crypto/srp/srp_vfy.c:580: error: BUFFER_OVERRUN_L3
  Offset: [-2, +oo] Size: 2500 by call to `t_tob64`.
Showing all 7 steps of the trace


crypto/srp/srp_vfy.c:526:1: Array declaration
524.      create a verifier (*salt,*verifier,g and N are in base64)
525.   */
526. > char *SRP_create_verifier(const char *user, const char *pass, char **salt,
527.   						  char **verifier, const char *N, const char *g)
528.   	{

crypto/srp/srp_vfy.c:580:2: Call
578.   	if (((vf = OPENSSL_malloc(BN_num_bytes(v)*2)) == NULL))
579.   		goto err;
580.   	t_tob64(vf, tmp, BN_num_bytes(v));
        ^
581.   
582.   	*verifier = vf;

crypto/srp/srp_vfy.c:126:1: <Offset trace>
124.    * Convert a raw byte string into a null-terminated base64 ASCII string.
125.    */
126. > static char *t_tob64(char *dst, const unsigned char *src, int size)
127.   	{
128.   	int c, pos = size % 3;

crypto/srp/srp_vfy.c:126:1: Parameter `size`
  124.    * Convert a raw byte string into a null-terminated base64 ASCII string.
  125.    */
  126. > static char *t_tob64(char *dst, const unsigned char *src, int size)
  127.   	{
  128.   	int c, pos = size % 3;

crypto/srp/srp_vfy.c:126:1: <Length trace>
124.    * Convert a raw byte string into a null-terminated base64 ASCII string.
125.    */
126. > static char *t_tob64(char *dst, const unsigned char *src, int size)
127.   	{
128.   	int c, pos = size % 3;

crypto/srp/srp_vfy.c:126:1: Parameter `*src`
  124.    * Convert a raw byte string into a null-terminated base64 ASCII string.
  125.    */
  126. > static char *t_tob64(char *dst, const unsigned char *src, int size)
  127.   	{
  128.   	int c, pos = size % 3;

crypto/srp/srp_vfy.c:172:9: Array access: Offset: [-2, +oo] Size: 2500 by call to `t_tob64` 
  170.   		else
  171.   			{
  172.   			b0 = src[pos++];
                 ^
  173.   			b1 = src[pos++];
  174.   			b2 = src[pos++];

static char *t_tob64(char *dst, const unsigned char *src, int size)
	{
	int c, pos = size % 3;
	unsigned char b0 = 0, b1 = 0, b2 = 0, notleading = 0;
	char *olddst = dst;
	switch(pos)
		{
	case 1:
		b2 = src[0];
		break;
	case 2:
		b1 = src[0];
		b2 = src[1];
		break;
		}
	while(1)
		{
		c = (b0 & 0xfc) >> 2;
		if(notleading || c != 0)
			{
			*dst++ = b64table[c];
			notleading = 1;
			}
		c = ((b0 & 3) << 4) | ((b1 & 0xf0) >> 4);
		if(notleading || c != 0)
			{
			*dst++ = b64table[c];
			notleading = 1;
			}
		c = ((b1 & 0xf) << 2) | ((b2 & 0xc0) >> 6);
		if(notleading || c != 0)
			{
			*dst++ = b64table[c];
			notleading = 1;
			}
		c = b2 & 0x3f;
		if(notleading || c != 0)
			{
			*dst++ = b64table[c];
			notleading = 1;
			}
		if(pos >= size) break;
		else
			{
			b0 = src[pos++];
			b1 = src[pos++];
			b2 = src[pos++];
			}
		}
	*dst++ = '\0';
	return olddst;
	}
['char *SRP_create_verifier(const char *user, const char *pass, char **salt,\n\t\t\t\t\t\t  char **verifier, const char *N, const char *g)\n\t{\n\tint len;\n\tchar * result=NULL;\n\tchar *vf;\n\tBIGNUM *N_bn = NULL, *g_bn = NULL, *s = NULL, *v = NULL;\n\tunsigned char tmp[MAX_LEN];\n\tunsigned char tmp2[MAX_LEN];\n\tchar * defgNid = NULL;\n\tif ((user == NULL)||\n\t\t(pass == NULL)||\n\t\t(salt == NULL)||\n\t\t(verifier == NULL))\n\t\tgoto err;\n\tif (N)\n\t\t{\n\t\tif (!(len = t_fromb64(tmp, N))) goto err;\n\t\tN_bn = BN_bin2bn(tmp,len,NULL);\n\t\tif (!(len = t_fromb64(tmp, g))) goto err;\n\t\tg_bn = BN_bin2bn(tmp, len, NULL);\n\t\tdefgNid = "*";\n\t\t}\n\telse\n\t\t{\n\t\tSRP_gN * gN = SRP_get_gN_by_id(g, NULL) ;\n\t\tif (gN == NULL)\n\t\t\tgoto err;\n\t\tN_bn = gN->N;\n\t\tg_bn = gN->g;\n\t\tdefgNid = gN->id;\n\t\t}\n\tif (*salt == NULL)\n\t\t{\n\t\tRAND_pseudo_bytes(tmp2, SRP_RANDOM_SALT_LEN);\n\t\ts = BN_bin2bn(tmp2, SRP_RANDOM_SALT_LEN, NULL);\n\t\t}\n\telse\n\t\t{\n\t\tif (!(len = t_fromb64(tmp2, *salt)))\n\t\t\tgoto err;\n\t\ts = BN_bin2bn(tmp2,len,NULL);\n\t\t}\n\tif(!SRP_create_verifier_BN(user, pass, &s, &v, N_bn, g_bn)) goto err;\n\tBN_bn2bin(v,tmp);\n\tif (((vf = OPENSSL_malloc(BN_num_bytes(v)*2)) == NULL))\n\t\tgoto err;\n\tt_tob64(vf, tmp, BN_num_bytes(v));\n\t*verifier = vf;\n\tif (*salt == NULL)\n\t\t{\n\t\tchar *tmp_salt;\n\t\tif ((tmp_salt = OPENSSL_malloc(SRP_RANDOM_SALT_LEN*2)) == NULL)\n\t\t\t{\n\t\t\tOPENSSL_free(vf);\n\t\t\tgoto err;\n\t\t\t}\n\t\tt_tob64(tmp_salt,tmp2,SRP_RANDOM_SALT_LEN);\n\t\t*salt = tmp_salt;\n\t\t}\n\tresult=defgNid;\nerr:\n\tif(N)\n\t\t{\n\t\tBN_free(N_bn);\n\t\tBN_free(g_bn);\n\t\t}\n\treturn result;\n\t}', "static char *t_tob64(char *dst, const unsigned char *src, int size)\n\t{\n\tint c, pos = size % 3;\n\tunsigned char b0 = 0, b1 = 0, b2 = 0, notleading = 0;\n\tchar *olddst = dst;\n\tswitch(pos)\n\t\t{\n\tcase 1:\n\t\tb2 = src[0];\n\t\tbreak;\n\tcase 2:\n\t\tb1 = src[0];\n\t\tb2 = src[1];\n\t\tbreak;\n\t\t}\n\twhile(1)\n\t\t{\n\t\tc = (b0 & 0xfc) >> 2;\n\t\tif(notleading || c != 0)\n\t\t\t{\n\t\t\t*dst++ = b64table[c];\n\t\t\tnotleading = 1;\n\t\t\t}\n\t\tc = ((b0 & 3) << 4) | ((b1 & 0xf0) >> 4);\n\t\tif(notleading || c != 0)\n\t\t\t{\n\t\t\t*dst++ = b64table[c];\n\t\t\tnotleading = 1;\n\t\t\t}\n\t\tc = ((b1 & 0xf) << 2) | ((b2 & 0xc0) >> 6);\n\t\tif(notleading || c != 0)\n\t\t\t{\n\t\t\t*dst++ = b64table[c];\n\t\t\tnotleading = 1;\n\t\t\t}\n\t\tc = b2 & 0x3f;\n\t\tif(notleading || c != 0)\n\t\t\t{\n\t\t\t*dst++ = b64table[c];\n\t\t\tnotleading = 1;\n\t\t\t}\n\t\tif(pos >= size) break;\n\t\telse\n\t\t\t{\n\t\t\tb0 = src[pos++];\n\t\t\tb1 = src[pos++];\n\t\t\tb2 = src[pos++];\n\t\t\t}\n\t\t}\n\t*dst++ = '\\0';\n\treturn olddst;\n\t}"]