj=tlen-3-8-flen;\n\tRAND_bytes(p,j);\n\tfor (i=0; i<j; i++)\n\t\t{\n\t\tif (*p == '\\0')\n\t\t\tdo\t{\n\t\t\t\tRAND_bytes(p,1);\n\t\t\t\t} while (*p == '\\0');\n\t\tp++;\n\t\t}\n\tmemset(p,3,8);\n\tp+=8;\n\t*(p++)='\\0';\n\tmemcpy(p,from,(unsigned int)flen);\n\treturn(1);\n\t}"]