crypto/pem/pvkfmt.c:766: error: BUFFER_OVERRUN_L3
  Offset: 1 Size: [0, +oo] by call to `do_PVK_body`.
Showing all 21 steps of the trace


crypto/pem/pvkfmt.c:753:10: Call
751.       p = pvk_hdr;
752.   
753.       if (!do_PVK_header(&p, 24, 0, &saltlen, &keylen))
                ^
754.           return 0;
755.       buflen = (int)keylen + saltlen;

crypto/pem/pvkfmt.c:609:1: Parameter `*pkeylen`
  607.   # ifndef OPENSSL_NO_RC4
  608.   
  609. > static int do_PVK_header(const unsigned char **in, unsigned int length,
  610.                            int skip_magic,
  611.                            unsigned int *psaltlen, unsigned int *pkeylen)

crypto/pem/pvkfmt.c:755:5: Assignment
753.       if (!do_PVK_header(&p, 24, 0, &saltlen, &keylen))
754.           return 0;
755.       buflen = (int)keylen + saltlen;
           ^
756.       buf = OPENSSL_malloc(buflen);
757.       if (buf == NULL) {

crypto/pem/pvkfmt.c:756:11: Call
754.           return 0;
755.       buflen = (int)keylen + saltlen;
756.       buf = OPENSSL_malloc(buflen);
                 ^
757.       if (buf == NULL) {
758.           PEMerr(PEM_F_B2I_PVK_BIO, ERR_R_MALLOC_FAILURE);

crypto/mem.c:125:9: Assignment
  123.   
  124.       if (num <= 0)
  125.           return NULL;
                 ^
  126.   
  127.       allow_customize = 0;

crypto/pem/pvkfmt.c:756:5: Assignment
754.           return 0;
755.       buflen = (int)keylen + saltlen;
756.       buf = OPENSSL_malloc(buflen);
           ^
757.       if (buf == NULL) {
758.           PEMerr(PEM_F_B2I_PVK_BIO, ERR_R_MALLOC_FAILURE);

crypto/pem/pvkfmt.c:761:5: Assignment
759.           return 0;
760.       }
761.       p = buf;
           ^
762.       if (BIO_read(in, buf, buflen) != buflen) {
763.           PEMerr(PEM_F_B2I_PVK_BIO, PEM_R_PVK_DATA_TOO_SHORT);

crypto/pem/pvkfmt.c:766:11: Call
764.           goto err;
765.       }
766.       ret = do_PVK_body(&p, saltlen, keylen, cb, u);
                 ^
767.   
768.    err:

crypto/pem/pvkfmt.c:666:1: Parameter `**in`
  664.   }
  665.   
  666. > static EVP_PKEY *do_PVK_body(const unsigned char **in,
  667.                                unsigned int saltlen, unsigned int keylen,
  668.                                pem_password_cb *cb, void *u)

crypto/pem/pvkfmt.c:671:5: Assignment
  669.   {
  670.       EVP_PKEY *ret = NULL;
  671.       const unsigned char *p = *in;
             ^
  672.       unsigned int magic;
  673.       unsigned char *enctmp = NULL, *q;

crypto/pem/pvkfmt.c:733:11: Call
  731.       }
  732.   
  733.       ret = b2i_PrivateKey(&p, keylen);
                   ^
  734.    err:
  735.       EVP_CIPHER_CTX_free(cctx);

crypto/pem/pvkfmt.c:388:1: Parameter `**in`
    386.   }
    387.   
    388. > EVP_PKEY *b2i_PrivateKey(const unsigned char **in, long length)
    389.   {
    390.       return do_b2i(in, length, 0);

crypto/pem/pvkfmt.c:390:12: Call
    388.   EVP_PKEY *b2i_PrivateKey(const unsigned char **in, long length)
    389.   {
    390.       return do_b2i(in, length, 0);
                      ^
    391.   }
    392.   

crypto/pem/pvkfmt.c:234:1: Parameter `**in`
      232.   }
      233.   
      234. > static EVP_PKEY *do_b2i(const unsigned char **in, unsigned int length,
      235.                           int ispub)
      236.   {

crypto/pem/pvkfmt.c:237:5: Assignment
      235.                           int ispub)
      236.   {
      237.       const unsigned char *p = *in;
                 ^
      238.       unsigned int bitlen, magic;
      239.       int isdss;

crypto/pem/pvkfmt.c:240:9: Call
      238.       unsigned int bitlen, magic;
      239.       int isdss;
      240.       if (do_blob_header(&p, length, &magic, &bitlen, &isdss, &ispub) <= 0) {
                     ^
      241.           PEMerr(PEM_F_DO_B2I, PEM_R_KEYBLOB_HEADER_PARSE_ERROR);
      242.           return NULL;

crypto/pem/pvkfmt.c:140:1: <Length trace>
138.                            unsigned int bitlen, int ispub);
139.   
140. > static int do_blob_header(const unsigned char **in, unsigned int length,
141.                             unsigned int *pmagic, unsigned int *pbitlen,
142.                             int *pisdss, int *pispub)

crypto/pem/pvkfmt.c:140:1: Parameter `**in`
        138.                            unsigned int bitlen, int ispub);
        139.   
        140. > static int do_blob_header(const unsigned char **in, unsigned int length,
        141.                             unsigned int *pmagic, unsigned int *pbitlen,
        142.                             int *pisdss, int *pispub)

crypto/pem/pvkfmt.c:144:5: Assignment
        142.                             int *pisdss, int *pispub)
        143.   {
        144.       const unsigned char *p = *in;
                   ^
        145.       if (length < 16)
        146.           return 0;

crypto/pem/pvkfmt.c:162:5: Assignment
        160.       } else
        161.           return 0;
        162.       p++;
                   ^
        163.       /* Version */
        164.       if (*p++ != 0x2) {

crypto/pem/pvkfmt.c:164:9: Array access: Offset: 1 Size: [0, +oo] by call to `do_PVK_body` 
        162.       p++;
        163.       /* Version */
        164.       if (*p++ != 0x2) {
                       ^
        165.           PEMerr(PEM_F_DO_BLOB_HEADER, PEM_R_BAD_VERSION_NUMBER);
        166.           return 0;

static int do_blob_header(const unsigned char **in, unsigned int length,
                          unsigned int *pmagic, unsigned int *pbitlen,
                          int *pisdss, int *pispub)
{
    const unsigned char *p = *in;
    if (length < 16)
        return 0;
    if (*p == MS_PUBLICKEYBLOB) {
        if (*pispub == 0) {
            PEMerr(PEM_F_DO_BLOB_HEADER, PEM_R_EXPECTING_PRIVATE_KEY_BLOB);
            return 0;
        }
        *pispub = 1;
    } else if (*p == MS_PRIVATEKEYBLOB) {
        if (*pispub == 1) {
            PEMerr(PEM_F_DO_BLOB_HEADER, PEM_R_EXPECTING_PUBLIC_KEY_BLOB);
            return 0;
        }
        *pispub = 0;
    } else
        return 0;
    p++;
    if (*p++ != 0x2) {
        PEMerr(PEM_F_DO_BLOB_HEADER, PEM_R_BAD_VERSION_NUMBER);
        return 0;
    }
    p += 6;
    *pmagic = read_ledword(&p);
    *pbitlen = read_ledword(&p);
    *pisdss = 0;
    switch (*pmagic) {
    case MS_DSS1MAGIC:
        *pisdss = 1;
    case MS_RSA1MAGIC:
        if (*pispub == 0) {
            PEMerr(PEM_F_DO_BLOB_HEADER, PEM_R_EXPECTING_PRIVATE_KEY_BLOB);
            return 0;
        }
        break;
    case MS_DSS2MAGIC:
        *pisdss = 1;
    case MS_RSA2MAGIC:
        if (*pispub == 1) {
            PEMerr(PEM_F_DO_BLOB_HEADER, PEM_R_EXPECTING_PUBLIC_KEY_BLOB);
            return 0;
        }
        break;
    default:
        PEMerr(PEM_F_DO_BLOB_HEADER, PEM_R_BAD_MAGIC_NUMBER);
        return -1;
    }
    *in = p;
    return 1;
}
['EVP_PKEY *b2i_PVK_bio(BIO *in, pem_password_cb *cb, void *u)\n{\n    unsigned char pvk_hdr[24], *buf = NULL;\n    const unsigned char *p;\n    int buflen;\n    EVP_PKEY *ret = NULL;\n    unsigned int saltlen, keylen;\n    if (BIO_read(in, pvk_hdr, 24) != 24) {\n        PEMerr(PEM_F_B2I_PVK_BIO, PEM_R_PVK_DATA_TOO_SHORT);\n        return NULL;\n    }\n    p = pvk_hdr;\n    if (!do_PVK_header(&p, 24, 0, &saltlen, &keylen))\n        return 0;\n    buflen = (int)keylen + saltlen;\n    buf = OPENSSL_malloc(buflen);\n    if (buf == NULL) {\n        PEMerr(PEM_F_B2I_PVK_BIO, ERR_R_MALLOC_FAILURE);\n        return 0;\n    }\n    p = buf;\n    if (BIO_read(in, buf, buflen) != buflen) {\n        PEMerr(PEM_F_B2I_PVK_BIO, PEM_R_PVK_DATA_TOO_SHORT);\n        goto err;\n    }\n    ret = do_PVK_body(&p, saltlen, keylen, cb, u);\n err:\n    OPENSSL_clear_free(buf, buflen);\n    return ret;\n}', 'static int do_PVK_header(const unsigned char **in, unsigned int length,\n                         int skip_magic,\n                         unsigned int *psaltlen, unsigned int *pkeylen)\n{\n    const unsigned char *p = *in;\n    unsigned int pvk_magic, is_encrypted;\n    if (skip_magic) {\n        if (length < 20) {\n            PEMerr(PEM_F_DO_PVK_HEADER, PEM_R_PVK_TOO_SHORT);\n            return 0;\n        }\n    } else {\n        if (length < 24) {\n            PEMerr(PEM_F_DO_PVK_HEADER, PEM_R_PVK_TOO_SHORT);\n            return 0;\n        }\n        pvk_magic = read_ledword(&p);\n        if (pvk_magic != MS_PVKMAGIC) {\n            PEMerr(PEM_F_DO_PVK_HEADER, PEM_R_BAD_MAGIC_NUMBER);\n            return 0;\n        }\n    }\n    p += 4;\n      read_ledword(&p);\n    is_encrypted = read_ledword(&p);\n    *psaltlen = read_ledword(&p);\n    *pkeylen = read_ledword(&p);\n    if (is_encrypted && !*psaltlen) {\n        PEMerr(PEM_F_DO_PVK_HEADER, PEM_R_INCONSISTENT_HEADER);\n        return 0;\n    }\n    *in = p;\n    return 1;\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (num <= 0)\n        return NULL;\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    (void)file;\n    (void)line;\n    ret = malloc(num);\n#endif\n#ifndef OPENSSL_CPUID_OBJ\n    if (ret && (num > 2048)) {\n        extern unsigned char cleanse_ctr;\n        ((unsigned char *)ret)[0] = cleanse_ctr;\n    }\n#endif\n    return ret;\n}', 'static EVP_PKEY *do_PVK_body(const unsigned char **in,\n                             unsigned int saltlen, unsigned int keylen,\n                             pem_password_cb *cb, void *u)\n{\n    EVP_PKEY *ret = NULL;\n    const unsigned char *p = *in;\n    unsigned int magic;\n    unsigned char *enctmp = NULL, *q;\n    EVP_CIPHER_CTX *cctx = EVP_CIPHER_CTX_new();\n    if (saltlen) {\n        char psbuf[PEM_BUFSIZE];\n        unsigned char keybuf[20];\n        int enctmplen, inlen;\n        if (cb)\n            inlen = cb(psbuf, PEM_BUFSIZE, 0, u);\n        else\n            inlen = PEM_def_callback(psbuf, PEM_BUFSIZE, 0, u);\n        if (inlen <= 0) {\n            PEMerr(PEM_F_DO_PVK_BODY, PEM_R_BAD_PASSWORD_READ);\n            goto err;\n        }\n        enctmp = OPENSSL_malloc(keylen + 8);\n        if (enctmp == NULL) {\n            PEMerr(PEM_F_DO_PVK_BODY, ERR_R_MALLOC_FAILURE);\n            goto err;\n        }\n        if (!derive_pvk_key(keybuf, p, saltlen,\n                            (unsigned char *)psbuf, inlen))\n            goto err;\n        p += saltlen;\n        memcpy(enctmp, p, 8);\n        p += 8;\n        if (keylen < 8) {\n            PEMerr(PEM_F_DO_PVK_BODY, PEM_R_PVK_TOO_SHORT);\n            goto err;\n        }\n        inlen = keylen - 8;\n        q = enctmp + 8;\n        if (!EVP_DecryptInit_ex(cctx, EVP_rc4(), NULL, keybuf, NULL))\n            goto err;\n        if (!EVP_DecryptUpdate(cctx, q, &enctmplen, p, inlen))\n            goto err;\n        if (!EVP_DecryptFinal_ex(cctx, q + enctmplen, &enctmplen))\n            goto err;\n        magic = read_ledword((const unsigned char **)&q);\n        if (magic != MS_RSA2MAGIC && magic != MS_DSS2MAGIC) {\n            q = enctmp + 8;\n            memset(keybuf + 5, 0, 11);\n            if (!EVP_DecryptInit_ex(cctx, EVP_rc4(), NULL, keybuf, NULL))\n                goto err;\n            OPENSSL_cleanse(keybuf, 20);\n            if (!EVP_DecryptUpdate(cctx, q, &enctmplen, p, inlen))\n                goto err;\n            if (!EVP_DecryptFinal_ex(cctx, q + enctmplen, &enctmplen))\n                goto err;\n            magic = read_ledword((const unsigned char **)&q);\n            if (magic != MS_RSA2MAGIC && magic != MS_DSS2MAGIC) {\n                PEMerr(PEM_F_DO_PVK_BODY, PEM_R_BAD_DECRYPT);\n                goto err;\n            }\n        } else\n            OPENSSL_cleanse(keybuf, 20);\n        p = enctmp;\n    }\n    ret = b2i_PrivateKey(&p, keylen);\n err:\n    EVP_CIPHER_CTX_free(cctx);\n    OPENSSL_free(enctmp);\n    return ret;\n}', 'EVP_PKEY *b2i_PrivateKey(const unsigned char **in, long length)\n{\n    return do_b2i(in, length, 0);\n}', 'static EVP_PKEY *do_b2i(const unsigned char **in, unsigned int length,\n                        int ispub)\n{\n    const unsigned char *p = *in;\n    unsigned int bitlen, magic;\n    int isdss;\n    if (do_blob_header(&p, length, &magic, &bitlen, &isdss, &ispub) <= 0) {\n        PEMerr(PEM_F_DO_B2I, PEM_R_KEYBLOB_HEADER_PARSE_ERROR);\n        return NULL;\n    }\n    length -= 16;\n    if (length < blob_length(bitlen, isdss, ispub)) {\n        PEMerr(PEM_F_DO_B2I, PEM_R_KEYBLOB_TOO_SHORT);\n        return NULL;\n    }\n    if (isdss)\n        return b2i_dss(&p, length, bitlen, ispub);\n    else\n        return b2i_rsa(&p, length, bitlen, ispub);\n}', 'static int do_blob_header(const unsigned char **in, unsigned int length,\n                          unsigned int *pmagic, unsigned int *pbitlen,\n                          int *pisdss, int *pispub)\n{\n    const unsigned char *p = *in;\n    if (length < 16)\n        return 0;\n    if (*p == MS_PUBLICKEYBLOB) {\n        if (*pispub == 0) {\n            PEMerr(PEM_F_DO_BLOB_HEADER, PEM_R_EXPECTING_PRIVATE_KEY_BLOB);\n            return 0;\n        }\n        *pispub = 1;\n    } else if (*p == MS_PRIVATEKEYBLOB) {\n        if (*pispub == 1) {\n            PEMerr(PEM_F_DO_BLOB_HEADER, PEM_R_EXPECTING_PUBLIC_KEY_BLOB);\n            return 0;\n        }\n        *pispub = 0;\n    } else\n        return 0;\n    p++;\n    if (*p++ != 0x2) {\n        PEMerr(PEM_F_DO_BLOB_HEADER, PEM_R_BAD_VERSION_NUMBER);\n        return 0;\n    }\n    p += 6;\n    *pmagic = read_ledword(&p);\n    *pbitlen = read_ledword(&p);\n    *pisdss = 0;\n    switch (*pmagic) {\n    case MS_DSS1MAGIC:\n        *pisdss = 1;\n    case MS_RSA1MAGIC:\n        if (*pispub == 0) {\n            PEMerr(PEM_F_DO_BLOB_HEADER, PEM_R_EXPECTING_PRIVATE_KEY_BLOB);\n            return 0;\n        }\n        break;\n    case MS_DSS2MAGIC:\n        *pisdss = 1;\n    case MS_RSA2MAGIC:\n        if (*pispub == 1) {\n            PEMerr(PEM_F_DO_BLOB_HEADER, PEM_R_EXPECTING_PUBLIC_KEY_BLOB);\n            return 0;\n        }\n        break;\n    default:\n        PEMerr(PEM_F_DO_BLOB_HEADER, PEM_R_BAD_MAGIC_NUMBER);\n        return -1;\n    }\n    *in = p;\n    return 1;\n}']