crypto/ts/ts_rsp_sign.c:1013: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] (⇐ [-1, 2147483647] + [0, +oo]) Size: 23 by call to `BIO_snprintf`.
Showing all 15 steps of the trace


crypto/ts/ts_rsp_sign.c:985:1: Array declaration
983.   }
984.   
985. > static ASN1_GENERALIZEDTIME *TS_RESP_set_genTime_with_precision(
986.           ASN1_GENERALIZEDTIME *asn1_time, long sec, long usec,
987.           unsigned precision)

crypto/ts/ts_rsp_sign.c:992:5: Assignment
990.       struct tm *tm = NULL, tm_result;
991.       char genTime_str[17 + TS_MAX_CLOCK_PRECISION_DIGITS];
992.       char *p = genTime_str;
           ^
993.       char *p_end = genTime_str + sizeof(genTime_str);
994.   

crypto/ts/ts_rsp_sign.c:1008:5: Assignment
1006.        * fraction-of-second details".
1007.        */
1008.       p += BIO_snprintf(p, p_end - p,
            ^
1009.                         "%04d%02d%02d%02d%02d%02d",
1010.                         tm->tm_year + 1900, tm->tm_mon + 1, tm->tm_mday,

crypto/ts/ts_rsp_sign.c:1013:9: Call
1011.                         tm->tm_hour, tm->tm_min, tm->tm_sec);
1012.       if (precision > 0) {
1013.           BIO_snprintf(p, 2 + precision, ".%06ld", usec);
                ^
1014.           p += strlen(p);
1015.   

crypto/bio/b_print.c:898:1: Parameter `*buf`
  896.    * function should be renamed, but to what?)
  897.    */
  898. > int BIO_snprintf(char *buf, size_t n, const char *format, ...)
  899.   {
  900.       va_list args;

crypto/bio/b_print.c:905:11: Call
  903.       va_start(args, format);
  904.   
  905.       ret = BIO_vsnprintf(buf, n, format, args);
                   ^
  906.   
  907.       va_end(args);

crypto/bio/b_print.c:911:1: Parameter `*buf`
    909.   }
    910.   
    911. > int BIO_vsnprintf(char *buf, size_t n, const char *format, va_list args)
    912.   {
    913.       size_t retlen;

crypto/bio/b_print.c:916:10: Call
    914.       int truncated;
    915.   
    916.       if (!_dopr(&buf, NULL, &n, &retlen, &truncated, format, args))
                    ^
    917.           return -1;
    918.   

crypto/bio/b_print.c:83:1: Parameter `*maxlen`
      81.   #define OSSL_MAX(p,q) ((p >= q) ? p : q)
      82.   
      83. > static int
      84.   _dopr(char **sbuffer,
      85.         char **buffer,

crypto/bio/b_print.c:114:22: Call
      112.                   state = DP_S_FLAGS;
      113.               else
      114.                   if (!doapr_outch(sbuffer, buffer, &currlen, maxlen, ch))
                                  ^
      115.                       return 0;
      116.               ch = *format++;

crypto/bio/b_print.c:804:1: <Offset trace>
802.   #define BUFFER_INC  1024
803.   
804. > static int
805.   doapr_outch(char **sbuffer,
806.               char **buffer, size_t *currlen, size_t *maxlen, int c)

crypto/bio/b_print.c:804:1: Parameter `*maxlen`
        802.   #define BUFFER_INC  1024
        803.   
        804. > static int
        805.   doapr_outch(char **sbuffer,
        806.               char **buffer, size_t *currlen, size_t *maxlen, int c)

crypto/bio/b_print.c:804:1: <Length trace>
802.   #define BUFFER_INC  1024
803.   
804. > static int
805.   doapr_outch(char **sbuffer,
806.               char **buffer, size_t *currlen, size_t *maxlen, int c)

crypto/bio/b_print.c:804:1: Parameter `**sbuffer`
        802.   #define BUFFER_INC  1024
        803.   
        804. > static int
        805.   doapr_outch(char **sbuffer,
        806.               char **buffer, size_t *currlen, size_t *maxlen, int c)

crypto/bio/b_print.c:842:13: Array access: Offset: [-1, +oo] (⇐ [-1, 2147483647] + [0, +oo]) Size: 23 by call to `BIO_snprintf` 
        840.       if (*currlen < *maxlen) {
        841.           if (*sbuffer)
        842.               (*sbuffer)[(*currlen)++] = (char)c;
                           ^
        843.           else
        844.               (*buffer)[(*currlen)++] = (char)c;

static int
doapr_outch(char **sbuffer,
            char **buffer, size_t *currlen, size_t *maxlen, int c)
{
    if (!ossl_assert(*sbuffer != NULL || buffer != NULL))
        return 0;
    if (!ossl_assert(*currlen <= *maxlen))
        return 0;
    if (buffer && *currlen == *maxlen) {
        if (*maxlen > INT_MAX - BUFFER_INC)
            return 0;
        *maxlen += BUFFER_INC;
        if (*buffer == NULL) {
            *buffer = OPENSSL_malloc(*maxlen);
            if (*buffer == NULL)
                return 0;
            if (*currlen > 0) {
                if (!ossl_assert(*sbuffer != NULL))
                    return 0;
                memcpy(*buffer, *sbuffer, *currlen);
            }
            *sbuffer = NULL;
        } else {
            char *tmpbuf;
            tmpbuf = OPENSSL_realloc(*buffer, *maxlen);
            if (tmpbuf == NULL)
                return 0;
            *buffer = tmpbuf;
        }
    }
    if (*currlen < *maxlen) {
        if (*sbuffer)
            (*sbuffer)[(*currlen)++] = (char)c;
        else
            (*buffer)[(*currlen)++] = (char)c;
    }
    return 1;
}
['static ASN1_GENERALIZEDTIME *TS_RESP_set_genTime_with_precision(\n        ASN1_GENERALIZEDTIME *asn1_time, long sec, long usec,\n        unsigned precision)\n{\n    time_t time_sec = (time_t)sec;\n    struct tm *tm = NULL, tm_result;\n    char genTime_str[17 + TS_MAX_CLOCK_PRECISION_DIGITS];\n    char *p = genTime_str;\n    char *p_end = genTime_str + sizeof(genTime_str);\n    if (precision > TS_MAX_CLOCK_PRECISION_DIGITS)\n        goto err;\n    if ((tm = OPENSSL_gmtime(&time_sec, &tm_result)) == NULL)\n        goto err;\n    p += BIO_snprintf(p, p_end - p,\n                      "%04d%02d%02d%02d%02d%02d",\n                      tm->tm_year + 1900, tm->tm_mon + 1, tm->tm_mday,\n                      tm->tm_hour, tm->tm_min, tm->tm_sec);\n    if (precision > 0) {\n        BIO_snprintf(p, 2 + precision, ".%06ld", usec);\n        p += strlen(p);\n        while (*--p == \'0\')\n             continue;\n        if (*p != \'.\')\n            ++p;\n    }\n    *p++ = \'Z\';\n    *p++ = \'\\0\';\n    if (asn1_time == NULL\n        && (asn1_time = ASN1_GENERALIZEDTIME_new()) == NULL)\n        goto err;\n    if (!ASN1_GENERALIZEDTIME_set_string(asn1_time, genTime_str)) {\n        ASN1_GENERALIZEDTIME_free(asn1_time);\n        goto err;\n    }\n    return asn1_time;\n err:\n    TSerr(TS_F_TS_RESP_SET_GENTIME_WITH_PRECISION, TS_R_COULD_NOT_SET_TIME);\n    return NULL;\n}', 'int BIO_snprintf(char *buf, size_t n, const char *format, ...)\n{\n    va_list args;\n    int ret;\n    va_start(args, format);\n    ret = BIO_vsnprintf(buf, n, format, args);\n    va_end(args);\n    return ret;\n}', 'int BIO_vsnprintf(char *buf, size_t n, const char *format, va_list args)\n{\n    size_t retlen;\n    int truncated;\n    if (!_dopr(&buf, NULL, &n, &retlen, &truncated, format, args))\n        return -1;\n    if (truncated)\n        return -1;\n    else\n        return (retlen <= INT_MAX) ? (int)retlen : -1;\n}', "static int\n_dopr(char **sbuffer,\n      char **buffer,\n      size_t *maxlen,\n      size_t *retlen, int *truncated, const char *format, va_list args)\n{\n    char ch;\n    int64_t value;\n    LDOUBLE fvalue;\n    char *strvalue;\n    int min;\n    int max;\n    int state;\n    int flags;\n    int cflags;\n    size_t currlen;\n    state = DP_S_DEFAULT;\n    flags = currlen = cflags = min = 0;\n    max = -1;\n    ch = *format++;\n    while (state != DP_S_DONE) {\n        if (ch == '\\0' || (buffer == NULL && currlen >= *maxlen))\n            state = DP_S_DONE;\n        switch (state) {\n        case DP_S_DEFAULT:\n            if (ch == '%')\n                state = DP_S_FLAGS;\n            else\n                if (!doapr_outch(sbuffer, buffer, &currlen, maxlen, ch))\n                    return 0;\n            ch = *format++;\n            break;\n        case DP_S_FLAGS:\n            switch (ch) {\n            case '-':\n                flags |= DP_F_MINUS;\n                ch = *format++;\n                break;\n            case '+':\n                flags |= DP_F_PLUS;\n                ch = *format++;\n                break;\n            case ' ':\n                flags |= DP_F_SPACE;\n                ch = *format++;\n                break;\n            case '#':\n                flags |= DP_F_NUM;\n                ch = *format++;\n                break;\n            case '0':\n                flags |= DP_F_ZERO;\n                ch = *format++;\n                break;\n            default:\n                state = DP_S_MIN;\n                break;\n            }\n            break;\n        case DP_S_MIN:\n            if (ossl_isdigit(ch)) {\n                min = 10 * min + char_to_int(ch);\n                ch = *format++;\n            } else if (ch == '*') {\n                min = va_arg(args, int);\n                ch = *format++;\n                state = DP_S_DOT;\n            } else\n                state = DP_S_DOT;\n            break;\n        case DP_S_DOT:\n            if (ch == '.') {\n                state = DP_S_MAX;\n                ch = *format++;\n            } else\n                state = DP_S_MOD;\n            break;\n        case DP_S_MAX:\n            if (ossl_isdigit(ch)) {\n                if (max < 0)\n                    max = 0;\n                max = 10 * max + char_to_int(ch);\n                ch = *format++;\n            } else if (ch == '*') {\n                max = va_arg(args, int);\n                ch = *format++;\n                state = DP_S_MOD;\n            } else\n                state = DP_S_MOD;\n            break;\n        case DP_S_MOD:\n            switch (ch) {\n            case 'h':\n                cflags = DP_C_SHORT;\n                ch = *format++;\n                break;\n            case 'l':\n                if (*format == 'l') {\n                    cflags = DP_C_LLONG;\n                    format++;\n                } else\n                    cflags = DP_C_LONG;\n                ch = *format++;\n                break;\n            case 'q':\n            case 'j':\n                cflags = DP_C_LLONG;\n                ch = *format++;\n                break;\n            case 'L':\n                cflags = DP_C_LDOUBLE;\n                ch = *format++;\n                break;\n            case 'z':\n                cflags = DP_C_SIZE;\n                ch = *format++;\n                break;\n            default:\n                break;\n            }\n            state = DP_S_CONV;\n            break;\n        case DP_S_CONV:\n            switch (ch) {\n            case 'd':\n            case 'i':\n                switch (cflags) {\n                case DP_C_SHORT:\n                    value = (short int)va_arg(args, int);\n                    break;\n                case DP_C_LONG:\n                    value = va_arg(args, long int);\n                    break;\n                case DP_C_LLONG:\n                    value = va_arg(args, int64_t);\n                    break;\n                case DP_C_SIZE:\n                    value = va_arg(args, ossl_ssize_t);\n                    break;\n                default:\n                    value = va_arg(args, int);\n                    break;\n                }\n                if (!fmtint(sbuffer, buffer, &currlen, maxlen, value, 10, min,\n                            max, flags))\n                    return 0;\n                break;\n            case 'X':\n                flags |= DP_F_UP;\n            case 'x':\n            case 'o':\n            case 'u':\n                flags |= DP_F_UNSIGNED;\n                switch (cflags) {\n                case DP_C_SHORT:\n                    value = (unsigned short int)va_arg(args, unsigned int);\n                    break;\n                case DP_C_LONG:\n                    value = va_arg(args, unsigned long int);\n                    break;\n                case DP_C_LLONG:\n                    value = va_arg(args, uint64_t);\n                    break;\n                case DP_C_SIZE:\n                    value = va_arg(args, size_t);\n                    break;\n                default:\n                    value = va_arg(args, unsigned int);\n                    break;\n                }\n                if (!fmtint(sbuffer, buffer, &currlen, maxlen, value,\n                            ch == 'o' ? 8 : (ch == 'u' ? 10 : 16),\n                            min, max, flags))\n                    return 0;\n                break;\n            case 'f':\n                if (cflags == DP_C_LDOUBLE)\n                    fvalue = va_arg(args, LDOUBLE);\n                else\n                    fvalue = va_arg(args, double);\n                if (!fmtfp(sbuffer, buffer, &currlen, maxlen, fvalue, min, max,\n                           flags, F_FORMAT))\n                    return 0;\n                break;\n            case 'E':\n                flags |= DP_F_UP;\n            case 'e':\n                if (cflags == DP_C_LDOUBLE)\n                    fvalue = va_arg(args, LDOUBLE);\n                else\n                    fvalue = va_arg(args, double);\n                if (!fmtfp(sbuffer, buffer, &currlen, maxlen, fvalue, min, max,\n                           flags, E_FORMAT))\n                    return 0;\n                break;\n            case 'G':\n                flags |= DP_F_UP;\n            case 'g':\n                if (cflags == DP_C_LDOUBLE)\n                    fvalue = va_arg(args, LDOUBLE);\n                else\n                    fvalue = va_arg(args, double);\n                if (!fmtfp(sbuffer, buffer, &currlen, maxlen, fvalue, min, max,\n                           flags, G_FORMAT))\n                    return 0;\n                break;\n            case 'c':\n                if (!doapr_outch(sbuffer, buffer, &currlen, maxlen,\n                                 va_arg(args, int)))\n                    return 0;\n                break;\n            case 's':\n                strvalue = va_arg(args, char *);\n                if (max < 0) {\n                    if (buffer)\n                        max = INT_MAX;\n                    else\n                        max = *maxlen;\n                }\n                if (!fmtstr(sbuffer, buffer, &currlen, maxlen, strvalue,\n                            flags, min, max))\n                    return 0;\n                break;\n            case 'p':\n                value = (size_t)va_arg(args, void *);\n                if (!fmtint(sbuffer, buffer, &currlen, maxlen,\n                            value, 16, min, max, flags | DP_F_NUM))\n                    return 0;\n                break;\n            case 'n':\n                {\n                    int *num;\n                    num = va_arg(args, int *);\n                    *num = currlen;\n                }\n                break;\n            case '%':\n                if (!doapr_outch(sbuffer, buffer, &currlen, maxlen, ch))\n                    return 0;\n                break;\n            case 'w':\n                ch = *format++;\n                break;\n            default:\n                break;\n            }\n            ch = *format++;\n            state = DP_S_DEFAULT;\n            flags = cflags = min = 0;\n            max = -1;\n            break;\n        case DP_S_DONE:\n            break;\n        default:\n            break;\n        }\n    }\n    if (buffer == NULL) {\n        *truncated = (currlen > *maxlen - 1);\n        if (*truncated)\n            currlen = *maxlen - 1;\n    }\n    if (!doapr_outch(sbuffer, buffer, &currlen, maxlen, '\\0'))\n        return 0;\n    *retlen = currlen - 1;\n    return 1;\n}", 'static int\ndoapr_outch(char **sbuffer,\n            char **buffer, size_t *currlen, size_t *maxlen, int c)\n{\n    if (!ossl_assert(*sbuffer != NULL || buffer != NULL))\n        return 0;\n    if (!ossl_assert(*currlen <= *maxlen))\n        return 0;\n    if (buffer && *currlen == *maxlen) {\n        if (*maxlen > INT_MAX - BUFFER_INC)\n            return 0;\n        *maxlen += BUFFER_INC;\n        if (*buffer == NULL) {\n            *buffer = OPENSSL_malloc(*maxlen);\n            if (*buffer == NULL)\n                return 0;\n            if (*currlen > 0) {\n                if (!ossl_assert(*sbuffer != NULL))\n                    return 0;\n                memcpy(*buffer, *sbuffer, *currlen);\n            }\n            *sbuffer = NULL;\n        } else {\n            char *tmpbuf;\n            tmpbuf = OPENSSL_realloc(*buffer, *maxlen);\n            if (tmpbuf == NULL)\n                return 0;\n            *buffer = tmpbuf;\n        }\n    }\n    if (*currlen < *maxlen) {\n        if (*sbuffer)\n            (*sbuffer)[(*currlen)++] = (char)c;\n        else\n            (*buffer)[(*currlen)++] = (char)c;\n    }\n    return 1;\n}']