test/ct_test.c:524: error: BUFFER_OVERRUN_L3
  Offset: 3 (⇐ 2 + 1) Size: [1, 288] by call to `SCT_new_from_base64`.
Showing all 12 steps of the trace


test/ct_test.c:518:5: Array declaration
516.       const uint64_t timestamp = 1;
517.       const char extensions[] = "";
518.       const char signature[] = "RQIgSC9nUa8126ZUNr4f1mQPPb+aQUKUlZJFMCiPo+XiPgY"
           ^
519.           "CIQDk7cDbOsVyseL16KtqaAZTmH3PQQJ9/v+hBVGdie2/CA==";
520.   

test/ct_test.c:524:16: Call
522.   
523.       STACK_OF(SCT) *sct_list = sk_SCT_new_null();
524.       SCT *sct = SCT_new_from_base64(SCT_VERSION_V1, log_id,
                      ^
525.                                      CT_LOG_ENTRY_TYPE_X509, timestamp,
526.                                      extensions, signature);

crypto/ct/ct_b64.c:55:1: Parameter `signature_base64->strlen`
  53.   }
  54.   
  55. > SCT *SCT_new_from_base64(unsigned char version, const char *logid_base64,
  56.                            ct_log_entry_type_t entry_type, uint64_t timestamp,
  57.                            const char *extensions_base64,

crypto/ct/ct_b64.c:95:14: Call
  93.       dec = NULL;
  94.   
  95.       declen = ct_base64_decode(signature_base64, &dec);
                     ^
  96.       if (declen < 0) {
  97.           CTerr(CT_F_SCT_NEW_FROM_BASE64, X509_R_BASE64_DECODE_ERROR);

crypto/ct/ct_b64.c:24:1: Parameter `**out`
    22.    * the caller. Do not provide a pre-allocated string in |out|.
    23.    */
    24. > static int ct_base64_decode(const char *in, unsigned char **out)
    25.   {
    26.       size_t inlen = strlen(in);

crypto/ct/ct_b64.c:100:9: Call
  98.           goto err;
  99.       }
  100.       if (o2i_SCT_signature(sct, (const unsigned char **)&dec, declen) <= 0)
                 ^
  101.           goto err;
  102.       OPENSSL_free(dec);

crypto/ct/ct_oct.c:24:1: <Length trace>
22.   #include "ct_locl.h"
23.   
24. > int o2i_SCT_signature(SCT *sct, const unsigned char **in, size_t len)
25.   {
26.       size_t siglen;

crypto/ct/ct_oct.c:24:1: Parameter `**in`
    22.   #include "ct_locl.h"
    23.   
    24. > int o2i_SCT_signature(SCT *sct, const unsigned char **in, size_t len)
    25.   {
    26.       size_t siglen;

crypto/ct/ct_oct.c:46:5: Assignment
    44.       }
    45.   
    46.       p = *in;
              ^
    47.       /* Get hash and signature algorithm */
    48.       sct->hash_alg = *p++;

crypto/ct/ct_oct.c:48:22: Assignment
    46.       p = *in;
    47.       /* Get hash and signature algorithm */
    48.       sct->hash_alg = *p++;
                               ^
    49.       sct->sig_alg = *p++;
    50.       if (SCT_get_signature_nid(sct) == NID_undef) {

crypto/ct/ct_oct.c:49:21: Assignment
    47.       /* Get hash and signature algorithm */
    48.       sct->hash_alg = *p++;
    49.       sct->sig_alg = *p++;
                              ^
    50.       if (SCT_get_signature_nid(sct) == NID_undef) {
    51.           CTerr(CT_F_O2I_SCT_SIGNATURE, CT_R_SCT_INVALID_SIGNATURE);

crypto/ct/ct_oct.c:55:5: Array access: Offset: 3 (⇐ 2 + 1) Size: [1, 288] by call to `SCT_new_from_base64` 
    53.       }
    54.       /* Retrieve signature and check it is consistent with the buffer length */
    55.       n2s(p, siglen);
              ^
    56.       len_remaining -= (p - *in);
    57.       if (siglen > len_remaining) {

int o2i_SCT_signature(SCT *sct, const unsigned char **in, size_t len)
{
    size_t siglen;
    size_t len_remaining = len;
    const unsigned char *p;
    if (sct->version != SCT_VERSION_V1) {
        CTerr(CT_F_O2I_SCT_SIGNATURE, CT_R_UNSUPPORTED_VERSION);
        return -1;
    }
    if (len <= 4) {
        CTerr(CT_F_O2I_SCT_SIGNATURE, CT_R_SCT_INVALID_SIGNATURE);
        return -1;
    }
    p = *in;
    sct->hash_alg = *p++;
    sct->sig_alg = *p++;
    if (SCT_get_signature_nid(sct) == NID_undef) {
        CTerr(CT_F_O2I_SCT_SIGNATURE, CT_R_SCT_INVALID_SIGNATURE);
        return -1;
    }
    n2s(p, siglen);
    len_remaining -= (p - *in);
    if (siglen > len_remaining) {
        CTerr(CT_F_O2I_SCT_SIGNATURE, CT_R_SCT_INVALID_SIGNATURE);
        return -1;
    }
    if (SCT_set1_signature(sct, p, siglen) != 1)
        return -1;
    len_remaining -= siglen;
    *in = p + siglen;
    return len - len_remaining;
}
['static int test_encode_tls_sct()\n{\n    const char log_id[] = "3xwuwRUAlFJHqWFoMl3cXHlZ6PfG04j8AC4LvT9012Q=";\n    const uint64_t timestamp = 1;\n    const char extensions[] = "";\n    const char signature[] = "RQIgSC9nUa8126ZUNr4f1mQPPb+aQUKUlZJFMCiPo+XiPgY"\n        "CIQDk7cDbOsVyseL16KtqaAZTmH3PQQJ9/v+hBVGdie2/CA==";\n    SETUP_CT_TEST_FIXTURE();\n    STACK_OF(SCT) *sct_list = sk_SCT_new_null();\n    SCT *sct = SCT_new_from_base64(SCT_VERSION_V1, log_id,\n                                   CT_LOG_ENTRY_TYPE_X509, timestamp,\n                                   extensions, signature);\n    if (sct == NULL) {\n        fprintf(stderr, "Failed to create SCT from base64-encoded test data\\n");\n        return 0;\n    }\n    sk_SCT_push(sct_list, sct);\n    fixture.sct_list = sct_list;\n    fixture.sct_dir = ct_dir;\n    fixture.sct_text_file = "tls1.sct";\n    EXECUTE_CT_TEST();\n}', 'SCT *SCT_new_from_base64(unsigned char version, const char *logid_base64,\n                         ct_log_entry_type_t entry_type, uint64_t timestamp,\n                         const char *extensions_base64,\n                         const char *signature_base64)\n{\n    SCT *sct = SCT_new();\n    unsigned char *dec = NULL;\n    int declen;\n    if (sct == NULL) {\n        CTerr(CT_F_SCT_NEW_FROM_BASE64, ERR_R_MALLOC_FAILURE);\n        return NULL;\n    }\n    if (!SCT_set_version(sct, version)) {\n        CTerr(CT_F_SCT_NEW_FROM_BASE64, CT_R_SCT_UNSUPPORTED_VERSION);\n        goto err;\n    }\n    declen = ct_base64_decode(logid_base64, &dec);\n    if (declen < 0) {\n        CTerr(CT_F_SCT_NEW_FROM_BASE64, X509_R_BASE64_DECODE_ERROR);\n        goto err;\n    }\n    if (!SCT_set0_log_id(sct, dec, declen))\n        goto err;\n    dec = NULL;\n    declen = ct_base64_decode(extensions_base64, &dec);\n    if (declen < 0) {\n        CTerr(CT_F_SCT_NEW_FROM_BASE64, X509_R_BASE64_DECODE_ERROR);\n        goto err;\n    }\n    SCT_set0_extensions(sct, dec, declen);\n    dec = NULL;\n    declen = ct_base64_decode(signature_base64, &dec);\n    if (declen < 0) {\n        CTerr(CT_F_SCT_NEW_FROM_BASE64, X509_R_BASE64_DECODE_ERROR);\n        goto err;\n    }\n    if (o2i_SCT_signature(sct, (const unsigned char **)&dec, declen) <= 0)\n        goto err;\n    OPENSSL_free(dec);\n    dec = NULL;\n    SCT_set_timestamp(sct, timestamp);\n    if (!SCT_set_log_entry_type(sct, entry_type))\n        goto err;\n    return sct;\n err:\n    OPENSSL_free(dec);\n    SCT_free(sct);\n    return NULL;\n}', 'static int ct_base64_decode(const char *in, unsigned char **out)\n{\n    size_t inlen = strlen(in);\n    int outlen;\n    unsigned char *outbuf = NULL;\n    if (inlen == 0) {\n        *out = NULL;\n        return 0;\n    }\n    outlen = (inlen / 4) * 3;\n    outbuf = OPENSSL_malloc(outlen);\n    if (outbuf == NULL) {\n        CTerr(CT_F_CT_BASE64_DECODE, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    outlen = EVP_DecodeBlock(outbuf, (unsigned char *)in, inlen);\n    if (outlen < 0) {\n        CTerr(CT_F_CT_BASE64_DECODE, CT_R_BASE64_DECODE_ERROR);\n        goto err;\n    }\n    *out = outbuf;\n    return outlen;\nerr:\n    OPENSSL_free(outbuf);\n    return -1;\n}', 'int o2i_SCT_signature(SCT *sct, const unsigned char **in, size_t len)\n{\n    size_t siglen;\n    size_t len_remaining = len;\n    const unsigned char *p;\n    if (sct->version != SCT_VERSION_V1) {\n        CTerr(CT_F_O2I_SCT_SIGNATURE, CT_R_UNSUPPORTED_VERSION);\n        return -1;\n    }\n    if (len <= 4) {\n        CTerr(CT_F_O2I_SCT_SIGNATURE, CT_R_SCT_INVALID_SIGNATURE);\n        return -1;\n    }\n    p = *in;\n    sct->hash_alg = *p++;\n    sct->sig_alg = *p++;\n    if (SCT_get_signature_nid(sct) == NID_undef) {\n        CTerr(CT_F_O2I_SCT_SIGNATURE, CT_R_SCT_INVALID_SIGNATURE);\n        return -1;\n    }\n    n2s(p, siglen);\n    len_remaining -= (p - *in);\n    if (siglen > len_remaining) {\n        CTerr(CT_F_O2I_SCT_SIGNATURE, CT_R_SCT_INVALID_SIGNATURE);\n        return -1;\n    }\n    if (SCT_set1_signature(sct, p, siglen) != 1)\n        return -1;\n    len_remaining -= siglen;\n    *in = p + siglen;\n    return len - len_remaining;\n}']