crypto/bn/bn_blind.c:255: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, 8388607] by call to `int_bn_mod_inverse`.
Showing all 28 steps of the trace


crypto/bn/bn_blind.c:255:14: Call
253.           if (!BN_priv_rand_range(ret->A, ret->mod))
254.               goto err;
255.           if (!int_bn_mod_inverse(ret->Ai, ret->A, ret->mod, ctx, &rv)) {
                    ^
256.               /*
257.                * this should almost never happen for good RSA keys

crypto/bn/bn_gcd.c:135:1: Parameter `in->top`
  133.   }
  134.   
  135. > BIGNUM *int_bn_mod_inverse(BIGNUM *in,
  136.                              const BIGNUM *a, const BIGNUM *n, BN_CTX *ctx,
  137.                              int *pnoinv)

crypto/bn/bn_blind.c:255:14: Call
253.           if (!BN_priv_rand_range(ret->A, ret->mod))
254.               goto err;
255.           if (!int_bn_mod_inverse(ret->Ai, ret->A, ret->mod, ctx, &rv)) {
                    ^
256.               /*
257.                * this should almost never happen for good RSA keys

crypto/bn/bn_gcd.c:135:1: Parameter `n->top`
  133.   }
  134.   
  135. > BIGNUM *int_bn_mod_inverse(BIGNUM *in,
  136.                              const BIGNUM *a, const BIGNUM *n, BN_CTX *ctx,
  137.                              int *pnoinv)

crypto/bn/bn_gcd.c:144:9: Call
  142.   
  143.       /* This is invalid input so we don't worry about constant time here */
  144.       if (BN_abs_is_word(n, 1) || BN_is_zero(n)) {
                 ^
  145.           if (pnoinv != NULL)
  146.               *pnoinv = 1;

crypto/bn/bn_lib.c:840:1: Parameter `a->top`
    838.   }
    839.   
    840. > int BN_abs_is_word(const BIGNUM *a, const BN_ULONG w)
    841.   {
    842.       return ((a->top == 1) && (a->d[0] == w)) || ((w == 0) && (a->top == 0));

crypto/bn/bn_gcd.c:144:33: Call
  142.   
  143.       /* This is invalid input so we don't worry about constant time here */
  144.       if (BN_abs_is_word(n, 1) || BN_is_zero(n)) {
                                         ^
  145.           if (pnoinv != NULL)
  146.               *pnoinv = 1;

crypto/bn/bn_lib.c:845:1: Parameter `a->top`
    843.   }
    844.   
    845. > int BN_is_zero(const BIGNUM *a)
    846.   {
    847.       return a->top == 0;

crypto/bn/bn_gcd.c:155:16: Call
  153.       if ((BN_get_flags(a, BN_FLG_CONSTTIME) != 0)
  154.           || (BN_get_flags(n, BN_FLG_CONSTTIME) != 0)) {
  155.           return BN_mod_inverse_no_branch(in, a, n, ctx);
                        ^
  156.       }
  157.   

crypto/bn/bn_gcd.c:458:1: Parameter `n->top`
    456.    * not contain branches that may leak sensitive information.
    457.    */
    458. > static BIGNUM *BN_mod_inverse_no_branch(BIGNUM *in,
    459.                                           const BIGNUM *a, const BIGNUM *n,
    460.                                           BN_CTX *ctx)

crypto/bn/bn_gcd.c:491:9: Call
    489.       if (BN_copy(B, a) == NULL)
    490.           goto err;
    491.       if (BN_copy(A, n) == NULL)
                   ^
    492.           goto err;
    493.       A->neg = 0;

crypto/bn/bn_lib.c:285:1: Parameter `b->top`
      283.   }
      284.   
      285. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      286.   {
      287.       bn_check_top(b);

crypto/bn/bn_gcd.c:609:18: Call
    607.                   goto err;
    608.           } else {
    609.               if (!BN_nnmod(R, Y, n, ctx))
                            ^
    610.                   goto err;
    611.           }

crypto/bn/bn_mod.c:13:1: Parameter `d->top`
      11.   #include "bn_lcl.h"
      12.   
      13. > int BN_nnmod(BIGNUM *r, const BIGNUM *m, const BIGNUM *d, BN_CTX *ctx)
      14.   {
      15.       /*

crypto/bn/bn_mod.c:20:11: Call
      18.        */
      19.   
      20.       if (!(BN_mod(r, m, d, ctx)))
                      ^
      21.           return 0;
      22.       if (!r->neg)

crypto/bn/bn_div.c:199:31: Call
        197.   
        198.       /* First we normalise the numbers */
        199.       norm_shift = BN_BITS2 - ((BN_num_bits(divisor)) % BN_BITS2);
                                             ^
        200.       if (!(BN_lshift(sdiv, divisor, norm_shift)))
        201.           goto err;

crypto/bn/bn_lib.c:140:9: Assignment
          138.   
          139.       if (BN_is_zero(a))
          140.           return 0;
                         ^
          141.       return ((i * BN_BITS2) + BN_num_bits_word(a->d[i]));
          142.   }

crypto/bn/bn_div.c:199:5: Assignment
        197.   
        198.       /* First we normalise the numbers */
        199.       norm_shift = BN_BITS2 - ((BN_num_bits(divisor)) % BN_BITS2);
                   ^
        200.       if (!(BN_lshift(sdiv, divisor, norm_shift)))
        201.           goto err;

crypto/bn/bn_div.c:200:11: Call
        198.       /* First we normalise the numbers */
        199.       norm_shift = BN_BITS2 - ((BN_num_bits(divisor)) % BN_BITS2);
        200.       if (!(BN_lshift(sdiv, divisor, norm_shift)))
                         ^
        201.           goto err;
        202.       sdiv->neg = 0;

crypto/bn/bn_shift.c:83:1: <Offset trace>
81.   }
82.   
83. > int BN_lshift(BIGNUM *r, const BIGNUM *a, int n)
84.   {
85.       int i, nw, lb, rb;

crypto/bn/bn_shift.c:83:1: Parameter `n`
          81.   }
          82.   
          83. > int BN_lshift(BIGNUM *r, const BIGNUM *a, int n)
          84.   {
          85.       int i, nw, lb, rb;

crypto/bn/bn_shift.c:97:5: Assignment
          95.       }
          96.   
          97.       nw = n / BN_BITS2;
                     ^
          98.       if (bn_wexpand(r, a->top + nw + 1) == NULL)
          99.           return 0;

crypto/bn/bn_shift.c:83:1: <Length trace>
81.   }
82.   
83. > int BN_lshift(BIGNUM *r, const BIGNUM *a, int n)
84.   {
85.       int i, nw, lb, rb;

crypto/bn/bn_shift.c:83:1: Parameter `*r->d`
          81.   }
          82.   
          83. > int BN_lshift(BIGNUM *r, const BIGNUM *a, int n)
          84.   {
          85.       int i, nw, lb, rb;

crypto/bn/bn_shift.c:98:9: Call
          96.   
          97.       nw = n / BN_BITS2;
          98.       if (bn_wexpand(r, a->top + nw + 1) == NULL)
                         ^
          99.           return 0;
          100.       r->neg = a->neg;

crypto/bn/bn_lib.c:941:1: Parameter `*a->d`
            939.   }
            940.   
            941. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
            942.   {
            943.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_shift.c:104:5: Assignment
          102.       rb = BN_BITS2 - lb;
          103.       f = a->d;
          104.       t = r->d;
                     ^
          105.       t[a->top + nw] = 0;
          106.       if (lb == 0)

crypto/bn/bn_shift.c:112:13: Array access: Offset: [1, +oo] Size: [0, 8388607] by call to `int_bn_mod_inverse` 
          110.           for (i = a->top - 1; i >= 0; i--) {
          111.               l = f[i];
          112.               t[nw + i + 1] |= (l >> rb) & BN_MASK2;
                             ^
          113.               t[nw + i] = (l << lb) & BN_MASK2;
          114.           }
