crypto/ct/ct_prn.c:46: error: BUFFER_OVERRUN_L3
  Offset: [15, +oo] (⇐ 14 + [1, +oo]) Size: [0, +oo] by call to `ASN1_GENERALIZEDTIME_print`.
Showing all 12 steps of the trace


crypto/ct/ct_prn.c:36:5: Call
34.       if (gen == NULL)
35.           return;
36.       ASN1_GENERALIZEDTIME_adj(gen, (time_t)0,
          ^
37.                                (int)(timestamp / 86400000),
38.                                (timestamp % 86400000) / 1000);

crypto/asn1/a_gentm.c:59:1: Parameter `*s->data`
  57.   }
  58.   
  59. > ASN1_GENERALIZEDTIME *ASN1_GENERALIZEDTIME_adj(ASN1_GENERALIZEDTIME *s,
  60.                                                  time_t t, int offset_day,
  61.                                                  long offset_sec)

crypto/ct/ct_prn.c:46:9: Call
44.                    ASN1_STRING_get0_data(gen), (unsigned int)(timestamp % 1000));
45.       if (ASN1_GENERALIZEDTIME_set_string(gen, genstr))
46.           ASN1_GENERALIZEDTIME_print(out, gen);
              ^
47.       ASN1_GENERALIZEDTIME_free(gen);
48.   }

crypto/asn1/a_gentm.c:78:1: Parameter `*tm->data`
  76.   }
  77.   
  78. > int ASN1_GENERALIZEDTIME_print(BIO *bp, const ASN1_GENERALIZEDTIME *tm)
  79.   {
  80.       if (tm->type != V_ASN1_GENERALIZEDTIME)

crypto/asn1/a_gentm.c:82:12: Call
  80.       if (tm->type != V_ASN1_GENERALIZEDTIME)
  81.           return 0;
  82.       return ASN1_TIME_print(bp, tm);
                   ^
  83.   }

crypto/asn1/a_time.c:491:13: <Offset trace>
489.           if (tm->length > 15 && v[14] == '.') {
490.               f = &v[14];
491.               f_len = 1;
                   ^
492.               while (14 + f_len < l && isdigit(f[f_len]))
493.                   ++f_len;

crypto/asn1/a_time.c:491:13: Assignment
    489.           if (tm->length > 15 && v[14] == '.') {
    490.               f = &v[14];
    491.               f_len = 1;
                       ^
    492.               while (14 + f_len < l && isdigit(f[f_len]))
    493.                   ++f_len;

crypto/asn1/a_time.c:465:1: <Length trace>
463.   };
464.   
465. > int ASN1_TIME_print(BIO *bp, const ASN1_TIME *tm)
466.   {
467.       char *v;

crypto/asn1/a_time.c:465:1: Parameter `*tm->data`
    463.   };
    464.   
    465. > int ASN1_TIME_print(BIO *bp, const ASN1_TIME *tm)
    466.   {
    467.       char *v;

crypto/asn1/a_time.c:477:5: Assignment
    475.   
    476.       l = tm->length;
    477.       v = (char *)tm->data;
               ^
    478.       if (v[l - 1] == 'Z')
    479.           gmt = 1;

crypto/asn1/a_time.c:490:13: Assignment
    488.            */
    489.           if (tm->length > 15 && v[14] == '.') {
    490.               f = &v[14];
                       ^
    491.               f_len = 1;
    492.               while (14 + f_len < l && isdigit(f[f_len]))

crypto/asn1/a_time.c:492:38: Array access: Offset: [15, +oo] (⇐ 14 + [1, +oo]) Size: [0, +oo] by call to `ASN1_GENERALIZEDTIME_print` 
    490.               f = &v[14];
    491.               f_len = 1;
    492.               while (14 + f_len < l && isdigit(f[f_len]))
                                                ^
    493.                   ++f_len;
    494.           }

int ASN1_TIME_print(BIO *bp, const ASN1_TIME *tm)
{
    char *v;
    int gmt = 0, l;
    struct tm stm;
    if (!asn1_time_to_tm(&stm, tm)) {
        goto err;
    }
    l = tm->length;
    v = (char *)tm->data;
    if (v[l - 1] == 'Z')
        gmt = 1;
    if (tm->type == V_ASN1_GENERALIZEDTIME) {
        char *f = NULL;
        int f_len = 0;
        if (tm->length > 15 && v[14] == '.') {
            f = &v[14];
            f_len = 1;
            while (14 + f_len < l && isdigit(f[f_len]))
                ++f_len;
        }
        return BIO_printf(bp, "%s %2d %02d:%02d:%02d%.*s %d%s",
                          _asn1_mon[stm.tm_mon], stm.tm_mday, stm.tm_hour,
                          stm.tm_min, stm.tm_sec, f_len, f, stm.tm_year + 1900,
                          (gmt ? " GMT" : "")) > 0;
    } else {
        return BIO_printf(bp, "%s %2d %02d:%02d:%02d %d%s",
                          _asn1_mon[stm.tm_mon], stm.tm_mday, stm.tm_hour,
                          stm.tm_min, stm.tm_sec, stm.tm_year + 1900,
                          (gmt ? " GMT" : "")) > 0;
    }
 err:
    BIO_write(bp, "Bad time value", 14);
    return 0;
}
['static void timestamp_print(uint64_t timestamp, BIO *out)\n{\n    ASN1_GENERALIZEDTIME *gen = ASN1_GENERALIZEDTIME_new();\n    char genstr[20];\n    if (gen == NULL)\n        return;\n    ASN1_GENERALIZEDTIME_adj(gen, (time_t)0,\n                             (int)(timestamp / 86400000),\n                             (timestamp % 86400000) / 1000);\n    BIO_snprintf(genstr, sizeof(genstr), "%.14s.%03dZ",\n                 ASN1_STRING_get0_data(gen), (unsigned int)(timestamp % 1000));\n    if (ASN1_GENERALIZEDTIME_set_string(gen, genstr))\n        ASN1_GENERALIZEDTIME_print(out, gen);\n    ASN1_GENERALIZEDTIME_free(gen);\n}', 'ASN1_GENERALIZEDTIME *ASN1_GENERALIZEDTIME_adj(ASN1_GENERALIZEDTIME *s,\n                                               time_t t, int offset_day,\n                                               long offset_sec)\n{\n    struct tm *ts;\n    struct tm data;\n    ts = OPENSSL_gmtime(&t, &data);\n    if (ts == NULL)\n        return NULL;\n    if (offset_day || offset_sec) {\n        if (!OPENSSL_gmtime_adj(ts, offset_day, offset_sec))\n            return NULL;\n    }\n    return asn1_time_from_tm(s, ts, V_ASN1_GENERALIZEDTIME);\n}', 'int ASN1_GENERALIZEDTIME_print(BIO *bp, const ASN1_GENERALIZEDTIME *tm)\n{\n    if (tm->type != V_ASN1_GENERALIZEDTIME)\n        return 0;\n    return ASN1_TIME_print(bp, tm);\n}', 'int ASN1_TIME_print(BIO *bp, const ASN1_TIME *tm)\n{\n    char *v;\n    int gmt = 0, l;\n    struct tm stm;\n    if (!asn1_time_to_tm(&stm, tm)) {\n        goto err;\n    }\n    l = tm->length;\n    v = (char *)tm->data;\n    if (v[l - 1] == \'Z\')\n        gmt = 1;\n    if (tm->type == V_ASN1_GENERALIZEDTIME) {\n        char *f = NULL;\n        int f_len = 0;\n        if (tm->length > 15 && v[14] == \'.\') {\n            f = &v[14];\n            f_len = 1;\n            while (14 + f_len < l && isdigit(f[f_len]))\n                ++f_len;\n        }\n        return BIO_printf(bp, "%s %2d %02d:%02d:%02d%.*s %d%s",\n                          _asn1_mon[stm.tm_mon], stm.tm_mday, stm.tm_hour,\n                          stm.tm_min, stm.tm_sec, f_len, f, stm.tm_year + 1900,\n                          (gmt ? " GMT" : "")) > 0;\n    } else {\n        return BIO_printf(bp, "%s %2d %02d:%02d:%02d %d%s",\n                          _asn1_mon[stm.tm_mon], stm.tm_mday, stm.tm_hour,\n                          stm.tm_min, stm.tm_sec, stm.tm_year + 1900,\n                          (gmt ? " GMT" : "")) > 0;\n    }\n err:\n    BIO_write(bp, "Bad time value", 14);\n    return 0;\n}']