ssl/t1_lib.c:3134: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] Size: [1, +oo] by call to `d2i_SSL_SESSION`.
Showing all 33 steps of the trace


ssl/t1_lib.c:3117:22: Call
3115.       /* Move p after IV to start of encrypted ticket, update length */
3116.       p = etick + 16 + EVP_CIPHER_CTX_iv_length(ctx);
3117.       eticklen -= 16 + EVP_CIPHER_CTX_iv_length(ctx);
                             ^
3118.       sdec = OPENSSL_malloc(eticklen);
3119.       if (sdec == NULL

crypto/evp/evp_lib.c:277:1: Parameter `ctx->cipher->iv_len`
  275.   }
  276.   
  277. > int EVP_CIPHER_CTX_iv_length(const EVP_CIPHER_CTX *ctx)
  278.   {
  279.       return ctx->cipher->iv_len;

crypto/evp/evp_lib.c:279:5: Assignment
  277.   int EVP_CIPHER_CTX_iv_length(const EVP_CIPHER_CTX *ctx)
  278.   {
  279.       return ctx->cipher->iv_len;
             ^
  280.   }
  281.   

ssl/t1_lib.c:3117:5: Assignment
3115.       /* Move p after IV to start of encrypted ticket, update length */
3116.       p = etick + 16 + EVP_CIPHER_CTX_iv_length(ctx);
3117.       eticklen -= 16 + EVP_CIPHER_CTX_iv_length(ctx);
            ^
3118.       sdec = OPENSSL_malloc(eticklen);
3119.       if (sdec == NULL

ssl/t1_lib.c:3118:12: Call
3116.       p = etick + 16 + EVP_CIPHER_CTX_iv_length(ctx);
3117.       eticklen -= 16 + EVP_CIPHER_CTX_iv_length(ctx);
3118.       sdec = OPENSSL_malloc(eticklen);
                   ^
3119.       if (sdec == NULL
3120.               || EVP_DecryptUpdate(ctx, sdec, &slen, p, eticklen) <= 0) {

crypto/mem.c:125:9: Assignment
  123.   
  124.       if (num <= 0)
  125.           return NULL;
                 ^
  126.   
  127.       allow_customize = 0;

ssl/t1_lib.c:3118:5: Assignment
3116.       p = etick + 16 + EVP_CIPHER_CTX_iv_length(ctx);
3117.       eticklen -= 16 + EVP_CIPHER_CTX_iv_length(ctx);
3118.       sdec = OPENSSL_malloc(eticklen);
            ^
3119.       if (sdec == NULL
3120.               || EVP_DecryptUpdate(ctx, sdec, &slen, p, eticklen) <= 0) {

ssl/t1_lib.c:3132:5: Assignment
3130.       EVP_CIPHER_CTX_free(ctx);
3131.       ctx = NULL;
3132.       p = sdec;
            ^
3133.   
3134.       sess = d2i_SSL_SESSION(NULL, &p, slen);

ssl/t1_lib.c:3134:12: Call
3132.       p = sdec;
3133.   
3134.       sess = d2i_SSL_SESSION(NULL, &p, slen);
                   ^
3135.       OPENSSL_free(sdec);
3136.       if (sess) {

ssl/ssl_asn1.c:288:1: Parameter `**pp`
  286.   }
  287.   
  288. > SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp,
  289.                                long length)
  290.   {

ssl/ssl_asn1.c:293:5: Assignment
  291.       long id;
  292.       unsigned int tmpl;
  293.       const unsigned char *p = *pp;
             ^
  294.       SSL_SESSION_ASN1 *as = NULL;
  295.       SSL_SESSION *ret = NULL;

ssl/ssl_asn1.c:297:10: Call
  295.       SSL_SESSION *ret = NULL;
  296.   
  297.       as = d2i_SSL_SESSION_ASN1(NULL, &p, length);
                  ^
  298.       /* ASN.1 code returns suitable error */
  299.       if (as == NULL)

ssl/ssl_asn1.c:143:1: Parameter `**in`
    141.   } static_ASN1_SEQUENCE_END(SSL_SESSION_ASN1)
    142.   
    143. > IMPLEMENT_STATIC_ASN1_ENCODE_FUNCTIONS(SSL_SESSION_ASN1)
    144.   
    145.   /* Utility functions for i2d_SSL_SESSION */

ssl/ssl_asn1.c:143:1: Call
    141.   } static_ASN1_SEQUENCE_END(SSL_SESSION_ASN1)
    142.   
    143. > IMPLEMENT_STATIC_ASN1_ENCODE_FUNCTIONS(SSL_SESSION_ASN1)
    144.   
    145.   /* Utility functions for i2d_SSL_SESSION */

crypto/asn1/tasn_dec.c:144:1: Parameter `**in`
      142.    */
      143.   
      144. > ASN1_VALUE *ASN1_item_d2i(ASN1_VALUE **pval,
      145.                             const unsigned char **in, long len,
      146.                             const ASN1_ITEM *it)

crypto/asn1/tasn_dec.c:153:9: Call
      151.           pval = &ptmpval;
      152.       asn1_tlc_clear_nc(&c);
      153.       if (ASN1_item_ex_d2i(pval, in, len, it, -1, 0, 0, &c) > 0)
                     ^
      154.           return *pval;
      155.       return NULL;

crypto/asn1/tasn_dec.c:158:1: Parameter `**in`
        156.   }
        157.   
        158. > int ASN1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in, long len,
        159.                        const ASN1_ITEM *it,
        160.                        int tag, int aclass, char opt, ASN1_TLC *ctx)

crypto/asn1/tasn_dec.c:163:10: Call
        161.   {
        162.       int rv;
        163.       rv = asn1_item_embed_d2i(pval, in, len, it, tag, aclass, opt, ctx);
                        ^
        164.       if (rv <= 0)
        165.           ASN1_item_ex_free(pval, it);

crypto/asn1/tasn_dec.c:174:1: Parameter `**in`
          172.    */
          173.   
          174. > static int asn1_item_embed_d2i(ASN1_VALUE **pval, const unsigned char **in,
          175.                                  long len, const ASN1_ITEM *it,
          176.                                  int tag, int aclass, char opt, ASN1_TLC *ctx)

crypto/asn1/tasn_dec.c:218:9: Assignment
          216.   
          217.       case ASN1_ITYPE_MSTRING:
          218.           p = *in;
                         ^
          219.           /* Just read in tag and class */
          220.           ret = asn1_check_tlen(NULL, &otag, &oclass, NULL, NULL,

crypto/asn1/tasn_dec.c:220:15: Call
          218.           p = *in;
          219.           /* Just read in tag and class */
          220.           ret = asn1_check_tlen(NULL, &otag, &oclass, NULL, NULL,
                               ^
          221.                                 &p, len, -1, 0, 1, ctx);
          222.           if (!ret) {

crypto/asn1/tasn_dec.c:1098:1: Parameter `**in`
            1096.    */
            1097.   
            1098. > static int asn1_check_tlen(long *olen, int *otag, unsigned char *oclass,
            1099.                              char *inf, char *cst,
            1100.                              const unsigned char **in, long len,

crypto/asn1/tasn_dec.c:1107:5: Assignment
            1105.       long plen;
            1106.       const unsigned char *p, *q;
            1107.       p = *in;
                        ^
            1108.       q = p;
            1109.   

crypto/asn1/tasn_dec.c:1117:13: Call
            1115.           p += ctx->hdrlen;
            1116.       } else {
            1117.           i = ASN1_get_object(&p, &plen, &ptag, &pclass, len);
                                ^
            1118.           if (ctx) {
            1119.               ctx->ret = i;

crypto/asn1/asn1_lib.c:92:1: Parameter `**pp`
              90.   }
              91.   
              92. > int ASN1_get_object(const unsigned char **pp, long *plength, int *ptag,
              93.                       int *pclass, long omax)
              94.   {

crypto/asn1/asn1_lib.c:97:5: Assignment
              95.       int i, ret;
              96.       long l;
              97.       const unsigned char *p = *pp;
                         ^
              98.       int tag, xclass, inf;
              99.       long max = omax;

crypto/asn1/asn1_lib.c:126:9: Assignment
              124.       } else {
              125.           tag = i;
              126.           p++;
                             ^
              127.           if (--max == 0)
              128.               goto err;

crypto/asn1/asn1_lib.c:132:10: Call
              130.       *ptag = tag;
              131.       *pclass = xclass;
              132.       if (!asn1_get_length(&p, &inf, plength, (int)max))
                              ^
              133.           goto err;
              134.   

crypto/asn1/asn1_lib.c:153:1: <Length trace>
151.   }
152.   
153. > static int asn1_get_length(const unsigned char **pp, int *inf, long *rl,
154.                              int max)
155.   {

crypto/asn1/asn1_lib.c:153:1: Parameter `**pp`
                151.   }
                152.   
                153. > static int asn1_get_length(const unsigned char **pp, int *inf, long *rl,
                154.                              int max)
                155.   {

crypto/asn1/asn1_lib.c:156:5: Assignment
                154.                              int max)
                155.   {
                156.       const unsigned char *p = *pp;
                           ^
                157.       unsigned long ret = 0;
                158.       unsigned int i;

crypto/asn1/asn1_lib.c:169:15: Assignment
                167.           *inf = 0;
                168.           i = *p & 0x7f;
                169.           if (*(p++) & 0x80) {
                                     ^
                170.               if (max < (int)i)
                171.                   return 0;

crypto/asn1/asn1_lib.c:173:25: Array access: Offset: [2, +oo] Size: [1, +oo] by call to `d2i_SSL_SESSION` 
                171.                   return 0;
                172.               /* Skip leading zeroes */
                173.               while (i && *p == 0) {
                                               ^
                174.                   p++;
                175.                   i--;

static int asn1_get_length(const unsigned char **pp, int *inf, long *rl,
                           int max)
{
    const unsigned char *p = *pp;
    unsigned long ret = 0;
    unsigned int i;
    if (max-- < 1)
        return (0);
    if (*p == 0x80) {
        *inf = 1;
        ret = 0;
        p++;
    } else {
        *inf = 0;
        i = *p & 0x7f;
        if (*(p++) & 0x80) {
            if (max < (int)i)
                return 0;
            while (i && *p == 0) {
                p++;
                i--;
            }
            if (i > sizeof(long))
                return 0;
            while (i-- > 0) {
                ret <<= 8L;
                ret |= *(p++);
            }
        } else
            ret = i;
    }
    if (ret > LONG_MAX)
        return 0;
    *pp = p;
    *rl = (long)ret;
    return (1);
}
['static int tls_decrypt_ticket(SSL *s, const unsigned char *etick,\n                              int eticklen, const unsigned char *sess_id,\n                              int sesslen, SSL_SESSION **psess)\n{\n    SSL_SESSION *sess;\n    unsigned char *sdec;\n    const unsigned char *p;\n    int slen, mlen, renew_ticket = 0;\n    unsigned char tick_hmac[EVP_MAX_MD_SIZE];\n    HMAC_CTX *hctx = NULL;\n    EVP_CIPHER_CTX *ctx;\n    SSL_CTX *tctx = s->initial_ctx;\n    if (eticklen < 48)\n        return 2;\n    hctx = HMAC_CTX_new();\n    if (hctx == NULL)\n        return -2;\n    ctx = EVP_CIPHER_CTX_new();\n    if (tctx->tlsext_ticket_key_cb) {\n        unsigned char *nctick = (unsigned char *)etick;\n        int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,\n                                            ctx, hctx, 0);\n        if (rv < 0)\n            return -1;\n        if (rv == 0)\n            return 2;\n        if (rv == 2)\n            renew_ticket = 1;\n    } else {\n        if (memcmp(etick, tctx->tlsext_tick_key_name, 16))\n            return 2;\n        if (HMAC_Init_ex(hctx, tctx->tlsext_tick_hmac_key, 16,\n                         EVP_sha256(), NULL) <= 0\n                || EVP_DecryptInit_ex(ctx, EVP_aes_128_cbc(), NULL,\n                                      tctx->tlsext_tick_aes_key,\n                                      etick + 16) <= 0) {\n            goto err;\n       }\n    }\n    mlen = HMAC_size(hctx);\n    if (mlen < 0) {\n        goto err;\n    }\n    eticklen -= mlen;\n    if (HMAC_Update(hctx, etick, eticklen) <= 0\n            || HMAC_Final(hctx, tick_hmac, NULL) <= 0) {\n        goto err;\n    }\n    HMAC_CTX_free(hctx);\n    if (CRYPTO_memcmp(tick_hmac, etick + eticklen, mlen)) {\n        EVP_CIPHER_CTX_free(ctx);\n        return 2;\n    }\n    p = etick + 16 + EVP_CIPHER_CTX_iv_length(ctx);\n    eticklen -= 16 + EVP_CIPHER_CTX_iv_length(ctx);\n    sdec = OPENSSL_malloc(eticklen);\n    if (sdec == NULL\n            || EVP_DecryptUpdate(ctx, sdec, &slen, p, eticklen) <= 0) {\n        EVP_CIPHER_CTX_free(ctx);\n        return -1;\n    }\n    if (EVP_DecryptFinal(ctx, sdec + slen, &mlen) <= 0) {\n        EVP_CIPHER_CTX_free(ctx);\n        OPENSSL_free(sdec);\n        return 2;\n    }\n    slen += mlen;\n    EVP_CIPHER_CTX_free(ctx);\n    ctx = NULL;\n    p = sdec;\n    sess = d2i_SSL_SESSION(NULL, &p, slen);\n    OPENSSL_free(sdec);\n    if (sess) {\n        if (sesslen)\n            memcpy(sess->session_id, sess_id, sesslen);\n        sess->session_id_length = sesslen;\n        *psess = sess;\n        if (renew_ticket)\n            return 4;\n        else\n            return 3;\n    }\n    ERR_clear_error();\n    return 2;\nerr:\n    EVP_CIPHER_CTX_free(ctx);\n    HMAC_CTX_free(hctx);\n    return -1;\n}', 'int EVP_CIPHER_CTX_iv_length(const EVP_CIPHER_CTX *ctx)\n{\n    return ctx->cipher->iv_len;\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (num <= 0)\n        return NULL;\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    (void)file;\n    (void)line;\n    ret = malloc(num);\n#endif\n#ifndef OPENSSL_CPUID_OBJ\n    if (ret && (num > 2048)) {\n        extern unsigned char cleanse_ctr;\n        ((unsigned char *)ret)[0] = cleanse_ctr;\n    }\n#endif\n    return ret;\n}', 'SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp,\n                             long length)\n{\n    long id;\n    unsigned int tmpl;\n    const unsigned char *p = *pp;\n    SSL_SESSION_ASN1 *as = NULL;\n    SSL_SESSION *ret = NULL;\n    as = d2i_SSL_SESSION_ASN1(NULL, &p, length);\n    if (as == NULL)\n        goto err;\n    if (!a || !*a) {\n        ret = SSL_SESSION_new();\n        if (ret == NULL)\n            goto err;\n    } else {\n        ret = *a;\n    }\n    if (as->version != SSL_SESSION_ASN1_VERSION) {\n        SSLerr(SSL_F_D2I_SSL_SESSION, SSL_R_UNKNOWN_SSL_VERSION);\n        goto err;\n    }\n    if ((as->ssl_version >> 8) != SSL3_VERSION_MAJOR\n        && (as->ssl_version >> 8) != DTLS1_VERSION_MAJOR\n        && as->ssl_version != DTLS1_BAD_VER) {\n        SSLerr(SSL_F_D2I_SSL_SESSION, SSL_R_UNSUPPORTED_SSL_VERSION);\n        goto err;\n    }\n    ret->ssl_version = (int)as->ssl_version;\n    if (as->cipher->length != 2) {\n        SSLerr(SSL_F_D2I_SSL_SESSION, SSL_R_CIPHER_CODE_WRONG_LENGTH);\n        goto err;\n    }\n    p = as->cipher->data;\n    id = 0x03000000L | ((unsigned long)p[0] << 8L) | (unsigned long)p[1];\n    ret->cipher = NULL;\n    ret->cipher_id = id;\n    if (!ssl_session_memcpy(ret->session_id, &ret->session_id_length,\n                            as->session_id, SSL3_MAX_SSL_SESSION_ID_LENGTH))\n        goto err;\n    if (!ssl_session_memcpy(ret->master_key, &tmpl,\n                            as->master_key, SSL_MAX_MASTER_KEY_LENGTH))\n        goto err;\n    ret->master_key_length = tmpl;\n    if (as->time != 0)\n        ret->time = as->time;\n    else\n        ret->time = (unsigned long)time(NULL);\n    if (as->timeout != 0)\n        ret->timeout = as->timeout;\n    else\n        ret->timeout = 3;\n    X509_free(ret->peer);\n    ret->peer = as->peer;\n    as->peer = NULL;\n    if (!ssl_session_memcpy(ret->sid_ctx, &ret->sid_ctx_length,\n                            as->session_id_context, SSL_MAX_SID_CTX_LENGTH))\n        goto err;\n    ret->verify_result = as->verify_result;\n    if (!ssl_session_strndup(&ret->tlsext_hostname, as->tlsext_hostname))\n        goto err;\n#ifndef OPENSSL_NO_PSK\n    if (!ssl_session_strndup(&ret->psk_identity_hint, as->psk_identity_hint))\n        goto err;\n    if (!ssl_session_strndup(&ret->psk_identity, as->psk_identity))\n        goto err;\n#endif\n    ret->tlsext_tick_lifetime_hint = as->tlsext_tick_lifetime_hint;\n    if (as->tlsext_tick) {\n        ret->tlsext_tick = as->tlsext_tick->data;\n        ret->tlsext_ticklen = as->tlsext_tick->length;\n        as->tlsext_tick->data = NULL;\n    } else {\n        ret->tlsext_tick = NULL;\n    }\n#ifndef OPENSSL_NO_COMP\n    if (as->comp_id) {\n        if (as->comp_id->length != 1) {\n            SSLerr(SSL_F_D2I_SSL_SESSION, SSL_R_BAD_LENGTH);\n            goto err;\n        }\n        ret->compress_meth = as->comp_id->data[0];\n    } else {\n        ret->compress_meth = 0;\n    }\n#endif\n#ifndef OPENSSL_NO_SRP\n    if (!ssl_session_strndup(&ret->srp_username, as->srp_username))\n        goto err;\n#endif\n    ret->flags = as->flags;\n    M_ASN1_free_of(as, SSL_SESSION_ASN1);\n    if ((a != NULL) && (*a == NULL))\n        *a = ret;\n    *pp = p;\n    return ret;\n    err:\n    M_ASN1_free_of(as, SSL_SESSION_ASN1);\n    if ((a == NULL) || (*a != ret))\n        SSL_SESSION_free(ret);\n    return NULL;\n}', 'IMPLEMENT_STATIC_ASN1_ENCODE_FUNCTIONS(SSL_SESSION_ASN1)', 'ASN1_VALUE *ASN1_item_d2i(ASN1_VALUE **pval,\n                          const unsigned char **in, long len,\n                          const ASN1_ITEM *it)\n{\n    ASN1_TLC c;\n    ASN1_VALUE *ptmpval = NULL;\n    if (!pval)\n        pval = &ptmpval;\n    asn1_tlc_clear_nc(&c);\n    if (ASN1_item_ex_d2i(pval, in, len, it, -1, 0, 0, &c) > 0)\n        return *pval;\n    return NULL;\n}', 'int ASN1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in, long len,\n                     const ASN1_ITEM *it,\n                     int tag, int aclass, char opt, ASN1_TLC *ctx)\n{\n    int rv;\n    rv = asn1_item_embed_d2i(pval, in, len, it, tag, aclass, opt, ctx);\n    if (rv <= 0)\n        ASN1_item_ex_free(pval, it);\n    return rv;\n}', 'static int asn1_item_embed_d2i(ASN1_VALUE **pval, const unsigned char **in,\n                               long len, const ASN1_ITEM *it,\n                               int tag, int aclass, char opt, ASN1_TLC *ctx)\n{\n    const ASN1_TEMPLATE *tt, *errtt = NULL;\n    const ASN1_EXTERN_FUNCS *ef;\n    const ASN1_AUX *aux = it->funcs;\n    ASN1_aux_cb *asn1_cb;\n    const unsigned char *p = NULL, *q;\n    unsigned char oclass;\n    char seq_eoc, seq_nolen, cst, isopt;\n    long tmplen;\n    int i;\n    int otag;\n    int ret = 0;\n    ASN1_VALUE **pchptr;\n    if (!pval)\n        return 0;\n    if (aux && aux->asn1_cb)\n        asn1_cb = aux->asn1_cb;\n    else\n        asn1_cb = 0;\n    switch (it->itype) {\n    case ASN1_ITYPE_PRIMITIVE:\n        if (it->templates) {\n            if ((tag != -1) || opt) {\n                ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I,\n                        ASN1_R_ILLEGAL_OPTIONS_ON_ITEM_TEMPLATE);\n                goto err;\n            }\n            return asn1_template_ex_d2i(pval, in, len,\n                                        it->templates, opt, ctx);\n        }\n        return asn1_d2i_ex_primitive(pval, in, len, it,\n                                     tag, aclass, opt, ctx);\n    case ASN1_ITYPE_MSTRING:\n        p = *in;\n        ret = asn1_check_tlen(NULL, &otag, &oclass, NULL, NULL,\n                              &p, len, -1, 0, 1, ctx);\n        if (!ret) {\n            ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ERR_R_NESTED_ASN1_ERROR);\n            goto err;\n        }\n        if (oclass != V_ASN1_UNIVERSAL) {\n            if (opt)\n                return -1;\n            ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ASN1_R_MSTRING_NOT_UNIVERSAL);\n            goto err;\n        }\n        if (!(ASN1_tag2bit(otag) & it->utype)) {\n            if (opt)\n                return -1;\n            ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ASN1_R_MSTRING_WRONG_TAG);\n            goto err;\n        }\n        return asn1_d2i_ex_primitive(pval, in, len, it, otag, 0, 0, ctx);\n    case ASN1_ITYPE_EXTERN:\n        ef = it->funcs;\n        return ef->asn1_ex_d2i(pval, in, len, it, tag, aclass, opt, ctx);\n    case ASN1_ITYPE_CHOICE:\n        if (asn1_cb && !asn1_cb(ASN1_OP_D2I_PRE, pval, it, NULL))\n            goto auxerr;\n        if (*pval) {\n            i = asn1_get_choice_selector(pval, it);\n            if ((i >= 0) && (i < it->tcount)) {\n                tt = it->templates + i;\n                pchptr = asn1_get_field_ptr(pval, tt);\n                asn1_template_free(pchptr, tt);\n                asn1_set_choice_selector(pval, -1, it);\n            }\n        } else if (!ASN1_item_ex_new(pval, it)) {\n            ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ERR_R_NESTED_ASN1_ERROR);\n            goto err;\n        }\n        p = *in;\n        for (i = 0, tt = it->templates; i < it->tcount; i++, tt++) {\n            pchptr = asn1_get_field_ptr(pval, tt);\n            ret = asn1_template_ex_d2i(pchptr, &p, len, tt, 1, ctx);\n            if (ret == -1)\n                continue;\n            if (ret > 0)\n                break;\n            errtt = tt;\n            ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ERR_R_NESTED_ASN1_ERROR);\n            goto err;\n        }\n        if (i == it->tcount) {\n            if (opt) {\n                ASN1_item_ex_free(pval, it);\n                return -1;\n            }\n            ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ASN1_R_NO_MATCHING_CHOICE_TYPE);\n            goto err;\n        }\n        asn1_set_choice_selector(pval, i, it);\n        if (asn1_cb && !asn1_cb(ASN1_OP_D2I_POST, pval, it, NULL))\n            goto auxerr;\n        *in = p;\n        return 1;\n    case ASN1_ITYPE_NDEF_SEQUENCE:\n    case ASN1_ITYPE_SEQUENCE:\n        p = *in;\n        tmplen = len;\n        if (tag == -1) {\n            tag = V_ASN1_SEQUENCE;\n            aclass = V_ASN1_UNIVERSAL;\n        }\n        ret = asn1_check_tlen(&len, NULL, NULL, &seq_eoc, &cst,\n                              &p, len, tag, aclass, opt, ctx);\n        if (!ret) {\n            ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ERR_R_NESTED_ASN1_ERROR);\n            goto err;\n        } else if (ret == -1)\n            return -1;\n        if (aux && (aux->flags & ASN1_AFLG_BROKEN)) {\n            len = tmplen - (p - *in);\n            seq_nolen = 1;\n        }\n        else\n            seq_nolen = seq_eoc;\n        if (!cst) {\n            ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ASN1_R_SEQUENCE_NOT_CONSTRUCTED);\n            goto err;\n        }\n        if (!*pval && !ASN1_item_ex_new(pval, it)) {\n            ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ERR_R_NESTED_ASN1_ERROR);\n            goto err;\n        }\n        if (asn1_cb && !asn1_cb(ASN1_OP_D2I_PRE, pval, it, NULL))\n            goto auxerr;\n        for (i = 0, tt = it->templates; i < it->tcount; i++, tt++) {\n            if (tt->flags & ASN1_TFLG_ADB_MASK) {\n                const ASN1_TEMPLATE *seqtt;\n                ASN1_VALUE **pseqval;\n                seqtt = asn1_do_adb(pval, tt, 1);\n                pseqval = asn1_get_field_ptr(pval, seqtt);\n                asn1_template_free(pseqval, seqtt);\n            }\n        }\n        for (i = 0, tt = it->templates; i < it->tcount; i++, tt++) {\n            const ASN1_TEMPLATE *seqtt;\n            ASN1_VALUE **pseqval;\n            seqtt = asn1_do_adb(pval, tt, 1);\n            if (!seqtt)\n                goto err;\n            pseqval = asn1_get_field_ptr(pval, seqtt);\n            if (!len)\n                break;\n            q = p;\n            if (asn1_check_eoc(&p, len)) {\n                if (!seq_eoc) {\n                    ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ASN1_R_UNEXPECTED_EOC);\n                    goto err;\n                }\n                len -= p - q;\n                seq_eoc = 0;\n                q = p;\n                break;\n            }\n            if (i == (it->tcount - 1))\n                isopt = 0;\n            else\n                isopt = (char)(seqtt->flags & ASN1_TFLG_OPTIONAL);\n            ret = asn1_template_ex_d2i(pseqval, &p, len, seqtt, isopt, ctx);\n            if (!ret) {\n                errtt = seqtt;\n                goto err;\n            } else if (ret == -1) {\n                asn1_template_free(pseqval, seqtt);\n                continue;\n            }\n            len -= p - q;\n        }\n        if (seq_eoc && !asn1_check_eoc(&p, len)) {\n            ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ASN1_R_MISSING_EOC);\n            goto err;\n        }\n        if (!seq_nolen && len) {\n            ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ASN1_R_SEQUENCE_LENGTH_MISMATCH);\n            goto err;\n        }\n        for (; i < it->tcount; tt++, i++) {\n            const ASN1_TEMPLATE *seqtt;\n            seqtt = asn1_do_adb(pval, tt, 1);\n            if (!seqtt)\n                goto err;\n            if (seqtt->flags & ASN1_TFLG_OPTIONAL) {\n                ASN1_VALUE **pseqval;\n                pseqval = asn1_get_field_ptr(pval, seqtt);\n                asn1_template_free(pseqval, seqtt);\n            } else {\n                errtt = seqtt;\n                ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ASN1_R_FIELD_MISSING);\n                goto err;\n            }\n        }\n        if (!asn1_enc_save(pval, *in, p - *in, it))\n            goto auxerr;\n        if (asn1_cb && !asn1_cb(ASN1_OP_D2I_POST, pval, it, NULL))\n            goto auxerr;\n        *in = p;\n        return 1;\n    default:\n        return 0;\n    }\n auxerr:\n    ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ASN1_R_AUX_ERROR);\n err:\n    if (errtt)\n        ERR_add_error_data(4, "Field=", errtt->field_name,\n                           ", Type=", it->sname);\n    else\n        ERR_add_error_data(2, "Type=", it->sname);\n    return 0;\n}', 'static int asn1_check_tlen(long *olen, int *otag, unsigned char *oclass,\n                           char *inf, char *cst,\n                           const unsigned char **in, long len,\n                           int exptag, int expclass, char opt, ASN1_TLC *ctx)\n{\n    int i;\n    int ptag, pclass;\n    long plen;\n    const unsigned char *p, *q;\n    p = *in;\n    q = p;\n    if (ctx && ctx->valid) {\n        i = ctx->ret;\n        plen = ctx->plen;\n        pclass = ctx->pclass;\n        ptag = ctx->ptag;\n        p += ctx->hdrlen;\n    } else {\n        i = ASN1_get_object(&p, &plen, &ptag, &pclass, len);\n        if (ctx) {\n            ctx->ret = i;\n            ctx->plen = plen;\n            ctx->pclass = pclass;\n            ctx->ptag = ptag;\n            ctx->hdrlen = p - q;\n            ctx->valid = 1;\n            if (!(i & 0x81) && ((plen + ctx->hdrlen) > len)) {\n                ASN1err(ASN1_F_ASN1_CHECK_TLEN, ASN1_R_TOO_LONG);\n                asn1_tlc_clear(ctx);\n                return 0;\n            }\n        }\n    }\n    if (i & 0x80) {\n        ASN1err(ASN1_F_ASN1_CHECK_TLEN, ASN1_R_BAD_OBJECT_HEADER);\n        asn1_tlc_clear(ctx);\n        return 0;\n    }\n    if (exptag >= 0) {\n        if ((exptag != ptag) || (expclass != pclass)) {\n            if (opt)\n                return -1;\n            asn1_tlc_clear(ctx);\n            ASN1err(ASN1_F_ASN1_CHECK_TLEN, ASN1_R_WRONG_TAG);\n            return 0;\n        }\n        asn1_tlc_clear(ctx);\n    }\n    if (i & 1)\n        plen = len - (p - q);\n    if (inf)\n        *inf = i & 1;\n    if (cst)\n        *cst = i & V_ASN1_CONSTRUCTED;\n    if (olen)\n        *olen = plen;\n    if (oclass)\n        *oclass = pclass;\n    if (otag)\n        *otag = ptag;\n    *in = p;\n    return 1;\n}', 'int ASN1_get_object(const unsigned char **pp, long *plength, int *ptag,\n                    int *pclass, long omax)\n{\n    int i, ret;\n    long l;\n    const unsigned char *p = *pp;\n    int tag, xclass, inf;\n    long max = omax;\n    if (!max)\n        goto err;\n    ret = (*p & V_ASN1_CONSTRUCTED);\n    xclass = (*p & V_ASN1_PRIVATE);\n    i = *p & V_ASN1_PRIMITIVE_TAG;\n    if (i == V_ASN1_PRIMITIVE_TAG) {\n        p++;\n        if (--max == 0)\n            goto err;\n        l = 0;\n        while (*p & 0x80) {\n            l <<= 7L;\n            l |= *(p++) & 0x7f;\n            if (--max == 0)\n                goto err;\n            if (l > (INT_MAX >> 7L))\n                goto err;\n        }\n        l <<= 7L;\n        l |= *(p++) & 0x7f;\n        tag = (int)l;\n        if (--max == 0)\n            goto err;\n    } else {\n        tag = i;\n        p++;\n        if (--max == 0)\n            goto err;\n    }\n    *ptag = tag;\n    *pclass = xclass;\n    if (!asn1_get_length(&p, &inf, plength, (int)max))\n        goto err;\n    if (inf && !(ret & V_ASN1_CONSTRUCTED))\n        goto err;\n    if (*plength > (omax - (p - *pp))) {\n        ASN1err(ASN1_F_ASN1_GET_OBJECT, ASN1_R_TOO_LONG);\n        ret |= 0x80;\n    }\n    *pp = p;\n    return (ret | inf);\n err:\n    ASN1err(ASN1_F_ASN1_GET_OBJECT, ASN1_R_HEADER_TOO_LONG);\n    return (0x80);\n}', 'static int asn1_get_length(const unsigned char **pp, int *inf, long *rl,\n                           int max)\n{\n    const unsigned char *p = *pp;\n    unsigned long ret = 0;\n    unsigned int i;\n    if (max-- < 1)\n        return (0);\n    if (*p == 0x80) {\n        *inf = 1;\n        ret = 0;\n        p++;\n    } else {\n        *inf = 0;\n        i = *p & 0x7f;\n        if (*(p++) & 0x80) {\n            if (max < (int)i)\n                return 0;\n            while (i && *p == 0) {\n                p++;\n                i--;\n            }\n            if (i > sizeof(long))\n                return 0;\n            while (i-- > 0) {\n                ret <<= 8L;\n                ret |= *(p++);\n            }\n        } else\n            ret = i;\n    }\n    if (ret > LONG_MAX)\n        return 0;\n    *pp = p;\n    *rl = (long)ret;\n    return (1);\n}']