crypto/pem/pem_lib.c:265: error: BUFFER_OVERRUN_L3
  Offset: [-12, +oo] Size: [1, 241] by call to `check_pem`.
Showing all 10 steps of the trace


crypto/pem/pem_lib.c:260:14: Call
258.           pem_free(header, flags);
259.           pem_free(data, flags);
260.           if (!PEM_read_bio_ex(bp, &nm, &header, &data, &len, flags)) {
                    ^
261.               if (ERR_GET_REASON(ERR_peek_error()) == PEM_R_NO_START_LINE)
262.                   ERR_add_error_data(2, "Expecting: ", name);

crypto/pem/pem_lib.c:958:5: Assignment
  956.       }
  957.       BIO_read(headerB, *header, headerlen);
  958.       (*header)[headerlen] = '\0';
             ^
  959.       BIO_read(dataB, *data, len);
  960.       *len_out = len;

crypto/pem/pem_lib.c:265:15: Call
263.               return 0;
264.           }
265.       } while (!check_pem(nm, name));
                     ^
266.       if (!PEM_get_EVP_CIPHER_INFO(header, &cipher))
267.           goto err;

crypto/pem/pem_lib.c:136:1: Parameter `*nm`
  134.   #endif
  135.   
  136. > static int check_pem(const char *nm, const char *name)
  137.   {
  138.       /* Normal matching nm and name */

crypto/pem/pem_lib.c:151:16: Call
  149.           if (strcmp(nm, PEM_STRING_PKCS8INF) == 0)
  150.               return 1;
  151.           slen = pem_check_suffix(nm, "PRIVATE KEY");
                        ^
  152.           if (slen > 0) {
  153.               /*

crypto/pem/pem_lib.c:985:1: <Length trace>
983.    */
984.   
985. > int pem_check_suffix(const char *pem_str, const char *suffix)
986.   {
987.       int pem_len = strlen(pem_str);

crypto/pem/pem_lib.c:985:1: Parameter `*pem_str`
    983.    */
    984.   
    985. > int pem_check_suffix(const char *pem_str, const char *suffix)
    986.   {
    987.       int pem_len = strlen(pem_str);

crypto/pem/pem_lib.c:992:5: Assignment
    990.       if (suffix_len + 1 >= pem_len)
    991.           return 0;
    992.       p = pem_str + pem_len - suffix_len;
               ^
    993.       if (strcmp(p, suffix))
    994.           return 0;

crypto/pem/pem_lib.c:995:5: Assignment
    993.       if (strcmp(p, suffix))
    994.           return 0;
    995.       p--;
               ^
    996.       if (*p != ' ')
    997.           return 0;

crypto/pem/pem_lib.c:996:9: Array access: Offset: [-12, +oo] Size: [1, 241] by call to `check_pem` 
    994.           return 0;
    995.       p--;
    996.       if (*p != ' ')
                   ^
    997.           return 0;
    998.       return p - pem_str;

int pem_check_suffix(const char *pem_str, const char *suffix)
{
    int pem_len = strlen(pem_str);
    int suffix_len = strlen(suffix);
    const char *p;
    if (suffix_len + 1 >= pem_len)
        return 0;
    p = pem_str + pem_len - suffix_len;
    if (strcmp(p, suffix))
        return 0;
    p--;
    if (*p != ' ')
        return 0;
    return p - pem_str;
}
['static int pem_bytes_read_bio_flags(unsigned char **pdata, long *plen,\n                                    char **pnm, const char *name, BIO *bp,\n                                    pem_password_cb *cb, void *u,\n                                    unsigned int flags)\n{\n    EVP_CIPHER_INFO cipher;\n    char *nm = NULL, *header = NULL;\n    unsigned char *data = NULL;\n    long len;\n    int ret = 0;\n    do {\n        pem_free(nm, flags);\n        pem_free(header, flags);\n        pem_free(data, flags);\n        if (!PEM_read_bio_ex(bp, &nm, &header, &data, &len, flags)) {\n            if (ERR_GET_REASON(ERR_peek_error()) == PEM_R_NO_START_LINE)\n                ERR_add_error_data(2, "Expecting: ", name);\n            return 0;\n        }\n    } while (!check_pem(nm, name));\n    if (!PEM_get_EVP_CIPHER_INFO(header, &cipher))\n        goto err;\n    if (!PEM_do_header(&cipher, data, &len, cb, u))\n        goto err;\n    *pdata = data;\n    *plen = len;\n    if (pnm != NULL)\n        *pnm = nm;\n    ret = 1;\n err:\n    if (!ret || pnm == NULL)\n        pem_free(nm, flags);\n    pem_free(header, flags);\n    if (!ret)\n        pem_free(data, flags);\n    return ret;\n}', "int PEM_read_bio_ex(BIO *bp, char **name_out, char **header,\n                    unsigned char **data, long *len_out, unsigned int flags)\n{\n    EVP_ENCODE_CTX *ctx = EVP_ENCODE_CTX_new();\n    const BIO_METHOD *bmeth;\n    BIO *headerB = NULL, *dataB = NULL;\n    char *name = NULL;\n    int len, taillen, headerlen, ret = 0;\n    BUF_MEM * buf_mem;\n    if (ctx == NULL) {\n        PEMerr(PEM_F_PEM_READ_BIO_EX, ERR_R_MALLOC_FAILURE);\n        return 0;\n    }\n    *len_out = 0;\n    *name_out = *header = NULL;\n    *data = NULL;\n    if ((flags & PEM_FLAG_EAY_COMPATIBLE) && (flags & PEM_FLAG_ONLY_B64)) {\n        PEMerr(PEM_F_PEM_READ_BIO_EX, ERR_R_PASSED_INVALID_ARGUMENT);\n        goto end;\n    }\n    bmeth = (flags & PEM_FLAG_SECURE) ? BIO_s_secmem() : BIO_s_mem();\n    headerB = BIO_new(bmeth);\n    dataB = BIO_new(bmeth);\n    if (headerB == NULL || dataB == NULL) {\n        PEMerr(PEM_F_PEM_READ_BIO_EX, ERR_R_MALLOC_FAILURE);\n        goto end;\n    }\n    if (!get_name(bp, &name, flags))\n        goto end;\n    if (!get_header_and_data(bp, &headerB, &dataB, name, flags))\n        goto end;\n    EVP_DecodeInit(ctx);\n    BIO_get_mem_ptr(dataB, &buf_mem);\n    len = buf_mem->length;\n    if (EVP_DecodeUpdate(ctx, (unsigned char*)buf_mem->data, &len,\n                         (unsigned char*)buf_mem->data, len) < 0\n            || EVP_DecodeFinal(ctx, (unsigned char*)&(buf_mem->data[len]),\n                               &taillen) < 0) {\n        PEMerr(PEM_F_PEM_READ_BIO_EX, PEM_R_BAD_BASE64_DECODE);\n        goto end;\n    }\n    len += taillen;\n    buf_mem->length = len;\n    if (len == 0)\n        goto end;\n    headerlen = BIO_get_mem_data(headerB, NULL);\n    *header = pem_malloc(headerlen + 1, flags);\n    *data = pem_malloc(len, flags);\n    if (*header == NULL || *data == NULL) {\n        pem_free(*header, flags);\n        pem_free(*data, flags);\n        goto end;\n    }\n    BIO_read(headerB, *header, headerlen);\n    (*header)[headerlen] = '\\0';\n    BIO_read(dataB, *data, len);\n    *len_out = len;\n    *name_out = name;\n    name = NULL;\n    ret = 1;\nend:\n    EVP_ENCODE_CTX_free(ctx);\n    pem_free(name, flags);\n    BIO_free(headerB);\n    BIO_free(dataB);\n    return ret;\n}", 'static int check_pem(const char *nm, const char *name)\n{\n    if (strcmp(nm, name) == 0)\n        return 1;\n    if (strcmp(name, PEM_STRING_EVP_PKEY) == 0) {\n        int slen;\n        const EVP_PKEY_ASN1_METHOD *ameth;\n        if (strcmp(nm, PEM_STRING_PKCS8) == 0)\n            return 1;\n        if (strcmp(nm, PEM_STRING_PKCS8INF) == 0)\n            return 1;\n        slen = pem_check_suffix(nm, "PRIVATE KEY");\n        if (slen > 0) {\n            ameth = EVP_PKEY_asn1_find_str(NULL, nm, slen);\n            if (ameth && ameth->old_priv_decode)\n                return 1;\n        }\n        return 0;\n    }\n    if (strcmp(name, PEM_STRING_PARAMETERS) == 0) {\n        int slen;\n        const EVP_PKEY_ASN1_METHOD *ameth;\n        slen = pem_check_suffix(nm, "PARAMETERS");\n        if (slen > 0) {\n            ENGINE *e;\n            ameth = EVP_PKEY_asn1_find_str(&e, nm, slen);\n            if (ameth) {\n                int r;\n                if (ameth->param_decode)\n                    r = 1;\n                else\n                    r = 0;\n#ifndef OPENSSL_NO_ENGINE\n                ENGINE_finish(e);\n#endif\n                return r;\n            }\n        }\n        return 0;\n    }\n    if (strcmp(nm, PEM_STRING_DHXPARAMS) == 0\n        && strcmp(name, PEM_STRING_DHPARAMS) == 0)\n        return 1;\n    if (strcmp(nm, PEM_STRING_X509_OLD) == 0\n        && strcmp(name, PEM_STRING_X509) == 0)\n        return 1;\n    if (strcmp(nm, PEM_STRING_X509_REQ_OLD) == 0\n        && strcmp(name, PEM_STRING_X509_REQ) == 0)\n        return 1;\n    if (strcmp(nm, PEM_STRING_X509) == 0\n        && strcmp(name, PEM_STRING_X509_TRUSTED) == 0)\n        return 1;\n    if (strcmp(nm, PEM_STRING_X509_OLD) == 0\n        && strcmp(name, PEM_STRING_X509_TRUSTED) == 0)\n        return 1;\n    if (strcmp(nm, PEM_STRING_X509) == 0\n        && strcmp(name, PEM_STRING_PKCS7) == 0)\n        return 1;\n    if (strcmp(nm, PEM_STRING_PKCS7_SIGNED) == 0\n        && strcmp(name, PEM_STRING_PKCS7) == 0)\n        return 1;\n#ifndef OPENSSL_NO_CMS\n    if (strcmp(nm, PEM_STRING_X509) == 0\n        && strcmp(name, PEM_STRING_CMS) == 0)\n        return 1;\n    if (strcmp(nm, PEM_STRING_PKCS7) == 0\n        && strcmp(name, PEM_STRING_CMS) == 0)\n        return 1;\n#endif\n    return 0;\n}', "int pem_check_suffix(const char *pem_str, const char *suffix)\n{\n    int pem_len = strlen(pem_str);\n    int suffix_len = strlen(suffix);\n    const char *p;\n    if (suffix_len + 1 >= pem_len)\n        return 0;\n    p = pem_str + pem_len - suffix_len;\n    if (strcmp(p, suffix))\n        return 0;\n    p--;\n    if (*p != ' ')\n        return 0;\n    return p - pem_str;\n}"]