crypto/ts/ts_rsp_sign.c:974: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] (⇐ [-1, 2147483647] + [0, +oo]) Size: 23 by call to `BIO_snprintf`.
Showing all 15 steps of the trace


crypto/ts/ts_rsp_sign.c:943:1: Array declaration
941.   
942.   
943. > static ASN1_GENERALIZEDTIME *
944.   TS_RESP_set_genTime_with_precision(ASN1_GENERALIZEDTIME *asn1_time, 
945.   				   long sec, long usec, unsigned precision)

crypto/ts/ts_rsp_sign.c:950:2: Assignment
948.   	struct tm *tm = NULL;	
949.   	char genTime_str[17 + TS_MAX_CLOCK_PRECISION_DIGITS];
950.   	char *p = genTime_str;
        ^
951.   	char *p_end = genTime_str + sizeof(genTime_str);
952.   

crypto/ts/ts_rsp_sign.c:967:2: Assignment
965.   	 * fraction-of-second details". 
966.   	 */                   
967.   	p += BIO_snprintf(p, p_end - p,
        ^
968.   			  "%04d%02d%02d%02d%02d%02d",
969.   			  tm->tm_year + 1900, tm->tm_mon + 1, tm->tm_mday, 

crypto/ts/ts_rsp_sign.c:974:3: Call
972.   	{
973.   		/* Add fraction of seconds (leave space for dot and null). */
974.   		BIO_snprintf(p, 2 + precision, ".%06ld", usec);
         ^
975.   		/* We cannot use the snprintf return value, 
976.   		   because it might have been truncated. */

crypto/bio/b_print.c:814:1: Parameter `*buf`
  812.    * to BIO_printf, and we need *some* name prefix ...
  813.    * (XXX  the function should be renamed, but to what?) */
  814. > int BIO_snprintf(char *buf, size_t n, const char *format, ...)
  815.   	{
  816.   	va_list args;

crypto/bio/b_print.c:821:8: Call
  819.   	va_start(args, format);
  820.   
  821.   	ret = BIO_vsnprintf(buf, n, format, args);
                ^
  822.   
  823.   	va_end(args);

crypto/bio/b_print.c:827:1: Parameter `*buf`
    825.   	}
    826.   
    827. > int BIO_vsnprintf(char *buf, size_t n, const char *format, va_list args)
    828.   	{
    829.   	size_t retlen;

crypto/bio/b_print.c:832:2: Call
    830.   	int truncated;
    831.   
    832.   	_dopr(&buf, NULL, &n, &retlen, &truncated, format, args);
            ^
    833.   
    834.   	if (truncated)

crypto/bio/b_print.c:168:1: Parameter `*maxlen`
      166.   #define OSSL_MAX(p,q) ((p >= q) ? p : q)
      167.   
      168. > static void
      169.   _dopr(
      170.       char **sbuffer,

crypto/bio/b_print.c:203:17: Call
      201.                   state = DP_S_FLAGS;
      202.               else
      203.                   doapr_outch(sbuffer,buffer, &currlen, maxlen, ch);
                             ^
      204.               ch = *format++;
      205.               break;

crypto/bio/b_print.c:725:1: <Offset trace>
723.   }
724.   
725. > static void
726.   doapr_outch(
727.       char **sbuffer,

crypto/bio/b_print.c:725:1: Parameter `*maxlen`
        723.   }
        724.   
        725. > static void
        726.   doapr_outch(
        727.       char **sbuffer,

crypto/bio/b_print.c:725:1: <Length trace>
723.   }
724.   
725. > static void
726.   doapr_outch(
727.       char **sbuffer,

crypto/bio/b_print.c:725:1: Parameter `**sbuffer`
        723.   }
        724.   
        725. > static void
        726.   doapr_outch(
        727.       char **sbuffer,

crypto/bio/b_print.c:758:6: Array access: Offset: [-1, +oo] (⇐ [-1, 2147483647] + [0, +oo]) Size: 23 by call to `BIO_snprintf` 
        756.       if (*currlen < *maxlen) {
        757.   	if (*sbuffer)
        758.   	    (*sbuffer)[(*currlen)++] = (char)c;
                    ^
        759.   	else
        760.   	    (*buffer)[(*currlen)++] = (char)c;

static void
doapr_outch(
    char **sbuffer,
    char **buffer,
    size_t *currlen,
    size_t *maxlen,
    int c)
{
    assert(*sbuffer != NULL || buffer != NULL);
    if (buffer) {
	while (*currlen >= *maxlen) {
	    if (*buffer == NULL) {
		if (*maxlen == 0)
		    *maxlen = 1024;
		*buffer = OPENSSL_malloc(*maxlen);
		if (*currlen > 0) {
		    assert(*sbuffer != NULL);
		    memcpy(*buffer, *sbuffer, *currlen);
		}
		*sbuffer = NULL;
	    } else {
		*maxlen += 1024;
		*buffer = OPENSSL_realloc(*buffer, *maxlen);
	    }
	}
	assert(*sbuffer != NULL || *buffer != NULL);
    }
    if (*currlen < *maxlen) {
	if (*sbuffer)
	    (*sbuffer)[(*currlen)++] = (char)c;
	else
	    (*buffer)[(*currlen)++] = (char)c;
    }
    return;
}
['static ASN1_GENERALIZEDTIME *\nTS_RESP_set_genTime_with_precision(ASN1_GENERALIZEDTIME *asn1_time,\n\t\t\t\t   long sec, long usec, unsigned precision)\n\t{\n\ttime_t time_sec = (time_t) sec;\n\tstruct tm *tm = NULL;\n\tchar genTime_str[17 + TS_MAX_CLOCK_PRECISION_DIGITS];\n\tchar *p = genTime_str;\n\tchar *p_end = genTime_str + sizeof(genTime_str);\n\tif (precision > TS_MAX_CLOCK_PRECISION_DIGITS)\n\t\tgoto err;\n\tif (!(tm = gmtime(&time_sec)))\n\t\tgoto err;\n\tp += BIO_snprintf(p, p_end - p,\n\t\t\t  "%04d%02d%02d%02d%02d%02d",\n\t\t\t  tm->tm_year + 1900, tm->tm_mon + 1, tm->tm_mday,\n\t\t\t  tm->tm_hour, tm->tm_min, tm->tm_sec);\n\tif (precision > 0)\n\t{\n\t\tBIO_snprintf(p, 2 + precision, ".%06ld", usec);\n\t\tp += strlen(p);\n\t\twhile (*--p == \'0\')\n\t\t\t ;\n\t\tif (*p != \'.\') ++p;\n\t\t}\n\t*p++ = \'Z\';\n\t*p++ = \'\\0\';\n\tif (!asn1_time && !(asn1_time = M_ASN1_GENERALIZEDTIME_new()))\n\t\tgoto err;\n\tif (!ASN1_GENERALIZEDTIME_set_string(asn1_time, genTime_str))\n\t\t{\n\t\tASN1_GENERALIZEDTIME_free(asn1_time);\n\t\tgoto err;\n\t\t}\n\treturn asn1_time;\n err:\n\tTSerr(TS_F_TS_RESP_SET_GENTIME_WITH_PRECISION, TS_R_COULD_NOT_SET_TIME);\n\treturn NULL;\n\t}', 'int BIO_snprintf(char *buf, size_t n, const char *format, ...)\n\t{\n\tva_list args;\n\tint ret;\n\tva_start(args, format);\n\tret = BIO_vsnprintf(buf, n, format, args);\n\tva_end(args);\n\treturn(ret);\n\t}', 'int BIO_vsnprintf(char *buf, size_t n, const char *format, va_list args)\n\t{\n\tsize_t retlen;\n\tint truncated;\n\t_dopr(&buf, NULL, &n, &retlen, &truncated, format, args);\n\tif (truncated)\n\t\treturn -1;\n\telse\n\t\treturn (retlen <= INT_MAX) ? (int)retlen : -1;\n\t}', "static void\n_dopr(\n    char **sbuffer,\n    char **buffer,\n    size_t *maxlen,\n    size_t *retlen,\n    int *truncated,\n    const char *format,\n    va_list args)\n{\n    char ch;\n    LLONG value;\n    LDOUBLE fvalue;\n    char *strvalue;\n    int min;\n    int max;\n    int state;\n    int flags;\n    int cflags;\n    size_t currlen;\n    state = DP_S_DEFAULT;\n    flags = currlen = cflags = min = 0;\n    max = -1;\n    ch = *format++;\n    while (state != DP_S_DONE) {\n        if (ch == '\\0' || (buffer == NULL && currlen >= *maxlen))\n            state = DP_S_DONE;\n        switch (state) {\n        case DP_S_DEFAULT:\n            if (ch == '%')\n                state = DP_S_FLAGS;\n            else\n                doapr_outch(sbuffer,buffer, &currlen, maxlen, ch);\n            ch = *format++;\n            break;\n        case DP_S_FLAGS:\n            switch (ch) {\n            case '-':\n                flags |= DP_F_MINUS;\n                ch = *format++;\n                break;\n            case '+':\n                flags |= DP_F_PLUS;\n                ch = *format++;\n                break;\n            case ' ':\n                flags |= DP_F_SPACE;\n                ch = *format++;\n                break;\n            case '#':\n                flags |= DP_F_NUM;\n                ch = *format++;\n                break;\n            case '0':\n                flags |= DP_F_ZERO;\n                ch = *format++;\n                break;\n            default:\n                state = DP_S_MIN;\n                break;\n            }\n            break;\n        case DP_S_MIN:\n            if (isdigit((unsigned char)ch)) {\n                min = 10 * min + char_to_int(ch);\n                ch = *format++;\n            } else if (ch == '*') {\n                min = va_arg(args, int);\n                ch = *format++;\n                state = DP_S_DOT;\n            } else\n                state = DP_S_DOT;\n            break;\n        case DP_S_DOT:\n            if (ch == '.') {\n                state = DP_S_MAX;\n                ch = *format++;\n            } else\n                state = DP_S_MOD;\n            break;\n        case DP_S_MAX:\n            if (isdigit((unsigned char)ch)) {\n                if (max < 0)\n                    max = 0;\n                max = 10 * max + char_to_int(ch);\n                ch = *format++;\n            } else if (ch == '*') {\n                max = va_arg(args, int);\n                ch = *format++;\n                state = DP_S_MOD;\n            } else\n                state = DP_S_MOD;\n            break;\n        case DP_S_MOD:\n            switch (ch) {\n            case 'h':\n                cflags = DP_C_SHORT;\n                ch = *format++;\n                break;\n            case 'l':\n                if (*format == 'l') {\n                    cflags = DP_C_LLONG;\n                    format++;\n                } else\n                    cflags = DP_C_LONG;\n                ch = *format++;\n                break;\n            case 'q':\n                cflags = DP_C_LLONG;\n                ch = *format++;\n                break;\n            case 'L':\n                cflags = DP_C_LDOUBLE;\n                ch = *format++;\n                break;\n            default:\n                break;\n            }\n            state = DP_S_CONV;\n            break;\n        case DP_S_CONV:\n            switch (ch) {\n            case 'd':\n            case 'i':\n                switch (cflags) {\n                case DP_C_SHORT:\n                    value = (short int)va_arg(args, int);\n                    break;\n                case DP_C_LONG:\n                    value = va_arg(args, long int);\n                    break;\n                case DP_C_LLONG:\n                    value = va_arg(args, LLONG);\n                    break;\n                default:\n                    value = va_arg(args, int);\n                    break;\n                }\n                fmtint(sbuffer, buffer, &currlen, maxlen,\n                       value, 10, min, max, flags);\n                break;\n            case 'X':\n                flags |= DP_F_UP;\n            case 'x':\n            case 'o':\n            case 'u':\n                flags |= DP_F_UNSIGNED;\n                switch (cflags) {\n                case DP_C_SHORT:\n                    value = (unsigned short int)va_arg(args, unsigned int);\n                    break;\n                case DP_C_LONG:\n                    value = (LLONG) va_arg(args,\n                        unsigned long int);\n                    break;\n                case DP_C_LLONG:\n                    value = va_arg(args, unsigned LLONG);\n                    break;\n                default:\n                    value = (LLONG) va_arg(args,\n                        unsigned int);\n                    break;\n                }\n                fmtint(sbuffer, buffer, &currlen, maxlen, value,\n                       ch == 'o' ? 8 : (ch == 'u' ? 10 : 16),\n                       min, max, flags);\n                break;\n            case 'f':\n                if (cflags == DP_C_LDOUBLE)\n                    fvalue = va_arg(args, LDOUBLE);\n                else\n                    fvalue = va_arg(args, double);\n                fmtfp(sbuffer, buffer, &currlen, maxlen,\n                      fvalue, min, max, flags);\n                break;\n            case 'E':\n                flags |= DP_F_UP;\n            case 'e':\n                if (cflags == DP_C_LDOUBLE)\n                    fvalue = va_arg(args, LDOUBLE);\n                else\n                    fvalue = va_arg(args, double);\n                break;\n            case 'G':\n                flags |= DP_F_UP;\n            case 'g':\n                if (cflags == DP_C_LDOUBLE)\n                    fvalue = va_arg(args, LDOUBLE);\n                else\n                    fvalue = va_arg(args, double);\n                break;\n            case 'c':\n                doapr_outch(sbuffer, buffer, &currlen, maxlen,\n                    va_arg(args, int));\n                break;\n            case 's':\n                strvalue = va_arg(args, char *);\n                if (max < 0) {\n\t\t    if (buffer)\n\t\t\tmax = INT_MAX;\n\t\t    else\n\t\t\tmax = *maxlen;\n\t\t}\n                fmtstr(sbuffer, buffer, &currlen, maxlen, strvalue,\n                       flags, min, max);\n                break;\n            case 'p':\n                value = (long)va_arg(args, void *);\n                fmtint(sbuffer, buffer, &currlen, maxlen,\n                    value, 16, min, max, flags|DP_F_NUM);\n                break;\n            case 'n':\n                if (cflags == DP_C_SHORT) {\n                    short int *num;\n                    num = va_arg(args, short int *);\n                    *num = currlen;\n                } else if (cflags == DP_C_LONG) {\n                    long int *num;\n                    num = va_arg(args, long int *);\n                    *num = (long int) currlen;\n                } else if (cflags == DP_C_LLONG) {\n                    LLONG *num;\n                    num = va_arg(args, LLONG *);\n                    *num = (LLONG) currlen;\n                } else {\n                    int    *num;\n                    num = va_arg(args, int *);\n                    *num = currlen;\n                }\n                break;\n            case '%':\n                doapr_outch(sbuffer, buffer, &currlen, maxlen, ch);\n                break;\n            case 'w':\n                ch = *format++;\n                break;\n            default:\n                break;\n            }\n            ch = *format++;\n            state = DP_S_DEFAULT;\n            flags = cflags = min = 0;\n            max = -1;\n            break;\n        case DP_S_DONE:\n            break;\n        default:\n            break;\n        }\n    }\n    *truncated = (currlen > *maxlen - 1);\n    if (*truncated)\n        currlen = *maxlen - 1;\n    doapr_outch(sbuffer, buffer, &currlen, maxlen, '\\0');\n    *retlen = currlen - 1;\n    return;\n}", 'static void\ndoapr_outch(\n    char **sbuffer,\n    char **buffer,\n    size_t *currlen,\n    size_t *maxlen,\n    int c)\n{\n    assert(*sbuffer != NULL || buffer != NULL);\n    if (buffer) {\n\twhile (*currlen >= *maxlen) {\n\t    if (*buffer == NULL) {\n\t\tif (*maxlen == 0)\n\t\t    *maxlen = 1024;\n\t\t*buffer = OPENSSL_malloc(*maxlen);\n\t\tif (*currlen > 0) {\n\t\t    assert(*sbuffer != NULL);\n\t\t    memcpy(*buffer, *sbuffer, *currlen);\n\t\t}\n\t\t*sbuffer = NULL;\n\t    } else {\n\t\t*maxlen += 1024;\n\t\t*buffer = OPENSSL_realloc(*buffer, *maxlen);\n\t    }\n\t}\n\tassert(*sbuffer != NULL || *buffer != NULL);\n    }\n    if (*currlen < *maxlen) {\n\tif (*sbuffer)\n\t    (*sbuffer)[(*currlen)++] = (char)c;\n\telse\n\t    (*buffer)[(*currlen)++] = (char)c;\n    }\n    return;\n}']