fuzz/test-corpus.c:55: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, +oo] by call to `FuzzerTestOneInput`.
Showing all 23 steps of the trace


fuzz/test-corpus.c:51:11: Array declaration
49.       if (f == NULL)
50.           return;
51.       buf = malloc(st.st_size);
                ^
52.       if (buf != NULL) {
53.           s = fread(buf, 1, st.st_size, f);

fuzz/test-corpus.c:51:5: Assignment
49.       if (f == NULL)
50.           return;
51.       buf = malloc(st.st_size);
          ^
52.       if (buf != NULL) {
53.           s = fread(buf, 1, st.st_size, f);

fuzz/test-corpus.c:55:9: Call
53.           s = fread(buf, 1, st.st_size, f);
54.           OPENSSL_assert(s == (size_t)st.st_size);
55.           FuzzerTestOneInput(buf, s);
              ^
56.           free(buf);
57.       }

fuzz/x509.c:28:1: Parameter `*buf`
  26.   }
  27.   
  28. > int FuzzerTestOneInput(const uint8_t *buf, size_t len)
  29.   {
  30.       const unsigned char *p = buf;

fuzz/x509.c:30:5: Assignment
  28.   int FuzzerTestOneInput(const uint8_t *buf, size_t len)
  29.   {
  30.       const unsigned char *p = buf;
            ^
  31.       unsigned char *der = NULL;
  32.   

fuzz/x509.c:33:18: Call
  31.       unsigned char *der = NULL;
  32.   
  33.       X509 *x509 = d2i_X509(NULL, &p, len);
                         ^
  34.       if (x509 != NULL) {
  35.           BIO *bio = BIO_new(BIO_s_null());

crypto/x509/x_x509.c:86:1: Parameter `**in`
    84.   } ASN1_SEQUENCE_END_ref(X509, X509)
    85.   
    86. > IMPLEMENT_ASN1_FUNCTIONS(X509)
    87.   
    88.   IMPLEMENT_ASN1_DUP_FUNCTION(X509)

crypto/x509/x_x509.c:86:1: Call
    84.   } ASN1_SEQUENCE_END_ref(X509, X509)
    85.   
    86. > IMPLEMENT_ASN1_FUNCTIONS(X509)
    87.   
    88.   IMPLEMENT_ASN1_DUP_FUNCTION(X509)

crypto/asn1/tasn_dec.c:105:1: Parameter `**in`
      103.    */
      104.   
      105. > ASN1_VALUE *ASN1_item_d2i(ASN1_VALUE **pval,
      106.                             const unsigned char **in, long len,
      107.                             const ASN1_ITEM *it)

crypto/asn1/tasn_dec.c:114:9: Call
      112.           pval = &ptmpval;
      113.       asn1_tlc_clear_nc(&c);
      114.       if (ASN1_item_ex_d2i(pval, in, len, it, -1, 0, 0, &c) > 0)
                     ^
      115.           return *pval;
      116.       return NULL;

crypto/asn1/tasn_dec.c:119:1: Parameter `**in`
        117.   }
        118.   
        119. > int ASN1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in, long len,
        120.                        const ASN1_ITEM *it,
        121.                        int tag, int aclass, char opt, ASN1_TLC *ctx)

crypto/asn1/tasn_dec.c:124:10: Call
        122.   {
        123.       int rv;
        124.       rv = asn1_item_embed_d2i(pval, in, len, it, tag, aclass, opt, ctx, 0);
                        ^
        125.       if (rv <= 0)
        126.           ASN1_item_ex_free(pval, it);

crypto/asn1/tasn_dec.c:135:1: Parameter `**in`
          133.    */
          134.   
          135. > static int asn1_item_embed_d2i(ASN1_VALUE **pval, const unsigned char **in,
          136.                                  long len, const ASN1_ITEM *it,
          137.                                  int tag, int aclass, char opt, ASN1_TLC *ctx,

crypto/asn1/tasn_dec.c:185:9: Assignment
          183.   
          184.       case ASN1_ITYPE_MSTRING:
          185.           p = *in;
                         ^
          186.           /* Just read in tag and class */
          187.           ret = asn1_check_tlen(NULL, &otag, &oclass, NULL, NULL,

crypto/asn1/tasn_dec.c:187:15: Call
          185.           p = *in;
          186.           /* Just read in tag and class */
          187.           ret = asn1_check_tlen(NULL, &otag, &oclass, NULL, NULL,
                               ^
          188.                                 &p, len, -1, 0, 1, ctx);
          189.           if (!ret) {

crypto/asn1/tasn_dec.c:1078:1: Parameter `**in`
            1076.    */
            1077.   
            1078. > static int asn1_check_tlen(long *olen, int *otag, unsigned char *oclass,
            1079.                              char *inf, char *cst,
            1080.                              const unsigned char **in, long len,

crypto/asn1/tasn_dec.c:1087:5: Assignment
            1085.       long plen;
            1086.       const unsigned char *p, *q;
            1087.       p = *in;
                        ^
            1088.       q = p;
            1089.   

crypto/asn1/tasn_dec.c:1097:13: Call
            1095.           p += ctx->hdrlen;
            1096.       } else {
            1097.           i = ASN1_get_object(&p, &plen, &ptag, &pclass, len);
                                ^
            1098.           if (ctx) {
            1099.               ctx->ret = i;

crypto/asn1/asn1_lib.c:44:1: <Length trace>
42.   }
43.   
44. > int ASN1_get_object(const unsigned char **pp, long *plength, int *ptag,
45.                       int *pclass, long omax)
46.   {

crypto/asn1/asn1_lib.c:44:1: Parameter `**pp`
              42.   }
              43.   
              44. > int ASN1_get_object(const unsigned char **pp, long *plength, int *ptag,
              45.                       int *pclass, long omax)
              46.   {

crypto/asn1/asn1_lib.c:49:5: Assignment
              47.       int i, ret;
              48.       long l;
              49.       const unsigned char *p = *pp;
                        ^
              50.       int tag, xclass, inf;
              51.       long max = omax;

crypto/asn1/asn1_lib.c:59:9: Assignment
              57.       i = *p & V_ASN1_PRIMITIVE_TAG;
              58.       if (i == V_ASN1_PRIMITIVE_TAG) { /* high-tag */
              59.           p++;
                            ^
              60.           if (--max == 0)
              61.               goto err;

crypto/asn1/asn1_lib.c:63:16: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `FuzzerTestOneInput` 
              61.               goto err;
              62.           l = 0;
              63.           while (*p & 0x80) {
                                   ^
              64.               l <<= 7L;
              65.               l |= *(p++) & 0x7f;

int ASN1_get_object(const unsigned char **pp, long *plength, int *ptag,
                    int *pclass, long omax)
{
    int i, ret;
    long l;
    const unsigned char *p = *pp;
    int tag, xclass, inf;
    long max = omax;
    if (!max)
        goto err;
    ret = (*p & V_ASN1_CONSTRUCTED);
    xclass = (*p & V_ASN1_PRIVATE);
    i = *p & V_ASN1_PRIMITIVE_TAG;
    if (i == V_ASN1_PRIMITIVE_TAG) {
        p++;
        if (--max == 0)
            goto err;
        l = 0;
        while (*p & 0x80) {
            l <<= 7L;
            l |= *(p++) & 0x7f;
            if (--max == 0)
                goto err;
            if (l > (INT_MAX >> 7L))
                goto err;
        }
        l <<= 7L;
        l |= *(p++) & 0x7f;
        tag = (int)l;
        if (--max == 0)
            goto err;
    } else {
        tag = i;
        p++;
        if (--max == 0)
            goto err;
    }
    *ptag = tag;
    *pclass = xclass;
    if (!asn1_get_length(&p, &inf, plength, max))
        goto err;
    if (inf && !(ret & V_ASN1_CONSTRUCTED))
        goto err;
    if (*plength > (omax - (p - *pp))) {
        ASN1err(ASN1_F_ASN1_GET_OBJECT, ASN1_R_TOO_LONG);
        ret |= 0x80;
    }
    *pp = p;
    return ret | inf;
 err:
    ASN1err(ASN1_F_ASN1_GET_OBJECT, ASN1_R_HEADER_TOO_LONG);
    return 0x80;
}
['static void testfile(const char *pathname)\n{\n    struct stat st;\n    FILE *f;\n    unsigned char *buf;\n    size_t s;\n    if (stat(pathname, &st) < 0 || !S_ISREG(st.st_mode))\n        return;\n    printf("# %s\\n", pathname);\n    fflush(stdout);\n    f = fopen(pathname, "rb");\n    if (f == NULL)\n        return;\n    buf = malloc(st.st_size);\n    if (buf != NULL) {\n        s = fread(buf, 1, st.st_size, f);\n        OPENSSL_assert(s == (size_t)st.st_size);\n        FuzzerTestOneInput(buf, s);\n        free(buf);\n    }\n    fclose(f);\n}', 'int FuzzerTestOneInput(const uint8_t *buf, size_t len)\n{\n    const unsigned char *p = buf;\n    unsigned char *der = NULL;\n    X509 *x509 = d2i_X509(NULL, &p, len);\n    if (x509 != NULL) {\n        BIO *bio = BIO_new(BIO_s_null());\n        X509_print(bio, x509);\n        BIO_free(bio);\n        i2d_X509(x509, &der);\n        OPENSSL_free(der);\n        X509_free(x509);\n    }\n    ERR_clear_error();\n    return 0;\n}', 'IMPLEMENT_ASN1_FUNCTIONS(X509)', 'ASN1_VALUE *ASN1_item_d2i(ASN1_VALUE **pval,\n                          const unsigned char **in, long len,\n                          const ASN1_ITEM *it)\n{\n    ASN1_TLC c;\n    ASN1_VALUE *ptmpval = NULL;\n    if (!pval)\n        pval = &ptmpval;\n    asn1_tlc_clear_nc(&c);\n    if (ASN1_item_ex_d2i(pval, in, len, it, -1, 0, 0, &c) > 0)\n        return *pval;\n    return NULL;\n}', 'int ASN1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in, long len,\n                     const ASN1_ITEM *it,\n                     int tag, int aclass, char opt, ASN1_TLC *ctx)\n{\n    int rv;\n    rv = asn1_item_embed_d2i(pval, in, len, it, tag, aclass, opt, ctx, 0);\n    if (rv <= 0)\n        ASN1_item_ex_free(pval, it);\n    return rv;\n}', 'static int asn1_item_embed_d2i(ASN1_VALUE **pval, const unsigned char **in,\n                               long len, const ASN1_ITEM *it,\n                               int tag, int aclass, char opt, ASN1_TLC *ctx,\n                               int depth)\n{\n    const ASN1_TEMPLATE *tt, *errtt = NULL;\n    const ASN1_EXTERN_FUNCS *ef;\n    const ASN1_AUX *aux = it->funcs;\n    ASN1_aux_cb *asn1_cb;\n    const unsigned char *p = NULL, *q;\n    unsigned char oclass;\n    char seq_eoc, seq_nolen, cst, isopt;\n    long tmplen;\n    int i;\n    int otag;\n    int ret = 0;\n    ASN1_VALUE **pchptr;\n    if (!pval)\n        return 0;\n    if (aux && aux->asn1_cb)\n        asn1_cb = aux->asn1_cb;\n    else\n        asn1_cb = 0;\n    if (++depth > ASN1_MAX_CONSTRUCTED_NEST) {\n        ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ASN1_R_NESTED_TOO_DEEP);\n        goto err;\n    }\n    switch (it->itype) {\n    case ASN1_ITYPE_PRIMITIVE:\n        if (it->templates) {\n            if ((tag != -1) || opt) {\n                ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I,\n                        ASN1_R_ILLEGAL_OPTIONS_ON_ITEM_TEMPLATE);\n                goto err;\n            }\n            return asn1_template_ex_d2i(pval, in, len,\n                                        it->templates, opt, ctx, depth);\n        }\n        return asn1_d2i_ex_primitive(pval, in, len, it,\n                                     tag, aclass, opt, ctx);\n    case ASN1_ITYPE_MSTRING:\n        p = *in;\n        ret = asn1_check_tlen(NULL, &otag, &oclass, NULL, NULL,\n                              &p, len, -1, 0, 1, ctx);\n        if (!ret) {\n            ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ERR_R_NESTED_ASN1_ERROR);\n            goto err;\n        }\n        if (oclass != V_ASN1_UNIVERSAL) {\n            if (opt)\n                return -1;\n            ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ASN1_R_MSTRING_NOT_UNIVERSAL);\n            goto err;\n        }\n        if (!(ASN1_tag2bit(otag) & it->utype)) {\n            if (opt)\n                return -1;\n            ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ASN1_R_MSTRING_WRONG_TAG);\n            goto err;\n        }\n        return asn1_d2i_ex_primitive(pval, in, len, it, otag, 0, 0, ctx);\n    case ASN1_ITYPE_EXTERN:\n        ef = it->funcs;\n        return ef->asn1_ex_d2i(pval, in, len, it, tag, aclass, opt, ctx);\n    case ASN1_ITYPE_CHOICE:\n        if (asn1_cb && !asn1_cb(ASN1_OP_D2I_PRE, pval, it, NULL))\n            goto auxerr;\n        if (*pval) {\n            i = asn1_get_choice_selector(pval, it);\n            if ((i >= 0) && (i < it->tcount)) {\n                tt = it->templates + i;\n                pchptr = asn1_get_field_ptr(pval, tt);\n                asn1_template_free(pchptr, tt);\n                asn1_set_choice_selector(pval, -1, it);\n            }\n        } else if (!ASN1_item_ex_new(pval, it)) {\n            ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ERR_R_NESTED_ASN1_ERROR);\n            goto err;\n        }\n        p = *in;\n        for (i = 0, tt = it->templates; i < it->tcount; i++, tt++) {\n            pchptr = asn1_get_field_ptr(pval, tt);\n            ret = asn1_template_ex_d2i(pchptr, &p, len, tt, 1, ctx, depth);\n            if (ret == -1)\n                continue;\n            if (ret > 0)\n                break;\n            asn1_template_free(pchptr, tt);\n            errtt = tt;\n            ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ERR_R_NESTED_ASN1_ERROR);\n            goto err;\n        }\n        if (i == it->tcount) {\n            if (opt) {\n                ASN1_item_ex_free(pval, it);\n                return -1;\n            }\n            ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ASN1_R_NO_MATCHING_CHOICE_TYPE);\n            goto err;\n        }\n        asn1_set_choice_selector(pval, i, it);\n        if (asn1_cb && !asn1_cb(ASN1_OP_D2I_POST, pval, it, NULL))\n            goto auxerr;\n        *in = p;\n        return 1;\n    case ASN1_ITYPE_NDEF_SEQUENCE:\n    case ASN1_ITYPE_SEQUENCE:\n        p = *in;\n        tmplen = len;\n        if (tag == -1) {\n            tag = V_ASN1_SEQUENCE;\n            aclass = V_ASN1_UNIVERSAL;\n        }\n        ret = asn1_check_tlen(&len, NULL, NULL, &seq_eoc, &cst,\n                              &p, len, tag, aclass, opt, ctx);\n        if (!ret) {\n            ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ERR_R_NESTED_ASN1_ERROR);\n            goto err;\n        } else if (ret == -1)\n            return -1;\n        if (aux && (aux->flags & ASN1_AFLG_BROKEN)) {\n            len = tmplen - (p - *in);\n            seq_nolen = 1;\n        }\n        else\n            seq_nolen = seq_eoc;\n        if (!cst) {\n            ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ASN1_R_SEQUENCE_NOT_CONSTRUCTED);\n            goto err;\n        }\n        if (!*pval && !ASN1_item_ex_new(pval, it)) {\n            ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ERR_R_NESTED_ASN1_ERROR);\n            goto err;\n        }\n        if (asn1_cb && !asn1_cb(ASN1_OP_D2I_PRE, pval, it, NULL))\n            goto auxerr;\n        for (i = 0, tt = it->templates; i < it->tcount; i++, tt++) {\n            if (tt->flags & ASN1_TFLG_ADB_MASK) {\n                const ASN1_TEMPLATE *seqtt;\n                ASN1_VALUE **pseqval;\n                seqtt = asn1_do_adb(pval, tt, 0);\n                if (seqtt == NULL)\n                    continue;\n                pseqval = asn1_get_field_ptr(pval, seqtt);\n                asn1_template_free(pseqval, seqtt);\n            }\n        }\n        for (i = 0, tt = it->templates; i < it->tcount; i++, tt++) {\n            const ASN1_TEMPLATE *seqtt;\n            ASN1_VALUE **pseqval;\n            seqtt = asn1_do_adb(pval, tt, 1);\n            if (seqtt == NULL)\n                goto err;\n            pseqval = asn1_get_field_ptr(pval, seqtt);\n            if (!len)\n                break;\n            q = p;\n            if (asn1_check_eoc(&p, len)) {\n                if (!seq_eoc) {\n                    ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ASN1_R_UNEXPECTED_EOC);\n                    goto err;\n                }\n                len -= p - q;\n                seq_eoc = 0;\n                q = p;\n                break;\n            }\n            if (i == (it->tcount - 1))\n                isopt = 0;\n            else\n                isopt = (char)(seqtt->flags & ASN1_TFLG_OPTIONAL);\n            ret = asn1_template_ex_d2i(pseqval, &p, len, seqtt, isopt, ctx,\n                                       depth);\n            if (!ret) {\n                errtt = seqtt;\n                goto err;\n            } else if (ret == -1) {\n                asn1_template_free(pseqval, seqtt);\n                continue;\n            }\n            len -= p - q;\n        }\n        if (seq_eoc && !asn1_check_eoc(&p, len)) {\n            ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ASN1_R_MISSING_EOC);\n            goto err;\n        }\n        if (!seq_nolen && len) {\n            ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ASN1_R_SEQUENCE_LENGTH_MISMATCH);\n            goto err;\n        }\n        for (; i < it->tcount; tt++, i++) {\n            const ASN1_TEMPLATE *seqtt;\n            seqtt = asn1_do_adb(pval, tt, 1);\n            if (seqtt == NULL)\n                goto err;\n            if (seqtt->flags & ASN1_TFLG_OPTIONAL) {\n                ASN1_VALUE **pseqval;\n                pseqval = asn1_get_field_ptr(pval, seqtt);\n                asn1_template_free(pseqval, seqtt);\n            } else {\n                errtt = seqtt;\n                ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ASN1_R_FIELD_MISSING);\n                goto err;\n            }\n        }\n        if (!asn1_enc_save(pval, *in, p - *in, it))\n            goto auxerr;\n        if (asn1_cb && !asn1_cb(ASN1_OP_D2I_POST, pval, it, NULL))\n            goto auxerr;\n        *in = p;\n        return 1;\n    default:\n        return 0;\n    }\n auxerr:\n    ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ASN1_R_AUX_ERROR);\n err:\n    if (errtt)\n        ERR_add_error_data(4, "Field=", errtt->field_name,\n                           ", Type=", it->sname);\n    else\n        ERR_add_error_data(2, "Type=", it->sname);\n    return 0;\n}', 'static int asn1_check_tlen(long *olen, int *otag, unsigned char *oclass,\n                           char *inf, char *cst,\n                           const unsigned char **in, long len,\n                           int exptag, int expclass, char opt, ASN1_TLC *ctx)\n{\n    int i;\n    int ptag, pclass;\n    long plen;\n    const unsigned char *p, *q;\n    p = *in;\n    q = p;\n    if (ctx && ctx->valid) {\n        i = ctx->ret;\n        plen = ctx->plen;\n        pclass = ctx->pclass;\n        ptag = ctx->ptag;\n        p += ctx->hdrlen;\n    } else {\n        i = ASN1_get_object(&p, &plen, &ptag, &pclass, len);\n        if (ctx) {\n            ctx->ret = i;\n            ctx->plen = plen;\n            ctx->pclass = pclass;\n            ctx->ptag = ptag;\n            ctx->hdrlen = p - q;\n            ctx->valid = 1;\n            if (!(i & 0x81) && ((plen + ctx->hdrlen) > len)) {\n                ASN1err(ASN1_F_ASN1_CHECK_TLEN, ASN1_R_TOO_LONG);\n                asn1_tlc_clear(ctx);\n                return 0;\n            }\n        }\n    }\n    if (i & 0x80) {\n        ASN1err(ASN1_F_ASN1_CHECK_TLEN, ASN1_R_BAD_OBJECT_HEADER);\n        asn1_tlc_clear(ctx);\n        return 0;\n    }\n    if (exptag >= 0) {\n        if ((exptag != ptag) || (expclass != pclass)) {\n            if (opt)\n                return -1;\n            asn1_tlc_clear(ctx);\n            ASN1err(ASN1_F_ASN1_CHECK_TLEN, ASN1_R_WRONG_TAG);\n            return 0;\n        }\n        asn1_tlc_clear(ctx);\n    }\n    if (i & 1)\n        plen = len - (p - q);\n    if (inf)\n        *inf = i & 1;\n    if (cst)\n        *cst = i & V_ASN1_CONSTRUCTED;\n    if (olen)\n        *olen = plen;\n    if (oclass)\n        *oclass = pclass;\n    if (otag)\n        *otag = ptag;\n    *in = p;\n    return 1;\n}', 'int ASN1_get_object(const unsigned char **pp, long *plength, int *ptag,\n                    int *pclass, long omax)\n{\n    int i, ret;\n    long l;\n    const unsigned char *p = *pp;\n    int tag, xclass, inf;\n    long max = omax;\n    if (!max)\n        goto err;\n    ret = (*p & V_ASN1_CONSTRUCTED);\n    xclass = (*p & V_ASN1_PRIVATE);\n    i = *p & V_ASN1_PRIMITIVE_TAG;\n    if (i == V_ASN1_PRIMITIVE_TAG) {\n        p++;\n        if (--max == 0)\n            goto err;\n        l = 0;\n        while (*p & 0x80) {\n            l <<= 7L;\n            l |= *(p++) & 0x7f;\n            if (--max == 0)\n                goto err;\n            if (l > (INT_MAX >> 7L))\n                goto err;\n        }\n        l <<= 7L;\n        l |= *(p++) & 0x7f;\n        tag = (int)l;\n        if (--max == 0)\n            goto err;\n    } else {\n        tag = i;\n        p++;\n        if (--max == 0)\n            goto err;\n    }\n    *ptag = tag;\n    *pclass = xclass;\n    if (!asn1_get_length(&p, &inf, plength, max))\n        goto err;\n    if (inf && !(ret & V_ASN1_CONSTRUCTED))\n        goto err;\n    if (*plength > (omax - (p - *pp))) {\n        ASN1err(ASN1_F_ASN1_GET_OBJECT, ASN1_R_TOO_LONG);\n        ret |= 0x80;\n    }\n    *pp = p;\n    return ret | inf;\n err:\n    ASN1err(ASN1_F_ASN1_GET_OBJECT, ASN1_R_HEADER_TOO_LONG);\n    return 0x80;\n}']