crypto/asn1/a_time.c:94: error: BUFFER_OVERRUN_S2
  Offset: [`t->data->strlen` + 2, `t->data->strlen` + 2] Size: [1, +oo].
Showing all 8 steps of the trace


crypto/asn1/a_time.c:62:1: <Offset trace>
60.   
61.   /* Convert an ASN1_TIME structure to GeneralizedTime */
62. > ASN1_GENERALIZEDTIME *ASN1_TIME_to_generalizedtime(const ASN1_TIME *t,
63.                                                      ASN1_GENERALIZEDTIME **out)
64.   {

crypto/asn1/a_time.c:62:1: Parameter `t->data->strlen`
60.   
61.   /* Convert an ASN1_TIME structure to GeneralizedTime */
62. > ASN1_GENERALIZEDTIME *ASN1_TIME_to_generalizedtime(const ASN1_TIME *t,
63.                                                      ASN1_GENERALIZEDTIME **out)
64.   {

crypto/asn1/a_time.c:62:1: <Length trace>
60.   
61.   /* Convert an ASN1_TIME structure to GeneralizedTime */
62. > ASN1_GENERALIZEDTIME *ASN1_TIME_to_generalizedtime(const ASN1_TIME *t,
63.                                                      ASN1_GENERALIZEDTIME **out)
64.   {

crypto/asn1/a_time.c:62:1: Parameter `*(*out)->data`
60.   
61.   /* Convert an ASN1_TIME structure to GeneralizedTime */
62. > ASN1_GENERALIZEDTIME *ASN1_TIME_to_generalizedtime(const ASN1_TIME *t,
63.                                                      ASN1_GENERALIZEDTIME **out)
64.   {

crypto/asn1/a_time.c:85:10: Call
83.   
84.       /* grow the string */
85.       if (!ASN1_STRING_set(ret, NULL, t->length + 2))
               ^
86.           goto err;
87.       str = (char *)ret->data;

crypto/asn1/asn1_lib.c:264:1: Parameter `*str->data`
  262.   }
  263.   
  264. > int ASN1_STRING_set(ASN1_STRING *str, const void *_data, int len)
  265.   {
  266.       unsigned char *c;

crypto/asn1/a_time.c:87:5: Assignment
85.       if (!ASN1_STRING_set(ret, NULL, t->length + 2))
86.           goto err;
87.       str = (char *)ret->data;
          ^
88.       /* Work out the century and prepend */
89.       if (t->data[0] >= '5')

crypto/asn1/a_time.c:94:5: Array access: Offset: [t->data->strlen + 2, t->data->strlen + 2] Size: [1, +oo]
92.           strcpy(str, "20");
93.   
94.       strcat(str, (const char *)t->data);
          ^
95.   
96.    done:

ASN1_GENERALIZEDTIME *ASN1_TIME_to_generalizedtime(const ASN1_TIME *t,
                                                   ASN1_GENERALIZEDTIME **out)
{
    ASN1_GENERALIZEDTIME *ret = NULL;
    char *str;
    if (!ASN1_TIME_check(t))
        return NULL;
    if (out == NULL || *out == NULL) {
        if ((ret = ASN1_GENERALIZEDTIME_new()) == NULL)
            goto err;
    } else
        ret = *out;
    if (t->type == V_ASN1_GENERALIZEDTIME) {
        if (!ASN1_STRING_set(ret, t->data, t->length))
            goto err;
        goto done;
    }
    if (!ASN1_STRING_set(ret, NULL, t->length + 2))
        goto err;
    str = (char *)ret->data;
    if (t->data[0] >= '5')
        strcpy(str, "19");
    else
        strcpy(str, "20");
    strcat(str, (const char *)t->data);
 done:
   if (out != NULL && *out == NULL)
       *out = ret;
   return ret;
 err:
    if (out == NULL || *out != ret)
        ASN1_GENERALIZEDTIME_free(ret);
    return NULL;
}
['ASN1_GENERALIZEDTIME *ASN1_TIME_to_generalizedtime(const ASN1_TIME *t,\n                                                   ASN1_GENERALIZEDTIME **out)\n{\n    ASN1_GENERALIZEDTIME *ret = NULL;\n    char *str;\n    if (!ASN1_TIME_check(t))\n        return NULL;\n    if (out == NULL || *out == NULL) {\n        if ((ret = ASN1_GENERALIZEDTIME_new()) == NULL)\n            goto err;\n    } else\n        ret = *out;\n    if (t->type == V_ASN1_GENERALIZEDTIME) {\n        if (!ASN1_STRING_set(ret, t->data, t->length))\n            goto err;\n        goto done;\n    }\n    if (!ASN1_STRING_set(ret, NULL, t->length + 2))\n        goto err;\n    str = (char *)ret->data;\n    if (t->data[0] >= \'5\')\n        strcpy(str, "19");\n    else\n        strcpy(str, "20");\n    strcat(str, (const char *)t->data);\n done:\n   if (out != NULL && *out == NULL)\n       *out = ret;\n   return ret;\n err:\n    if (out == NULL || *out != ret)\n        ASN1_GENERALIZEDTIME_free(ret);\n    return NULL;\n}', "int ASN1_STRING_set(ASN1_STRING *str, const void *_data, int len)\n{\n    unsigned char *c;\n    const char *data = _data;\n    if (len < 0) {\n        if (data == NULL)\n            return (0);\n        else\n            len = strlen(data);\n    }\n    if ((str->length <= len) || (str->data == NULL)) {\n        c = str->data;\n        str->data = OPENSSL_realloc(c, len + 1);\n        if (str->data == NULL) {\n            ASN1err(ASN1_F_ASN1_STRING_SET, ERR_R_MALLOC_FAILURE);\n            str->data = c;\n            return (0);\n        }\n    }\n    str->length = len;\n    if (data != NULL) {\n        memcpy(str->data, data, len);\n        str->data[len] = '\\0';\n    }\n    return (1);\n}"]