crypto/ct/ct_oct.c:424: error: BUFFER_OVERRUN_L3
  Offset added: [44, +oo] (⇐ 43 + [1, +oo]) Size: [1, +oo] by call to `i2o_SCT`.
Showing all 22 steps of the trace


crypto/ct/ct_oct.c:420:28: Call
418.               p2 = p;
419.               p += 2;
420.               if ((sct_len = i2o_SCT(sk_SCT_value(a, i), &p)) == -1)
                                  ^
421.                   goto err;
422.               s2n(sct_len, p2);

crypto/ct/ct_oct.c:268:1: Parameter `sct->ext_len`
  266.   }
  267.   
  268. > int i2o_SCT(const SCT *sct, unsigned char **out)
  269.   {
  270.       size_t len;

crypto/ct/ct_oct.c:420:28: Call
418.               p2 = p;
419.               p += 2;
420.               if ((sct_len = i2o_SCT(sk_SCT_value(a, i), &p)) == -1)
                                  ^
421.                   goto err;
422.               s2n(sct_len, p2);

crypto/ct/ct_oct.c:268:1: Parameter `sct->ext_len`
  266.   }
  267.   
  268. > int i2o_SCT(const SCT *sct, unsigned char **out)
  269.   {
  270.       size_t len;

crypto/ct/ct_oct.c:424:26: Call
422.               s2n(sct_len, p2);
423.           } else {
424.             if ((sct_len = i2o_SCT(sk_SCT_value(a, i), NULL)) == -1)
                                ^
425.                 goto err;
426.           }

crypto/ct/ct_oct.c:268:1: <Offset trace>
266.   }
267.   
268. > int i2o_SCT(const SCT *sct, unsigned char **out)
269.   {
270.       size_t len;

crypto/ct/ct_oct.c:268:1: Parameter `sct->ext_len`
  266.   }
  267.   
  268. > int i2o_SCT(const SCT *sct, unsigned char **out)
  269.   {
  270.       size_t len;

crypto/ct/ct_oct.c:268:1: <Length trace>
266.   }
267.   
268. > int i2o_SCT(const SCT *sct, unsigned char **out)
269.   {
270.       size_t len;

crypto/ct/ct_oct.c:268:1: Parameter `**out`
  266.   }
  267.   
  268. > int i2o_SCT(const SCT *sct, unsigned char **out)
  269.   {
  270.       size_t len;

crypto/ct/ct_oct.c:292:9: Assignment
  290.   
  291.       if (*out != NULL) {
  292.           p = *out;
                 ^
  293.           *out += len;
  294.       } else {

crypto/ct/ct_oct.c:304:10: Assignment
  302.   
  303.       if (sct->version == SCT_VERSION_V1) {
  304.           *p++ = sct->version;
                  ^
  305.           memcpy(p, sct->log_id, CT_V1_HASHLEN);
  306.           p += CT_V1_HASHLEN;

crypto/ct/ct_oct.c:306:9: Assignment
  304.           *p++ = sct->version;
  305.           memcpy(p, sct->log_id, CT_V1_HASHLEN);
  306.           p += CT_V1_HASHLEN;
                 ^
  307.           l2n8(sct->timestamp, p);
  308.           s2n(sct->ext_len, p);

crypto/ct/ct_oct.c:307:9: Assignment
  305.           memcpy(p, sct->log_id, CT_V1_HASHLEN);
  306.           p += CT_V1_HASHLEN;
  307.           l2n8(sct->timestamp, p);
                 ^
  308.           s2n(sct->ext_len, p);
  309.           if (sct->ext_len > 0) {

crypto/ct/ct_oct.c:307:9: Assignment
  305.           memcpy(p, sct->log_id, CT_V1_HASHLEN);
  306.           p += CT_V1_HASHLEN;
  307.           l2n8(sct->timestamp, p);
                 ^
  308.           s2n(sct->ext_len, p);
  309.           if (sct->ext_len > 0) {

crypto/ct/ct_oct.c:307:9: Assignment
  305.           memcpy(p, sct->log_id, CT_V1_HASHLEN);
  306.           p += CT_V1_HASHLEN;
  307.           l2n8(sct->timestamp, p);
                 ^
  308.           s2n(sct->ext_len, p);
  309.           if (sct->ext_len > 0) {

crypto/ct/ct_oct.c:307:9: Assignment
  305.           memcpy(p, sct->log_id, CT_V1_HASHLEN);
  306.           p += CT_V1_HASHLEN;
  307.           l2n8(sct->timestamp, p);
                 ^
  308.           s2n(sct->ext_len, p);
  309.           if (sct->ext_len > 0) {

crypto/ct/ct_oct.c:307:9: Assignment
  305.           memcpy(p, sct->log_id, CT_V1_HASHLEN);
  306.           p += CT_V1_HASHLEN;
  307.           l2n8(sct->timestamp, p);
                 ^
  308.           s2n(sct->ext_len, p);
  309.           if (sct->ext_len > 0) {

crypto/ct/ct_oct.c:307:9: Assignment
  305.           memcpy(p, sct->log_id, CT_V1_HASHLEN);
  306.           p += CT_V1_HASHLEN;
  307.           l2n8(sct->timestamp, p);
                 ^
  308.           s2n(sct->ext_len, p);
  309.           if (sct->ext_len > 0) {

crypto/ct/ct_oct.c:307:9: Assignment
  305.           memcpy(p, sct->log_id, CT_V1_HASHLEN);
  306.           p += CT_V1_HASHLEN;
  307.           l2n8(sct->timestamp, p);
                 ^
  308.           s2n(sct->ext_len, p);
  309.           if (sct->ext_len > 0) {

crypto/ct/ct_oct.c:307:9: Assignment
  305.           memcpy(p, sct->log_id, CT_V1_HASHLEN);
  306.           p += CT_V1_HASHLEN;
  307.           l2n8(sct->timestamp, p);
                 ^
  308.           s2n(sct->ext_len, p);
  309.           if (sct->ext_len > 0) {

crypto/ct/ct_oct.c:308:9: Assignment
  306.           p += CT_V1_HASHLEN;
  307.           l2n8(sct->timestamp, p);
  308.           s2n(sct->ext_len, p);
                 ^
  309.           if (sct->ext_len > 0) {
  310.               memcpy(p, sct->ext, sct->ext_len);

crypto/ct/ct_oct.c:310:13: Array access: Offset added: [44, +oo] (⇐ 43 + [1, +oo]) Size: [1, +oo] by call to `i2o_SCT` 
  308.           s2n(sct->ext_len, p);
  309.           if (sct->ext_len > 0) {
  310.               memcpy(p, sct->ext, sct->ext_len);
                     ^
  311.               p += sct->ext_len;
  312.           }

int i2o_SCT(const SCT *sct, unsigned char **out)
{
    size_t len;
    unsigned char *p = NULL;
    if (!SCT_is_complete(sct)) {
        CTerr(CT_F_I2O_SCT, CT_R_SCT_NOT_SET);
        goto err;
    }
    if (sct->version == SCT_VERSION_V1)
        len = 43 + sct->ext_len + 4 + sct->sig_len;
    else
        len = sct->sct_len;
    if (out == NULL)
        return len;
    if (*out != NULL) {
        p = *out;
        *out += len;
    } else {
        p = OPENSSL_malloc(len);
        if (p == NULL) {
            CTerr(CT_F_I2O_SCT, ERR_R_MALLOC_FAILURE);
            goto err;
        }
        *out = p;
    }
    if (sct->version == SCT_VERSION_V1) {
        *p++ = sct->version;
        memcpy(p, sct->log_id, CT_V1_HASHLEN);
        p += CT_V1_HASHLEN;
        l2n8(sct->timestamp, p);
        s2n(sct->ext_len, p);
        if (sct->ext_len > 0) {
            memcpy(p, sct->ext, sct->ext_len);
            p += sct->ext_len;
        }
        if (i2o_SCT_signature(sct, &p) <= 0)
            goto err;
    } else {
        memcpy(p, sct->sct, len);
    }
    return len;
err:
    OPENSSL_free(p);
    return -1;
}
['int i2o_SCT_LIST(const STACK_OF(SCT) *a, unsigned char **pp)\n{\n    int len, sct_len, i, is_pp_new = 0;\n    size_t len2;\n    unsigned char *p = NULL, *p2;\n    if (pp != NULL) {\n        if (*pp == NULL) {\n            if ((len = i2o_SCT_LIST(a, NULL)) == -1) {\n                CTerr(CT_F_I2O_SCT_LIST, CT_R_SCT_LIST_INVALID);\n                return -1;\n            }\n            if ((*pp = OPENSSL_malloc(len)) == NULL) {\n                CTerr(CT_F_I2O_SCT_LIST, ERR_R_MALLOC_FAILURE);\n                return -1;\n            }\n            is_pp_new = 1;\n        }\n        p = *pp + 2;\n    }\n    len2 = 2;\n    for (i = 0; i < sk_SCT_num(a); i++) {\n        if (pp != NULL) {\n            p2 = p;\n            p += 2;\n            if ((sct_len = i2o_SCT(sk_SCT_value(a, i), &p)) == -1)\n                goto err;\n            s2n(sct_len, p2);\n        } else {\n          if ((sct_len = i2o_SCT(sk_SCT_value(a, i), NULL)) == -1)\n              goto err;\n        }\n        len2 += 2 + sct_len;\n    }\n    if (len2 > MAX_SCT_LIST_SIZE)\n        goto err;\n    if (pp != NULL) {\n        p = *pp;\n        s2n(len2 - 2, p);\n    }\n    if (!is_pp_new)\n        *pp += len2;\n    return len2;\n err:\n    if (is_pp_new) {\n        OPENSSL_free(*pp);\n        *pp = NULL;\n    }\n    return -1;\n}', 'int i2o_SCT(const SCT *sct, unsigned char **out)\n{\n    size_t len;\n    unsigned char *p = NULL;\n    if (!SCT_is_complete(sct)) {\n        CTerr(CT_F_I2O_SCT, CT_R_SCT_NOT_SET);\n        goto err;\n    }\n    if (sct->version == SCT_VERSION_V1)\n        len = 43 + sct->ext_len + 4 + sct->sig_len;\n    else\n        len = sct->sct_len;\n    if (out == NULL)\n        return len;\n    if (*out != NULL) {\n        p = *out;\n        *out += len;\n    } else {\n        p = OPENSSL_malloc(len);\n        if (p == NULL) {\n            CTerr(CT_F_I2O_SCT, ERR_R_MALLOC_FAILURE);\n            goto err;\n        }\n        *out = p;\n    }\n    if (sct->version == SCT_VERSION_V1) {\n        *p++ = sct->version;\n        memcpy(p, sct->log_id, CT_V1_HASHLEN);\n        p += CT_V1_HASHLEN;\n        l2n8(sct->timestamp, p);\n        s2n(sct->ext_len, p);\n        if (sct->ext_len > 0) {\n            memcpy(p, sct->ext, sct->ext_len);\n            p += sct->ext_len;\n        }\n        if (i2o_SCT_signature(sct, &p) <= 0)\n            goto err;\n    } else {\n        memcpy(p, sct->sct, len);\n    }\n    return len;\nerr:\n    OPENSSL_free(p);\n    return -1;\n}']