crypto/x509v3/v3_ncons.c:371: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] Size: [1, +oo].
Showing all 6 steps of the trace


crypto/x509v3/v3_ncons.c:352:10: <Offset trace>
350.        * that is not a problem.
351.        */
352.       for (i = 0; i < utf8_length; ++i) {
                ^
353.           unsigned char c = utf8_value[i];
354.   

crypto/x509v3/v3_ncons.c:352:10: Assignment
350.        * that is not a problem.
351.        */
352.       for (i = 0; i < utf8_length; ++i) {
                ^
353.           unsigned char c = utf8_value[i];
354.   

crypto/x509v3/v3_ncons.c:328:24: <Length trace>
326.        * we must use for 'utf8_length'.
327.        */
328.       if ((utf8_length = ASN1_STRING_to_UTF8(&utf8_value, cn)) < 0)
                              ^
329.           return X509_V_ERR_OUT_OF_MEM;
330.   

crypto/x509v3/v3_ncons.c:328:24: Call
326.        * we must use for 'utf8_length'.
327.        */
328.       if ((utf8_length = ASN1_STRING_to_UTF8(&utf8_value, cn)) < 0)
                              ^
329.           return X509_V_ERR_OUT_OF_MEM;
330.   

crypto/asn1/a_strex.c:603:1: Parameter `**out`
  601.    */
  602.   
  603. > int ASN1_STRING_to_UTF8(unsigned char **out, const ASN1_STRING *in)
  604.   {
  605.       ASN1_STRING stmp, *str = &stmp;

crypto/x509v3/v3_ncons.c:371:20: Array access: Offset: [2, +oo] Size: [1, +oo]
369.                */
370.               if (c == '.'
371.                   && utf8_value[i + 1] != '.'
                          ^
372.                   && utf8_value[i - 1] != '-'
373.                   && utf8_value[i + 1] != '-') {

static int cn2dnsid(ASN1_STRING *cn, unsigned char **dnsid, size_t *idlen)
{
    int utf8_length;
    int i;
    unsigned char *utf8_value;
    int isdnsname = 0;
    *dnsid = NULL;
    *idlen = 0;
    if ((utf8_length = ASN1_STRING_to_UTF8(&utf8_value, cn)) < 0)
        return X509_V_ERR_OUT_OF_MEM;
    while (utf8_length > 0 && utf8_value[utf8_length - 1] == '\0')
        --utf8_length;
    if ((size_t)utf8_length != strlen((char *)utf8_value))
        return X509_V_ERR_UNSPECIFIED;
    for (i = 0; i < utf8_length; ++i) {
        unsigned char c = utf8_value[i];
        if ((c >= 'a' && c <= 'z')
            || (c >= 'A' && c <= 'Z')
            || (c >= '0' && c <= '9')
            || c == '_')
            continue;
        if (i > 0 && i < utf8_length - 1) {
            if (c == '-')
                continue;
            if (c == '.'
                && utf8_value[i + 1] != '.'
                && utf8_value[i - 1] != '-'
                && utf8_value[i + 1] != '-') {
                isdnsname = 1;
                continue;
            }
        }
        isdnsname = 0;
        break;
    }
    if (isdnsname) {
        *dnsid = utf8_value;
        *idlen = (size_t)utf8_length;
        return X509_V_OK;
    }
    OPENSSL_free(utf8_value);
    return X509_V_OK;
}
["static int cn2dnsid(ASN1_STRING *cn, unsigned char **dnsid, size_t *idlen)\n{\n    int utf8_length;\n    int i;\n    unsigned char *utf8_value;\n    int isdnsname = 0;\n    *dnsid = NULL;\n    *idlen = 0;\n    if ((utf8_length = ASN1_STRING_to_UTF8(&utf8_value, cn)) < 0)\n        return X509_V_ERR_OUT_OF_MEM;\n    while (utf8_length > 0 && utf8_value[utf8_length - 1] == '\\0')\n        --utf8_length;\n    if ((size_t)utf8_length != strlen((char *)utf8_value))\n        return X509_V_ERR_UNSPECIFIED;\n    for (i = 0; i < utf8_length; ++i) {\n        unsigned char c = utf8_value[i];\n        if ((c >= 'a' && c <= 'z')\n            || (c >= 'A' && c <= 'Z')\n            || (c >= '0' && c <= '9')\n            || c == '_')\n            continue;\n        if (i > 0 && i < utf8_length - 1) {\n            if (c == '-')\n                continue;\n            if (c == '.'\n                && utf8_value[i + 1] != '.'\n                && utf8_value[i - 1] != '-'\n                && utf8_value[i + 1] != '-') {\n                isdnsname = 1;\n                continue;\n            }\n        }\n        isdnsname = 0;\n        break;\n    }\n    if (isdnsname) {\n        *dnsid = utf8_value;\n        *idlen = (size_t)utf8_length;\n        return X509_V_OK;\n    }\n    OPENSSL_free(utf8_value);\n    return X509_V_OK;\n}", 'int ASN1_STRING_to_UTF8(unsigned char **out, const ASN1_STRING *in)\n{\n    ASN1_STRING stmp, *str = &stmp;\n    int mbflag, type, ret;\n    if (!in)\n        return -1;\n    type = in->type;\n    if ((type < 0) || (type > 30))\n        return -1;\n    mbflag = tag2nbyte[type];\n    if (mbflag == -1)\n        return -1;\n    mbflag |= MBSTRING_FLAG;\n    stmp.data = NULL;\n    stmp.length = 0;\n    stmp.flags = 0;\n    ret =\n        ASN1_mbstring_copy(&str, in->data, in->length, mbflag,\n                           B_ASN1_UTF8STRING);\n    if (ret < 0)\n        return ret;\n    *out = stmp.data;\n    return stmp.length;\n}']