crypto/bn/bn_print.c:104: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: [0, +oo].
Showing all 12 steps of the trace


crypto/bn/bn_print.c:68:9: <Length trace>
66.        *     <= 3 * BN_num_bits(a) / 10 + 3 * BN_num_bits / 1000 + 1 + 1
67.        */
68.       i = BN_num_bits(a) * 3;
              ^
69.       num = (i / 10 + i / 1000 + 1) + 1;
70.       tbytes = num + 3;   /* negative and terminator and one spare? */

crypto/bn/bn_print.c:68:9: Call
66.        *     <= 3 * BN_num_bits(a) / 10 + 3 * BN_num_bits / 1000 + 1 + 1
67.        */
68.       i = BN_num_bits(a) * 3;
              ^
69.       num = (i / 10 + i / 1000 + 1) + 1;
70.       tbytes = num + 3;   /* negative and terminator and one spare? */

crypto/bn/bn_lib.c:167:9: Assignment
  165.   
  166.       if (BN_is_zero(a))
  167.           return 0;
                 ^
  168.       return ((i * BN_BITS2) + BN_num_bits_word(a->d[i]));
  169.   }

crypto/bn/bn_print.c:68:5: Assignment
66.        *     <= 3 * BN_num_bits(a) / 10 + 3 * BN_num_bits / 1000 + 1 + 1
67.        */
68.       i = BN_num_bits(a) * 3;
          ^
69.       num = (i / 10 + i / 1000 + 1) + 1;
70.       tbytes = num + 3;   /* negative and terminator and one spare? */

crypto/bn/bn_print.c:69:5: Assignment
67.        */
68.       i = BN_num_bits(a) * 3;
69.       num = (i / 10 + i / 1000 + 1) + 1;
          ^
70.       tbytes = num + 3;   /* negative and terminator and one spare? */
71.       bn_data_num = num / BN_DEC_NUM + 1;

crypto/bn/bn_print.c:71:5: Assignment
69.       num = (i / 10 + i / 1000 + 1) + 1;
70.       tbytes = num + 3;   /* negative and terminator and one spare? */
71.       bn_data_num = num / BN_DEC_NUM + 1;
          ^
72.       bn_data = OPENSSL_malloc(bn_data_num * sizeof(BN_ULONG));
73.       buf = OPENSSL_malloc(tbytes);

crypto/bn/bn_print.c:72:15: Call
70.       tbytes = num + 3;   /* negative and terminator and one spare? */
71.       bn_data_num = num / BN_DEC_NUM + 1;
72.       bn_data = OPENSSL_malloc(bn_data_num * sizeof(BN_ULONG));
                    ^
73.       buf = OPENSSL_malloc(tbytes);
74.       if (buf == NULL || bn_data == NULL) {

crypto/mem.c:177:9: Assignment
  175.   
  176.       if (num == 0)
  177.           return NULL;
                 ^
  178.   
  179.       FAILTEST();

crypto/bn/bn_print.c:72:5: Assignment
70.       tbytes = num + 3;   /* negative and terminator and one spare? */
71.       bn_data_num = num / BN_DEC_NUM + 1;
72.       bn_data = OPENSSL_malloc(bn_data_num * sizeof(BN_ULONG));
          ^
73.       buf = OPENSSL_malloc(tbytes);
74.       if (buf == NULL || bn_data == NULL) {

crypto/bn/bn_print.c:82:5: Assignment
80.   
81.       p = buf;
82.       lp = bn_data;
          ^
83.       if (BN_is_zero(t)) {
84.           *p++ = '0';

crypto/bn/bn_print.c:98:9: Assignment
96.               lp++;
97.           }
98.           lp--;
               ^
99.           /*
100.            * We now have a series of blocks, BN_DEC_NUM chars in length, where

crypto/bn/bn_print.c:104:70: Array access: Offset: [-1, +oo] Size: [0, +oo]
102.            * order.
103.            */
104.           n = BIO_snprintf(p, tbytes - (size_t)(p - buf), BN_DEC_FMT1, *lp);
                                                                            ^
105.           if (n < 0)
106.               goto err;

char *BN_bn2dec(const BIGNUM *a)
{
    int i = 0, num, ok = 0, n, tbytes;
    char *buf = NULL;
    char *p;
    BIGNUM *t = NULL;
    BN_ULONG *bn_data = NULL, *lp;
    int bn_data_num;
    i = BN_num_bits(a) * 3;
    num = (i / 10 + i / 1000 + 1) + 1;
    tbytes = num + 3;
    bn_data_num = num / BN_DEC_NUM + 1;
    bn_data = OPENSSL_malloc(bn_data_num * sizeof(BN_ULONG));
    buf = OPENSSL_malloc(tbytes);
    if (buf == NULL || bn_data == NULL) {
        BNerr(BN_F_BN_BN2DEC, ERR_R_MALLOC_FAILURE);
        goto err;
    }
    if ((t = BN_dup(a)) == NULL)
        goto err;
    p = buf;
    lp = bn_data;
    if (BN_is_zero(t)) {
        *p++ = '0';
        *p++ = '\0';
    } else {
        if (BN_is_negative(t))
            *p++ = '-';
        while (!BN_is_zero(t)) {
            if (lp - bn_data >= bn_data_num)
                goto err;
            *lp = BN_div_word(t, BN_DEC_CONV);
            if (*lp == (BN_ULONG)-1)
                goto err;
            lp++;
        }
        lp--;
        n = BIO_snprintf(p, tbytes - (size_t)(p - buf), BN_DEC_FMT1, *lp);
        if (n < 0)
            goto err;
        p += n;
        while (lp != bn_data) {
            lp--;
            n = BIO_snprintf(p, tbytes - (size_t)(p - buf), BN_DEC_FMT2, *lp);
            if (n < 0)
                goto err;
            p += n;
        }
    }
    ok = 1;
 err:
    OPENSSL_free(bn_data);
    BN_free(t);
    if (ok)
        return buf;
    OPENSSL_free(buf);
    return NULL;
}
["char *BN_bn2dec(const BIGNUM *a)\n{\n    int i = 0, num, ok = 0, n, tbytes;\n    char *buf = NULL;\n    char *p;\n    BIGNUM *t = NULL;\n    BN_ULONG *bn_data = NULL, *lp;\n    int bn_data_num;\n    i = BN_num_bits(a) * 3;\n    num = (i / 10 + i / 1000 + 1) + 1;\n    tbytes = num + 3;\n    bn_data_num = num / BN_DEC_NUM + 1;\n    bn_data = OPENSSL_malloc(bn_data_num * sizeof(BN_ULONG));\n    buf = OPENSSL_malloc(tbytes);\n    if (buf == NULL || bn_data == NULL) {\n        BNerr(BN_F_BN_BN2DEC, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    if ((t = BN_dup(a)) == NULL)\n        goto err;\n    p = buf;\n    lp = bn_data;\n    if (BN_is_zero(t)) {\n        *p++ = '0';\n        *p++ = '\\0';\n    } else {\n        if (BN_is_negative(t))\n            *p++ = '-';\n        while (!BN_is_zero(t)) {\n            if (lp - bn_data >= bn_data_num)\n                goto err;\n            *lp = BN_div_word(t, BN_DEC_CONV);\n            if (*lp == (BN_ULONG)-1)\n                goto err;\n            lp++;\n        }\n        lp--;\n        n = BIO_snprintf(p, tbytes - (size_t)(p - buf), BN_DEC_FMT1, *lp);\n        if (n < 0)\n            goto err;\n        p += n;\n        while (lp != bn_data) {\n            lp--;\n            n = BIO_snprintf(p, tbytes - (size_t)(p - buf), BN_DEC_FMT2, *lp);\n            if (n < 0)\n                goto err;\n            p += n;\n        }\n    }\n    ok = 1;\n err:\n    OPENSSL_free(bn_data);\n    BN_free(t);\n    if (ok)\n        return buf;\n    OPENSSL_free(buf);\n    return NULL;\n}", 'int BN_num_bits(const BIGNUM *a)\n{\n    int i = a->top - 1;\n    bn_check_top(a);\n    if (BN_is_zero(a))\n        return 0;\n    return ((i * BN_BITS2) + BN_num_bits_word(a->d[i]));\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)\n        return malloc_impl(num, file, line);\n    if (num == 0)\n        return NULL;\n    FAILTEST();\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    (void)(file); (void)(line);\n    ret = malloc(num);\n#endif\n    return ret;\n}']