crypto/asn1/a_strex.c:460: error: BUFFER_OVERRUN_L1
  Offset added: 80 Size: 32 by call to `OBJ_obj2txt`.
Showing all 6 steps of the trace


crypto/asn1/a_strex.c:460:5: Call
458.   			int objlen;
459.   			if((fn_opt == XN_FLAG_FN_OID) || (fn_nid==NID_undef) ) {
460.   				OBJ_obj2txt(objtmp, 80, fn, 1);
           ^
461.   				objbuf = objtmp;
462.   			} else {

crypto/objects/obj_dat.c:423:1: <Offset trace>
421.   	}
422.   
423. > int OBJ_obj2txt(char *buf, int buf_len, ASN1_OBJECT *a, int no_name)
424.   {
425.   	int i,idx=0,n=0,len,nid;

crypto/objects/obj_dat.c:423:1: Parameter `buf_len`
  421.   	}
  422.   
  423. > int OBJ_obj2txt(char *buf, int buf_len, ASN1_OBJECT *a, int no_name)
  424.   {
  425.   	int i,idx=0,n=0,len,nid;

crypto/objects/obj_dat.c:423:1: <Length trace>
421.   	}
422.   
423. > int OBJ_obj2txt(char *buf, int buf_len, ASN1_OBJECT *a, int no_name)
424.   {
425.   	int i,idx=0,n=0,len,nid;

crypto/objects/obj_dat.c:423:1: Array declaration
  421.   	}
  422.   
  423. > int OBJ_obj2txt(char *buf, int buf_len, ASN1_OBJECT *a, int no_name)
  424.   {
  425.   	int i,idx=0,n=0,len,nid;

crypto/objects/obj_dat.c:458:3: Array access: Offset added: 80 Size: 32 by call to `OBJ_obj2txt` 
  456.   		sprintf(tbuf,"%d.%lu",i,l);
  457.   		i=strlen(tbuf);
  458.   		strncpy(buf,tbuf,buf_len);
           ^
  459.   		buf_len-=i;
  460.   		buf+=i;

int OBJ_obj2txt(char *buf, int buf_len, ASN1_OBJECT *a, int no_name)
{
	int i,idx=0,n=0,len,nid;
	unsigned long l;
	unsigned char *p;
	const char *s;
	char tbuf[32];
	if (buf_len <= 0) return(0);
	if ((a == NULL) || (a->data == NULL)) {
		buf[0]='\0';
		return(0);
	}
	nid=OBJ_obj2nid(a);
	if ((nid == NID_undef) || no_name) {
		len=a->length;
		p=a->data;
		idx=0;
		l=0;
		while (idx < a->length) {
			l|=(p[idx]&0x7f);
			if (!(p[idx] & 0x80)) break;
			l<<=7L;
			idx++;
		}
		idx++;
		i=(int)(l/40);
		if (i > 2) i=2;
		l-=(long)(i*40);
		sprintf(tbuf,"%d.%lu",i,l);
		i=strlen(tbuf);
		strncpy(buf,tbuf,buf_len);
		buf_len-=i;
		buf+=i;
		n+=i;
		l=0;
		for (; idx<len; idx++) {
			l|=p[idx]&0x7f;
			if (!(p[idx] & 0x80)) {
				sprintf(tbuf,".%lu",l);
				i=strlen(tbuf);
				if (buf_len > 0)
					strncpy(buf,tbuf,buf_len);
				buf_len-=i;
				buf+=i;
				n+=i;
				l=0;
			}
			l<<=7L;
		}
	} else {
		s=OBJ_nid2ln(nid);
		if (s == NULL)
			s=OBJ_nid2sn(nid);
		strncpy(buf,s,buf_len);
		n=strlen(s);
	}
	buf[buf_len-1]='\0';
	return(n);
}
['static int do_name_ex(char_io *io_ch, void *arg, X509_NAME *n,\n\t\t\t\tint indent, unsigned long flags)\n{\n\tint i, prev = -1, orflags, cnt;\n\tint fn_opt, fn_nid;\n\tASN1_OBJECT *fn;\n\tASN1_STRING *val;\n\tX509_NAME_ENTRY *ent;\n\tchar objtmp[80];\n\tconst char *objbuf;\n\tint outlen, len;\n\tchar *sep_dn, *sep_mv, *sep_eq;\n\tint sep_dn_len, sep_mv_len, sep_eq_len;\n\tif(indent < 0) indent = 0;\n\toutlen = indent;\n\tif(!do_indent(io_ch, arg, indent)) return -1;\n\tswitch (flags & XN_FLAG_SEP_MASK)\n\t{\n\t\tcase XN_FLAG_SEP_MULTILINE:\n\t\tsep_dn = "\\n";\n\t\tsep_dn_len = 1;\n\t\tsep_mv = "+";\n\t\tsep_mv_len = 1;\n\t\tbreak;\n\t\tcase XN_FLAG_SEP_COMMA_PLUS:\n\t\tsep_dn = ",";\n\t\tsep_dn_len = 1;\n\t\tsep_mv = "+";\n\t\tsep_mv_len = 1;\n\t\tindent = 0;\n\t\tbreak;\n\t\tcase XN_FLAG_SEP_CPLUS_SPC:\n\t\tsep_dn = ", ";\n\t\tsep_dn_len = 2;\n\t\tsep_mv = " + ";\n\t\tsep_mv_len = 3;\n\t\tindent = 0;\n\t\tbreak;\n\t\tcase XN_FLAG_SEP_SPLUS_SPC:\n\t\tsep_dn = "; ";\n\t\tsep_dn_len = 2;\n\t\tsep_mv = " + ";\n\t\tsep_mv_len = 3;\n\t\tindent = 0;\n\t\tbreak;\n\t\tdefault:\n\t\treturn -1;\n\t}\n\tif(flags & XN_FLAG_SPC_EQ) {\n\t\tsep_eq = " = ";\n\t\tsep_eq_len = 3;\n\t} else {\n\t\tsep_eq = "=";\n\t\tsep_eq_len = 1;\n\t}\n\tfn_opt = flags & XN_FLAG_FN_MASK;\n\tcnt = X509_NAME_entry_count(n);\n\tfor(i = 0; i < cnt; i++) {\n\t\tif(flags & XN_FLAG_DN_REV)\n\t\t\t\tent = X509_NAME_get_entry(n, cnt - i - 1);\n\t\telse ent = X509_NAME_get_entry(n, i);\n\t\tif(prev != -1) {\n\t\t\tif(prev == ent->set) {\n\t\t\t\tif(!io_ch(arg, sep_mv, sep_mv_len)) return -1;\n\t\t\t\toutlen += sep_mv_len;\n\t\t\t} else {\n\t\t\t\tif(!io_ch(arg, sep_dn, sep_dn_len)) return -1;\n\t\t\t\toutlen += sep_dn_len;\n\t\t\t}\n\t\t\tif(!do_indent(io_ch, arg, indent)) return -1;\n\t\t\toutlen += indent;\n\t\t}\n\t\tprev = ent->set;\n\t\tfn = X509_NAME_ENTRY_get_object(ent);\n\t\tval = X509_NAME_ENTRY_get_data(ent);\n\t\tfn_nid = OBJ_obj2nid(fn);\n\t\tif(fn_opt != XN_FLAG_FN_NONE) {\n\t\t\tint objlen;\n\t\t\tif((fn_opt == XN_FLAG_FN_OID) || (fn_nid==NID_undef) ) {\n\t\t\t\tOBJ_obj2txt(objtmp, 80, fn, 1);\n\t\t\t\tobjbuf = objtmp;\n\t\t\t} else {\n\t\t\t\tif(fn_opt == XN_FLAG_FN_SN)\n\t\t\t\t\tobjbuf = OBJ_nid2sn(fn_nid);\n\t\t\t\telse if(fn_opt == XN_FLAG_FN_LN)\n\t\t\t\t\tobjbuf = OBJ_nid2ln(fn_nid);\n\t\t\t\telse objbuf = "";\n\t\t\t}\n\t\t\tobjlen = strlen(objbuf);\n\t\t\tif(!io_ch(arg, objbuf, objlen)) return -1;\n\t\t\tif(!io_ch(arg, sep_eq, sep_eq_len)) return -1;\n\t\t\toutlen += objlen + sep_eq_len;\n\t\t}\n\t\tif((fn_nid == NID_undef) && (flags & XN_FLAG_DUMP_UNKNOWN_FIELDS))\n\t\t\t\t\torflags = ASN1_STRFLGS_DUMP_ALL;\n\t\telse orflags = 0;\n\t\tlen = do_print_ex(io_ch, arg, flags | orflags, val);\n\t\tif(len < 0) return -1;\n\t\toutlen += len;\n\t}\n\treturn outlen;\n}', 'int OBJ_obj2txt(char *buf, int buf_len, ASN1_OBJECT *a, int no_name)\n{\n\tint i,idx=0,n=0,len,nid;\n\tunsigned long l;\n\tunsigned char *p;\n\tconst char *s;\n\tchar tbuf[32];\n\tif (buf_len <= 0) return(0);\n\tif ((a == NULL) || (a->data == NULL)) {\n\t\tbuf[0]=\'\\0\';\n\t\treturn(0);\n\t}\n\tnid=OBJ_obj2nid(a);\n\tif ((nid == NID_undef) || no_name) {\n\t\tlen=a->length;\n\t\tp=a->data;\n\t\tidx=0;\n\t\tl=0;\n\t\twhile (idx < a->length) {\n\t\t\tl|=(p[idx]&0x7f);\n\t\t\tif (!(p[idx] & 0x80)) break;\n\t\t\tl<<=7L;\n\t\t\tidx++;\n\t\t}\n\t\tidx++;\n\t\ti=(int)(l/40);\n\t\tif (i > 2) i=2;\n\t\tl-=(long)(i*40);\n\t\tsprintf(tbuf,"%d.%lu",i,l);\n\t\ti=strlen(tbuf);\n\t\tstrncpy(buf,tbuf,buf_len);\n\t\tbuf_len-=i;\n\t\tbuf+=i;\n\t\tn+=i;\n\t\tl=0;\n\t\tfor (; idx<len; idx++) {\n\t\t\tl|=p[idx]&0x7f;\n\t\t\tif (!(p[idx] & 0x80)) {\n\t\t\t\tsprintf(tbuf,".%lu",l);\n\t\t\t\ti=strlen(tbuf);\n\t\t\t\tif (buf_len > 0)\n\t\t\t\t\tstrncpy(buf,tbuf,buf_len);\n\t\t\t\tbuf_len-=i;\n\t\t\t\tbuf+=i;\n\t\t\t\tn+=i;\n\t\t\t\tl=0;\n\t\t\t}\n\t\t\tl<<=7L;\n\t\t}\n\t} else {\n\t\ts=OBJ_nid2ln(nid);\n\t\tif (s == NULL)\n\t\t\ts=OBJ_nid2sn(nid);\n\t\tstrncpy(buf,s,buf_len);\n\t\tn=strlen(s);\n\t}\n\tbuf[buf_len-1]=\'\\0\';\n\treturn(n);\n}']