crypto/ct/ct_prn.c:46: error: BUFFER_OVERRUN_L3
  Offset: [7, +oo] Size: [0, +oo] by call to `ASN1_GENERALIZEDTIME_print`.
Showing all 13 steps of the trace


crypto/ct/ct_prn.c:36:5: Call
34.       if (gen == NULL)
35.           return;
36.       ASN1_GENERALIZEDTIME_adj(gen, (time_t)0,
          ^
37.                                (int)(timestamp / 86400000),
38.                                (timestamp % 86400000) / 1000);

crypto/asn1/a_gentm.c:59:1: Parameter `*s->data`
  57.   }
  58.   
  59. > ASN1_GENERALIZEDTIME *ASN1_GENERALIZEDTIME_adj(ASN1_GENERALIZEDTIME *s,
  60.                                                  time_t t, int offset_day,
  61.                                                  long offset_sec)

crypto/ct/ct_prn.c:46:9: Call
44.                    ASN1_STRING_get0_data(gen), (unsigned int)(timestamp % 1000));
45.       if (ASN1_GENERALIZEDTIME_set_string(gen, genstr))
46.           ASN1_GENERALIZEDTIME_print(out, gen);
              ^
47.       ASN1_GENERALIZEDTIME_free(gen);
48.   }

crypto/asn1/a_gentm.c:78:1: Parameter `*tm->data`
  76.   }
  77.   
  78. > int ASN1_GENERALIZEDTIME_print(BIO *bp, const ASN1_GENERALIZEDTIME *tm)
  79.   {
  80.       if (tm->type != V_ASN1_GENERALIZEDTIME)

crypto/asn1/a_gentm.c:82:12: Call
  80.       if (tm->type != V_ASN1_GENERALIZEDTIME)
  81.           return 0;
  82.       return ASN1_TIME_print(bp, tm);
                   ^
  83.   }

crypto/asn1/a_time.c:465:1: Parameter `*tm->data`
    463.   };
    464.   
    465. > int ASN1_TIME_print(BIO *bp, const ASN1_TIME *tm)
    466.   {
    467.       char *v;

crypto/asn1/a_time.c:471:10: Call
    469.       struct tm stm;
    470.   
    471.       if (!asn1_time_to_tm(&stm, tm)) {
                    ^
    472.           /* asn1_time_to_tm will check the time type */
    473.           goto err;

crypto/asn1/a_time.c:80:5: <Offset trace>
78.       static const int mdays[12] = { 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 };
79.       char *a;
80.       int n, i, i2, l, o, min_l = 11, strict = 0, end = 6, btz = 5, md;
          ^
81.       struct tm tmp;
82.   

crypto/asn1/a_time.c:80:5: Assignment
      78.       static const int mdays[12] = { 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 };
      79.       char *a;
      80.       int n, i, i2, l, o, min_l = 11, strict = 0, end = 6, btz = 5, md;
                ^
      81.       struct tm tmp;
      82.   

crypto/asn1/a_time.c:74:1: <Length trace>
72.   }
73.   
74. > int asn1_time_to_tm(struct tm *tm, const ASN1_TIME *d)
75.   {
76.       static const int min[9] = { 0, 0, 1, 1, 0, 0, 0, 0, 0 };

crypto/asn1/a_time.c:74:1: Parameter `*d->data`
      72.   }
      73.   
      74. > int asn1_time_to_tm(struct tm *tm, const ASN1_TIME *d)
      75.   {
      76.       static const int min[9] = { 0, 0, 1, 1, 0, 0, 0, 0, 0 };

crypto/asn1/a_time.c:110:5: Assignment
      108.   
      109.       l = d->length;
      110.       a = (char *)d->data;
                 ^
      111.       o = 0;
      112.       memset(&tmp, 0, sizeof(tmp));

crypto/asn1/a_time.c:226:18: Array access: Offset: [7, +oo] Size: [0, +oo] by call to `ASN1_GENERALIZEDTIME_print` 
      224.               goto err;
      225.           for (i = end; i < end + 2; i++) {
      226.               if (!isdigit(a[o]))
                              ^
      227.                   goto err;
      228.               n = a[o] - '0';

int asn1_time_to_tm(struct tm *tm, const ASN1_TIME *d)
{
    static const int min[9] = { 0, 0, 1, 1, 0, 0, 0, 0, 0 };
    static const int max[9] = { 99, 99, 12, 31, 23, 59, 59, 12, 59 };
    static const int mdays[12] = { 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 };
    char *a;
    int n, i, i2, l, o, min_l = 11, strict = 0, end = 6, btz = 5, md;
    struct tm tmp;
    if (d->type == V_ASN1_UTCTIME) {
        if (d->flags & ASN1_STRING_FLAG_X509_TIME) {
            min_l = 13;
            strict = 1;
        }
    } else if (d->type == V_ASN1_GENERALIZEDTIME) {
        end = 7;
        btz = 6;
        if (d->flags & ASN1_STRING_FLAG_X509_TIME) {
            min_l = 15;
            strict = 1;
        } else {
            min_l = 13;
        }
    } else {
        return 0;
    }
    l = d->length;
    a = (char *)d->data;
    o = 0;
    memset(&tmp, 0, sizeof(tmp));
    if (l < min_l)
        goto err;
    for (i = 0; i < end; i++) {
        if (!strict && (i == btz) && ((a[o] == 'Z') || (a[o] == '+') || (a[o] == '-'))) {
            i++;
            break;
        }
        if (!isdigit(a[o]))
            goto err;
        n = a[o] - '0';
        if (++o == l)
            goto err;
        if (!isdigit(a[o]))
            goto err;
        n = (n * 10) + a[o] - '0';
        if (++o == l)
            goto err;
        i2 = (d->type == V_ASN1_UTCTIME) ? i + 1 : i;
        if ((n < min[i2]) || (n > max[i2]))
            goto err;
        switch (i2) {
        case 0:
            tmp.tm_year = n * 100 - 1900;
            break;
        case 1:
            if (d->type == V_ASN1_UTCTIME)
                tmp.tm_year = n < 50 ? n + 100 : n;
            else
                tmp.tm_year += n;
            break;
        case 2:
            tmp.tm_mon = n - 1;
            break;
        case 3:
            if (tmp.tm_mon == 1) {
                md = mdays[1] + leap_year(tmp.tm_year + 1900);
            } else {
                md = mdays[tmp.tm_mon];
            }
            if (n > md)
                goto err;
            tmp.tm_mday = n;
            determine_days(&tmp);
            break;
        case 4:
            tmp.tm_hour = n;
            break;
        case 5:
            tmp.tm_min = n;
            break;
        case 6:
            tmp.tm_sec = n;
            break;
        }
    }
    if (d->type == V_ASN1_GENERALIZEDTIME && a[o] == '.') {
        if (strict)
            goto err;
        if (++o == l)
            goto err;
        i = o;
        while ((o < l) && isdigit(a[o]))
            o++;
        if (i == o)
            goto err;
        if (o == l)
            goto err;
    }
    if (a[o] == 'Z') {
        o++;
    } else if (!strict && ((a[o] == '+') || (a[o] == '-'))) {
        int offsign = a[o] == '-' ? 1 : -1;
        int offset = 0;
        o++;
        if (o + 4 != l)
            goto err;
        for (i = end; i < end + 2; i++) {
            if (!isdigit(a[o]))
                goto err;
            n = a[o] - '0';
            o++;
            if (!isdigit(a[o]))
                goto err;
            n = (n * 10) + a[o] - '0';
            i2 = (d->type == V_ASN1_UTCTIME) ? i + 1 : i;
            if ((n < min[i2]) || (n > max[i2]))
                goto err;
            if (tm != NULL) {
                if (i == end)
                    offset = n * 3600;
                else if (i == end + 1)
                    offset += n * 60;
            }
            o++;
        }
        if (offset && !OPENSSL_gmtime_adj(&tmp, 0, offset * offsign))
            goto err;
    } else {
        goto err;
    }
    if (o == l) {
        if (tm != NULL)
            *tm = tmp;
        return 1;
    }
 err:
    return 0;
}
['static void timestamp_print(uint64_t timestamp, BIO *out)\n{\n    ASN1_GENERALIZEDTIME *gen = ASN1_GENERALIZEDTIME_new();\n    char genstr[20];\n    if (gen == NULL)\n        return;\n    ASN1_GENERALIZEDTIME_adj(gen, (time_t)0,\n                             (int)(timestamp / 86400000),\n                             (timestamp % 86400000) / 1000);\n    BIO_snprintf(genstr, sizeof(genstr), "%.14s.%03dZ",\n                 ASN1_STRING_get0_data(gen), (unsigned int)(timestamp % 1000));\n    if (ASN1_GENERALIZEDTIME_set_string(gen, genstr))\n        ASN1_GENERALIZEDTIME_print(out, gen);\n    ASN1_GENERALIZEDTIME_free(gen);\n}', 'ASN1_GENERALIZEDTIME *ASN1_GENERALIZEDTIME_adj(ASN1_GENERALIZEDTIME *s,\n                                               time_t t, int offset_day,\n                                               long offset_sec)\n{\n    struct tm *ts;\n    struct tm data;\n    ts = OPENSSL_gmtime(&t, &data);\n    if (ts == NULL)\n        return NULL;\n    if (offset_day || offset_sec) {\n        if (!OPENSSL_gmtime_adj(ts, offset_day, offset_sec))\n            return NULL;\n    }\n    return asn1_time_from_tm(s, ts, V_ASN1_GENERALIZEDTIME);\n}', 'int ASN1_GENERALIZEDTIME_print(BIO *bp, const ASN1_GENERALIZEDTIME *tm)\n{\n    if (tm->type != V_ASN1_GENERALIZEDTIME)\n        return 0;\n    return ASN1_TIME_print(bp, tm);\n}', 'int ASN1_TIME_print(BIO *bp, const ASN1_TIME *tm)\n{\n    char *v;\n    int gmt = 0, l;\n    struct tm stm;\n    if (!asn1_time_to_tm(&stm, tm)) {\n        goto err;\n    }\n    l = tm->length;\n    v = (char *)tm->data;\n    if (v[l - 1] == \'Z\')\n        gmt = 1;\n    if (tm->type == V_ASN1_GENERALIZEDTIME) {\n        char *f = NULL;\n        int f_len = 0;\n        if (tm->length > 15 && v[14] == \'.\') {\n            f = &v[14];\n            f_len = 1;\n            while (14 + f_len < l && isdigit(f[f_len]))\n                ++f_len;\n        }\n        return BIO_printf(bp, "%s %2d %02d:%02d:%02d%.*s %d%s",\n                          _asn1_mon[stm.tm_mon], stm.tm_mday, stm.tm_hour,\n                          stm.tm_min, stm.tm_sec, f_len, f, stm.tm_year + 1900,\n                          (gmt ? " GMT" : "")) > 0;\n    } else {\n        return BIO_printf(bp, "%s %2d %02d:%02d:%02d %d%s",\n                          _asn1_mon[stm.tm_mon], stm.tm_mday, stm.tm_hour,\n                          stm.tm_min, stm.tm_sec, stm.tm_year + 1900,\n                          (gmt ? " GMT" : "")) > 0;\n    }\n err:\n    BIO_write(bp, "Bad time value", 14);\n    return 0;\n}', "int asn1_time_to_tm(struct tm *tm, const ASN1_TIME *d)\n{\n    static const int min[9] = { 0, 0, 1, 1, 0, 0, 0, 0, 0 };\n    static const int max[9] = { 99, 99, 12, 31, 23, 59, 59, 12, 59 };\n    static const int mdays[12] = { 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 };\n    char *a;\n    int n, i, i2, l, o, min_l = 11, strict = 0, end = 6, btz = 5, md;\n    struct tm tmp;\n    if (d->type == V_ASN1_UTCTIME) {\n        if (d->flags & ASN1_STRING_FLAG_X509_TIME) {\n            min_l = 13;\n            strict = 1;\n        }\n    } else if (d->type == V_ASN1_GENERALIZEDTIME) {\n        end = 7;\n        btz = 6;\n        if (d->flags & ASN1_STRING_FLAG_X509_TIME) {\n            min_l = 15;\n            strict = 1;\n        } else {\n            min_l = 13;\n        }\n    } else {\n        return 0;\n    }\n    l = d->length;\n    a = (char *)d->data;\n    o = 0;\n    memset(&tmp, 0, sizeof(tmp));\n    if (l < min_l)\n        goto err;\n    for (i = 0; i < end; i++) {\n        if (!strict && (i == btz) && ((a[o] == 'Z') || (a[o] == '+') || (a[o] == '-'))) {\n            i++;\n            break;\n        }\n        if (!isdigit(a[o]))\n            goto err;\n        n = a[o] - '0';\n        if (++o == l)\n            goto err;\n        if (!isdigit(a[o]))\n            goto err;\n        n = (n * 10) + a[o] - '0';\n        if (++o == l)\n            goto err;\n        i2 = (d->type == V_ASN1_UTCTIME) ? i + 1 : i;\n        if ((n < min[i2]) || (n > max[i2]))\n            goto err;\n        switch (i2) {\n        case 0:\n            tmp.tm_year = n * 100 - 1900;\n            break;\n        case 1:\n            if (d->type == V_ASN1_UTCTIME)\n                tmp.tm_year = n < 50 ? n + 100 : n;\n            else\n                tmp.tm_year += n;\n            break;\n        case 2:\n            tmp.tm_mon = n - 1;\n            break;\n        case 3:\n            if (tmp.tm_mon == 1) {\n                md = mdays[1] + leap_year(tmp.tm_year + 1900);\n            } else {\n                md = mdays[tmp.tm_mon];\n            }\n            if (n > md)\n                goto err;\n            tmp.tm_mday = n;\n            determine_days(&tmp);\n            break;\n        case 4:\n            tmp.tm_hour = n;\n            break;\n        case 5:\n            tmp.tm_min = n;\n            break;\n        case 6:\n            tmp.tm_sec = n;\n            break;\n        }\n    }\n    if (d->type == V_ASN1_GENERALIZEDTIME && a[o] == '.') {\n        if (strict)\n            goto err;\n        if (++o == l)\n            goto err;\n        i = o;\n        while ((o < l) && isdigit(a[o]))\n            o++;\n        if (i == o)\n            goto err;\n        if (o == l)\n            goto err;\n    }\n    if (a[o] == 'Z') {\n        o++;\n    } else if (!strict && ((a[o] == '+') || (a[o] == '-'))) {\n        int offsign = a[o] == '-' ? 1 : -1;\n        int offset = 0;\n        o++;\n        if (o + 4 != l)\n            goto err;\n        for (i = end; i < end + 2; i++) {\n            if (!isdigit(a[o]))\n                goto err;\n            n = a[o] - '0';\n            o++;\n            if (!isdigit(a[o]))\n                goto err;\n            n = (n * 10) + a[o] - '0';\n            i2 = (d->type == V_ASN1_UTCTIME) ? i + 1 : i;\n            if ((n < min[i2]) || (n > max[i2]))\n                goto err;\n            if (tm != NULL) {\n                if (i == end)\n                    offset = n * 3600;\n                else if (i == end + 1)\n                    offset += n * 60;\n            }\n            o++;\n        }\n        if (offset && !OPENSSL_gmtime_adj(&tmp, 0, offset * offsign))\n            goto err;\n    } else {\n        goto err;\n    }\n    if (o == l) {\n        if (tm != NULL)\n            *tm = tmp;\n        return 1;\n    }\n err:\n    return 0;\n}"]