crypto/pem/pvkfmt.c:766: error: BUFFER_OVERRUN_L3
  Offset: 11 Size: [8, +oo] by call to `do_PVK_body`.
Showing all 16 steps of the trace


crypto/pem/pvkfmt.c:753:10: Call
751.       p = pvk_hdr;
752.   
753.       if (!do_PVK_header(&p, 24, 0, &saltlen, &keylen))
                ^
754.           return 0;
755.       buflen = (int)keylen + saltlen;

crypto/pem/pvkfmt.c:609:1: Parameter `*pkeylen`
  607.   # ifndef OPENSSL_NO_RC4
  608.   
  609. > static int do_PVK_header(const unsigned char **in, unsigned int length,
  610.                            int skip_magic,
  611.                            unsigned int *psaltlen, unsigned int *pkeylen)

crypto/pem/pvkfmt.c:766:11: Call
764.           goto err;
765.       }
766.       ret = do_PVK_body(&p, saltlen, keylen, cb, u);
                 ^
767.   
768.    err:

crypto/pem/pvkfmt.c:666:1: Parameter `keylen`
  664.   }
  665.   
  666. > static EVP_PKEY *do_PVK_body(const unsigned char **in,
  667.                                unsigned int saltlen, unsigned int keylen,
  668.                                pem_password_cb *cb, void *u)

crypto/pem/pvkfmt.c:688:18: Call
  686.               goto err;
  687.           }
  688.           enctmp = OPENSSL_malloc(keylen + 8);
                          ^
  689.           if (enctmp == NULL) {
  690.               PEMerr(PEM_F_DO_PVK_BODY, ERR_R_MALLOC_FAILURE);

crypto/mem.c:125:9: Assignment
    123.   
    124.       if (num <= 0)
    125.           return NULL;
                   ^
    126.   
    127.       allow_customize = 0;

crypto/pem/pvkfmt.c:688:9: Assignment
  686.               goto err;
  687.           }
  688.           enctmp = OPENSSL_malloc(keylen + 8);
                 ^
  689.           if (enctmp == NULL) {
  690.               PEMerr(PEM_F_DO_PVK_BODY, ERR_R_MALLOC_FAILURE);

crypto/pem/pvkfmt.c:705:9: Assignment
  703.           }
  704.           inlen = keylen - 8;
  705.           q = enctmp + 8;
                 ^
  706.           if (!EVP_DecryptInit_ex(cctx, EVP_rc4(), NULL, keybuf, NULL))
  707.               goto err;

crypto/pem/pvkfmt.c:712:17: Call
  710.           if (!EVP_DecryptFinal_ex(cctx, q + enctmplen, &enctmplen))
  711.               goto err;
  712.           magic = read_ledword((const unsigned char **)&q);
                         ^
  713.           if (magic != MS_RSA2MAGIC && magic != MS_DSS2MAGIC) {
  714.               q = enctmp + 8;

crypto/pem/pvkfmt.c:77:1: <Length trace>
75.    */
76.   
77. > static unsigned int read_ledword(const unsigned char **in)
78.   {
79.       const unsigned char *p = *in;

crypto/pem/pvkfmt.c:77:1: Parameter `**in`
    75.    */
    76.   
    77. > static unsigned int read_ledword(const unsigned char **in)
    78.   {
    79.       const unsigned char *p = *in;

crypto/pem/pvkfmt.c:79:5: Assignment
    77.   static unsigned int read_ledword(const unsigned char **in)
    78.   {
    79.       const unsigned char *p = *in;
              ^
    80.       unsigned int ret;
    81.       ret = *p++;

crypto/pem/pvkfmt.c:81:12: Assignment
    79.       const unsigned char *p = *in;
    80.       unsigned int ret;
    81.       ret = *p++;
                     ^
    82.       ret |= (*p++ << 8);
    83.       ret |= (*p++ << 16);

crypto/pem/pvkfmt.c:82:14: Assignment
    80.       unsigned int ret;
    81.       ret = *p++;
    82.       ret |= (*p++ << 8);
                       ^
    83.       ret |= (*p++ << 16);
    84.       ret |= (*p++ << 24);

crypto/pem/pvkfmt.c:83:14: Assignment
    81.       ret = *p++;
    82.       ret |= (*p++ << 8);
    83.       ret |= (*p++ << 16);
                       ^
    84.       ret |= (*p++ << 24);
    85.       *in = p;

crypto/pem/pvkfmt.c:84:13: Array access: Offset: 11 Size: [8, +oo] by call to `do_PVK_body` 
    82.       ret |= (*p++ << 8);
    83.       ret |= (*p++ << 16);
    84.       ret |= (*p++ << 24);
                      ^
    85.       *in = p;
    86.       return ret;

static unsigned int read_ledword(const unsigned char **in)
{
    const unsigned char *p = *in;
    unsigned int ret;
    ret = *p++;
    ret |= (*p++ << 8);
    ret |= (*p++ << 16);
    ret |= (*p++ << 24);
    *in = p;
    return ret;
}
['EVP_PKEY *b2i_PVK_bio(BIO *in, pem_password_cb *cb, void *u)\n{\n    unsigned char pvk_hdr[24], *buf = NULL;\n    const unsigned char *p;\n    int buflen;\n    EVP_PKEY *ret = NULL;\n    unsigned int saltlen, keylen;\n    if (BIO_read(in, pvk_hdr, 24) != 24) {\n        PEMerr(PEM_F_B2I_PVK_BIO, PEM_R_PVK_DATA_TOO_SHORT);\n        return NULL;\n    }\n    p = pvk_hdr;\n    if (!do_PVK_header(&p, 24, 0, &saltlen, &keylen))\n        return 0;\n    buflen = (int)keylen + saltlen;\n    buf = OPENSSL_malloc(buflen);\n    if (buf == NULL) {\n        PEMerr(PEM_F_B2I_PVK_BIO, ERR_R_MALLOC_FAILURE);\n        return 0;\n    }\n    p = buf;\n    if (BIO_read(in, buf, buflen) != buflen) {\n        PEMerr(PEM_F_B2I_PVK_BIO, PEM_R_PVK_DATA_TOO_SHORT);\n        goto err;\n    }\n    ret = do_PVK_body(&p, saltlen, keylen, cb, u);\n err:\n    OPENSSL_clear_free(buf, buflen);\n    return ret;\n}', 'static int do_PVK_header(const unsigned char **in, unsigned int length,\n                         int skip_magic,\n                         unsigned int *psaltlen, unsigned int *pkeylen)\n{\n    const unsigned char *p = *in;\n    unsigned int pvk_magic, is_encrypted;\n    if (skip_magic) {\n        if (length < 20) {\n            PEMerr(PEM_F_DO_PVK_HEADER, PEM_R_PVK_TOO_SHORT);\n            return 0;\n        }\n    } else {\n        if (length < 24) {\n            PEMerr(PEM_F_DO_PVK_HEADER, PEM_R_PVK_TOO_SHORT);\n            return 0;\n        }\n        pvk_magic = read_ledword(&p);\n        if (pvk_magic != MS_PVKMAGIC) {\n            PEMerr(PEM_F_DO_PVK_HEADER, PEM_R_BAD_MAGIC_NUMBER);\n            return 0;\n        }\n    }\n    p += 4;\n      read_ledword(&p);\n    is_encrypted = read_ledword(&p);\n    *psaltlen = read_ledword(&p);\n    *pkeylen = read_ledword(&p);\n    if (is_encrypted && !*psaltlen) {\n        PEMerr(PEM_F_DO_PVK_HEADER, PEM_R_INCONSISTENT_HEADER);\n        return 0;\n    }\n    *in = p;\n    return 1;\n}', 'static EVP_PKEY *do_PVK_body(const unsigned char **in,\n                             unsigned int saltlen, unsigned int keylen,\n                             pem_password_cb *cb, void *u)\n{\n    EVP_PKEY *ret = NULL;\n    const unsigned char *p = *in;\n    unsigned int magic;\n    unsigned char *enctmp = NULL, *q;\n    EVP_CIPHER_CTX *cctx = EVP_CIPHER_CTX_new();\n    if (saltlen) {\n        char psbuf[PEM_BUFSIZE];\n        unsigned char keybuf[20];\n        int enctmplen, inlen;\n        if (cb)\n            inlen = cb(psbuf, PEM_BUFSIZE, 0, u);\n        else\n            inlen = PEM_def_callback(psbuf, PEM_BUFSIZE, 0, u);\n        if (inlen <= 0) {\n            PEMerr(PEM_F_DO_PVK_BODY, PEM_R_BAD_PASSWORD_READ);\n            goto err;\n        }\n        enctmp = OPENSSL_malloc(keylen + 8);\n        if (enctmp == NULL) {\n            PEMerr(PEM_F_DO_PVK_BODY, ERR_R_MALLOC_FAILURE);\n            goto err;\n        }\n        if (!derive_pvk_key(keybuf, p, saltlen,\n                            (unsigned char *)psbuf, inlen))\n            goto err;\n        p += saltlen;\n        memcpy(enctmp, p, 8);\n        p += 8;\n        if (keylen < 8) {\n            PEMerr(PEM_F_DO_PVK_BODY, PEM_R_PVK_TOO_SHORT);\n            goto err;\n        }\n        inlen = keylen - 8;\n        q = enctmp + 8;\n        if (!EVP_DecryptInit_ex(cctx, EVP_rc4(), NULL, keybuf, NULL))\n            goto err;\n        if (!EVP_DecryptUpdate(cctx, q, &enctmplen, p, inlen))\n            goto err;\n        if (!EVP_DecryptFinal_ex(cctx, q + enctmplen, &enctmplen))\n            goto err;\n        magic = read_ledword((const unsigned char **)&q);\n        if (magic != MS_RSA2MAGIC && magic != MS_DSS2MAGIC) {\n            q = enctmp + 8;\n            memset(keybuf + 5, 0, 11);\n            if (!EVP_DecryptInit_ex(cctx, EVP_rc4(), NULL, keybuf, NULL))\n                goto err;\n            OPENSSL_cleanse(keybuf, 20);\n            if (!EVP_DecryptUpdate(cctx, q, &enctmplen, p, inlen))\n                goto err;\n            if (!EVP_DecryptFinal_ex(cctx, q + enctmplen, &enctmplen))\n                goto err;\n            magic = read_ledword((const unsigned char **)&q);\n            if (magic != MS_RSA2MAGIC && magic != MS_DSS2MAGIC) {\n                PEMerr(PEM_F_DO_PVK_BODY, PEM_R_BAD_DECRYPT);\n                goto err;\n            }\n        } else\n            OPENSSL_cleanse(keybuf, 20);\n        p = enctmp;\n    }\n    ret = b2i_PrivateKey(&p, keylen);\n err:\n    EVP_CIPHER_CTX_free(cctx);\n    OPENSSL_free(enctmp);\n    return ret;\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (num <= 0)\n        return NULL;\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    (void)file;\n    (void)line;\n    ret = malloc(num);\n#endif\n#ifndef OPENSSL_CPUID_OBJ\n    if (ret && (num > 2048)) {\n        extern unsigned char cleanse_ctr;\n        ((unsigned char *)ret)[0] = cleanse_ctr;\n    }\n#endif\n    return ret;\n}', 'static unsigned int read_ledword(const unsigned char **in)\n{\n    const unsigned char *p = *in;\n    unsigned int ret;\n    ret = *p++;\n    ret |= (*p++ << 8);\n    ret |= (*p++ << 16);\n    ret |= (*p++ << 24);\n    *in = p;\n    return ret;\n}']