crypto/x509/x509spki.c:117: error: BUFFER_OVERRUN_L3
  Offset: [9, +oo] Size: [0, +oo] by call to `i2d_NETSCAPE_SPKI`.
Showing all 54 steps of the trace


crypto/x509/x509spki.c:109:12: Call
107.   	char *b64_str;
108.   	int der_len;
109.   	der_len = i2d_NETSCAPE_SPKI(spki, NULL);
                  ^
110.   	der_spki = Malloc(der_len);
111.   	b64_str = Malloc(der_len * 2);

crypto/asn1/x_spki.c:117:2: Assignment
  115.   int i2d_NETSCAPE_SPKI(NETSCAPE_SPKI *a, unsigned char **pp)
  116.   	{
  117.   	M_ASN1_I2D_vars(a);
          ^
  118.   
  119.   	M_ASN1_I2D_len(a->spkac,	i2d_NETSCAPE_SPKAC);

crypto/x509/x509spki.c:109:2: Assignment
107.   	char *b64_str;
108.   	int der_len;
109.   	der_len = i2d_NETSCAPE_SPKI(spki, NULL);
        ^
110.   	der_spki = Malloc(der_len);
111.   	b64_str = Malloc(der_len * 2);

crypto/x509/x509spki.c:110:13: Array declaration
108.   	int der_len;
109.   	der_len = i2d_NETSCAPE_SPKI(spki, NULL);
110.   	der_spki = Malloc(der_len);
                   ^
111.   	b64_str = Malloc(der_len * 2);
112.   	if(!der_spki || !b64_str) {

crypto/x509/x509spki.c:110:2: Assignment
108.   	int der_len;
109.   	der_len = i2d_NETSCAPE_SPKI(spki, NULL);
110.   	der_spki = Malloc(der_len);
        ^
111.   	b64_str = Malloc(der_len * 2);
112.   	if(!der_spki || !b64_str) {

crypto/x509/x509spki.c:116:2: Assignment
114.   		return NULL;
115.   	}
116.   	p = der_spki;
        ^
117.   	i2d_NETSCAPE_SPKI(spki, &p);
118.   	EVP_EncodeBlock((unsigned char *)b64_str, der_spki, der_len);

crypto/x509/x509spki.c:117:2: Call
115.   	}
116.   	p = der_spki;
117.   	i2d_NETSCAPE_SPKI(spki, &p);
        ^
118.   	EVP_EncodeBlock((unsigned char *)b64_str, der_spki, der_len);
119.   	Free(der_spki);

crypto/asn1/x_spki.c:115:1: Parameter `**pp`
  113.   	}
  114.   
  115. > int i2d_NETSCAPE_SPKI(NETSCAPE_SPKI *a, unsigned char **pp)
  116.   	{
  117.   	M_ASN1_I2D_vars(a);

crypto/asn1/x_spki.c:123:2: Assignment
  121.   	M_ASN1_I2D_len(a->signature,	i2d_ASN1_BIT_STRING);
  122.   
  123.   	M_ASN1_I2D_seq_total();
          ^
  124.   
  125.   	M_ASN1_I2D_put(a->spkac,	i2d_NETSCAPE_SPKAC);

crypto/asn1/x_spki.c:123:2: Call
  121.   	M_ASN1_I2D_len(a->signature,	i2d_ASN1_BIT_STRING);
  122.   
  123.   	M_ASN1_I2D_seq_total();
          ^
  124.   
  125.   	M_ASN1_I2D_put(a->spkac,	i2d_NETSCAPE_SPKAC);

crypto/asn1/asn1_lib.c:180:1: Parameter `**pp`
    178.   /* class 0 is constructed
    179.    * constructed == 2 for indefinitle length constructed */
    180. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
    181.   	     int xclass)
    182.   	{

crypto/asn1/asn1_lib.c:183:2: Assignment
    181.   	     int xclass)
    182.   	{
    183.   	unsigned char *p= *pp;
            ^
    184.   	int i;
    185.   

crypto/asn1/asn1_lib.c:189:5: Assignment
    187.   	i|=(xclass&V_ASN1_PRIVATE);
    188.   	if (tag < 31)
    189.   		*(p++)=i|(tag&V_ASN1_PRIMITIVE_TAG);
               ^
    190.   	else
    191.   		{

crypto/asn1/asn1_lib.c:201:5: Assignment
    199.   		}
    200.   	if ((constructed == 2) && (length == 0))
    201.   		*(p++)=0x80; /* der_put_length would output 0 instead */
               ^
    202.   	else
    203.   		asn1_put_length(&p,length);

crypto/asn1/asn1_lib.c:204:2: Assignment
    202.   	else
    203.   		asn1_put_length(&p,length);
    204.   	*pp=p;
            ^
    205.   	}
    206.   

crypto/asn1/x_spki.c:125:2: Call
  123.   	M_ASN1_I2D_seq_total();
  124.   
  125.   	M_ASN1_I2D_put(a->spkac,	i2d_NETSCAPE_SPKAC);
          ^
  126.   	M_ASN1_I2D_put(a->sig_algor,	i2d_X509_ALGOR);
  127.   	M_ASN1_I2D_put(a->signature,	i2d_ASN1_BIT_STRING);

crypto/asn1/x_spki.c:68:1: Parameter `**pp`
    66.   #include <openssl/asn1_mac.h>
    67.   
    68. > int i2d_NETSCAPE_SPKAC(NETSCAPE_SPKAC *a, unsigned char **pp)
    69.   	{
    70.   	M_ASN1_I2D_vars(a);

crypto/asn1/x_spki.c:75:2: Assignment
    73.   	M_ASN1_I2D_len(a->challenge,	i2d_ASN1_IA5STRING);
    74.   
    75.   	M_ASN1_I2D_seq_total();
           ^
    76.   
    77.   	M_ASN1_I2D_put(a->pubkey,	i2d_X509_PUBKEY);

crypto/asn1/x_spki.c:75:2: Call
    73.   	M_ASN1_I2D_len(a->challenge,	i2d_ASN1_IA5STRING);
    74.   
    75.   	M_ASN1_I2D_seq_total();
           ^
    76.   
    77.   	M_ASN1_I2D_put(a->pubkey,	i2d_X509_PUBKEY);

crypto/asn1/asn1_lib.c:180:1: Parameter `**pp`
      178.   /* class 0 is constructed
      179.    * constructed == 2 for indefinitle length constructed */
      180. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
      181.   	     int xclass)
      182.   	{

crypto/asn1/asn1_lib.c:183:2: Assignment
      181.   	     int xclass)
      182.   	{
      183.   	unsigned char *p= *pp;
              ^
      184.   	int i;
      185.   

crypto/asn1/asn1_lib.c:189:5: Assignment
      187.   	i|=(xclass&V_ASN1_PRIVATE);
      188.   	if (tag < 31)
      189.   		*(p++)=i|(tag&V_ASN1_PRIMITIVE_TAG);
                 ^
      190.   	else
      191.   		{

crypto/asn1/asn1_lib.c:201:5: Assignment
      199.   		}
      200.   	if ((constructed == 2) && (length == 0))
      201.   		*(p++)=0x80; /* der_put_length would output 0 instead */
                 ^
      202.   	else
      203.   		asn1_put_length(&p,length);

crypto/asn1/asn1_lib.c:204:2: Assignment
      202.   	else
      203.   		asn1_put_length(&p,length);
      204.   	*pp=p;
              ^
      205.   	}
      206.   

crypto/asn1/x_spki.c:77:2: Call
    75.   	M_ASN1_I2D_seq_total();
    76.   
    77.   	M_ASN1_I2D_put(a->pubkey,	i2d_X509_PUBKEY);
           ^
    78.   	M_ASN1_I2D_put(a->challenge,	i2d_ASN1_IA5STRING);
    79.   

crypto/asn1/x_pubkey.c:64:1: Parameter `**pp`
      62.   #include <openssl/x509.h>
      63.   
      64. > int i2d_X509_PUBKEY(X509_PUBKEY *a, unsigned char **pp)
      65.   	{
      66.   	M_ASN1_I2D_vars(a);

crypto/asn1/x_pubkey.c:71:2: Assignment
      69.   	M_ASN1_I2D_len(a->public_key,	i2d_ASN1_BIT_STRING);
      70.   
      71.   	M_ASN1_I2D_seq_total();
             ^
      72.   
      73.   	M_ASN1_I2D_put(a->algor,	i2d_X509_ALGOR);

crypto/asn1/x_pubkey.c:71:2: Call
      69.   	M_ASN1_I2D_len(a->public_key,	i2d_ASN1_BIT_STRING);
      70.   
      71.   	M_ASN1_I2D_seq_total();
             ^
      72.   
      73.   	M_ASN1_I2D_put(a->algor,	i2d_X509_ALGOR);

crypto/asn1/asn1_lib.c:180:1: Parameter `**pp`
        178.   /* class 0 is constructed
        179.    * constructed == 2 for indefinitle length constructed */
        180. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
        181.   	     int xclass)
        182.   	{

crypto/asn1/asn1_lib.c:183:2: Assignment
        181.   	     int xclass)
        182.   	{
        183.   	unsigned char *p= *pp;
                ^
        184.   	int i;
        185.   

crypto/asn1/asn1_lib.c:189:5: Assignment
        187.   	i|=(xclass&V_ASN1_PRIVATE);
        188.   	if (tag < 31)
        189.   		*(p++)=i|(tag&V_ASN1_PRIMITIVE_TAG);
                   ^
        190.   	else
        191.   		{

crypto/asn1/asn1_lib.c:201:5: Assignment
        199.   		}
        200.   	if ((constructed == 2) && (length == 0))
        201.   		*(p++)=0x80; /* der_put_length would output 0 instead */
                   ^
        202.   	else
        203.   		asn1_put_length(&p,length);

crypto/asn1/asn1_lib.c:204:2: Assignment
        202.   	else
        203.   		asn1_put_length(&p,length);
        204.   	*pp=p;
                ^
        205.   	}
        206.   

crypto/asn1/x_pubkey.c:73:2: Call
      71.   	M_ASN1_I2D_seq_total();
      72.   
      73.   	M_ASN1_I2D_put(a->algor,	i2d_X509_ALGOR);
             ^
      74.   	M_ASN1_I2D_put(a->public_key,	i2d_ASN1_BIT_STRING);
      75.   

crypto/asn1/x_algor.c:64:1: Parameter `**pp`
        62.   #include <openssl/x509.h>
        63.   
        64. > int i2d_X509_ALGOR(X509_ALGOR *a, unsigned char **pp)
        65.   	{
        66.   	M_ASN1_I2D_vars(a);

crypto/asn1/x_algor.c:72:2: Assignment
        70.   		{ M_ASN1_I2D_len(a->parameter,i2d_ASN1_TYPE); }
        71.   
        72.   	M_ASN1_I2D_seq_total();
               ^
        73.   	M_ASN1_I2D_put(a->algorithm,i2d_ASN1_OBJECT);
        74.   	if (a->parameter != NULL)

crypto/asn1/x_algor.c:72:2: Call
        70.   		{ M_ASN1_I2D_len(a->parameter,i2d_ASN1_TYPE); }
        71.   
        72.   	M_ASN1_I2D_seq_total();
               ^
        73.   	M_ASN1_I2D_put(a->algorithm,i2d_ASN1_OBJECT);
        74.   	if (a->parameter != NULL)

crypto/asn1/asn1_lib.c:180:1: Parameter `**pp`
          178.   /* class 0 is constructed
          179.    * constructed == 2 for indefinitle length constructed */
          180. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
          181.   	     int xclass)
          182.   	{

crypto/asn1/asn1_lib.c:183:2: Assignment
          181.   	     int xclass)
          182.   	{
          183.   	unsigned char *p= *pp;
                  ^
          184.   	int i;
          185.   

crypto/asn1/asn1_lib.c:189:5: Assignment
          187.   	i|=(xclass&V_ASN1_PRIVATE);
          188.   	if (tag < 31)
          189.   		*(p++)=i|(tag&V_ASN1_PRIMITIVE_TAG);
                     ^
          190.   	else
          191.   		{

crypto/asn1/asn1_lib.c:201:5: Assignment
          199.   		}
          200.   	if ((constructed == 2) && (length == 0))
          201.   		*(p++)=0x80; /* der_put_length would output 0 instead */
                     ^
          202.   	else
          203.   		asn1_put_length(&p,length);

crypto/asn1/asn1_lib.c:204:2: Assignment
          202.   	else
          203.   		asn1_put_length(&p,length);
          204.   	*pp=p;
                  ^
          205.   	}
          206.   

crypto/asn1/x_algor.c:73:2: Call
        71.   
        72.   	M_ASN1_I2D_seq_total();
        73.   	M_ASN1_I2D_put(a->algorithm,i2d_ASN1_OBJECT);
               ^
        74.   	if (a->parameter != NULL)
        75.   		{ M_ASN1_I2D_put(a->parameter,i2d_ASN1_TYPE); }

crypto/asn1/a_object.c:65:1: Parameter `**pp`
          63.   #include <openssl/objects.h>
          64.   
          65. > int i2d_ASN1_OBJECT(ASN1_OBJECT *a, unsigned char **pp)
          66.   	{
          67.   	unsigned char *p;

crypto/asn1/a_object.c:74:2: Assignment
          72.   		return(ASN1_object_size(0,a->length,V_ASN1_OBJECT));
          73.   
          74.   	p= *pp;
                 ^
          75.   	ASN1_put_object(&p,0,a->length,V_ASN1_OBJECT,V_ASN1_UNIVERSAL);
          76.   	memcpy(p,a->data,a->length);

crypto/asn1/a_object.c:75:2: Call
          73.   
          74.   	p= *pp;
          75.   	ASN1_put_object(&p,0,a->length,V_ASN1_OBJECT,V_ASN1_UNIVERSAL);
                 ^
          76.   	memcpy(p,a->data,a->length);
          77.   	p+=a->length;

crypto/asn1/asn1_lib.c:180:1: Parameter `**pp`
            178.   /* class 0 is constructed
            179.    * constructed == 2 for indefinitle length constructed */
            180. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
            181.   	     int xclass)
            182.   	{

crypto/asn1/asn1_lib.c:183:2: Assignment
            181.   	     int xclass)
            182.   	{
            183.   	unsigned char *p= *pp;
                    ^
            184.   	int i;
            185.   

crypto/asn1/asn1_lib.c:189:5: Assignment
            187.   	i|=(xclass&V_ASN1_PRIVATE);
            188.   	if (tag < 31)
            189.   		*(p++)=i|(tag&V_ASN1_PRIMITIVE_TAG);
                       ^
            190.   	else
            191.   		{

crypto/asn1/asn1_lib.c:203:3: Call
            201.   		*(p++)=0x80; /* der_put_length would output 0 instead */
            202.   	else
            203.   		asn1_put_length(&p,length);
                     ^
            204.   	*pp=p;
            205.   	}

crypto/asn1/asn1_lib.c:207:1: <Length trace>
205.   	}
206.   
207. > static void asn1_put_length(unsigned char **pp, int length)
208.   	{
209.   	unsigned char *p= *pp;

crypto/asn1/asn1_lib.c:207:1: Parameter `**pp`
              205.   	}
              206.   
              207. > static void asn1_put_length(unsigned char **pp, int length)
              208.   	{
              209.   	unsigned char *p= *pp;

crypto/asn1/asn1_lib.c:209:2: Assignment
              207.   static void asn1_put_length(unsigned char **pp, int length)
              208.   	{
              209.   	unsigned char *p= *pp;
                      ^
              210.   	int i,l;
              211.   	if (length <= 127)

crypto/asn1/asn1_lib.c:212:3: Array access: Offset: [9, +oo] Size: [0, +oo] by call to `i2d_NETSCAPE_SPKI` 
              210.   	int i,l;
              211.   	if (length <= 127)
              212.   		*(p++)=(unsigned char)length;
                       ^
              213.   	else
              214.   		{

static void asn1_put_length(unsigned char **pp, int length)
	{
	unsigned char *p= *pp;
	int i,l;
	if (length <= 127)
		*(p++)=(unsigned char)length;
	else
		{
		l=length;
		for (i=0; l > 0; i++)
			l>>=8;
		*(p++)=i|0x80;
		l=i;
		while (i-- > 0)
			{
			p[i]=length&0xff;
			length>>=8;
			}
		p+=l;
		}
	*pp=p;
	}
['char * NETSCAPE_SPKI_b64_encode(NETSCAPE_SPKI *spki)\n{\n\tunsigned char *der_spki, *p;\n\tchar *b64_str;\n\tint der_len;\n\tder_len = i2d_NETSCAPE_SPKI(spki, NULL);\n\tder_spki = Malloc(der_len);\n\tb64_str = Malloc(der_len * 2);\n\tif(!der_spki || !b64_str) {\n\t\tX509err(X509_F_NETSCAPE_SPKI_B64_ENCODE, ERR_R_MALLOC_FAILURE);\n\t\treturn NULL;\n\t}\n\tp = der_spki;\n\ti2d_NETSCAPE_SPKI(spki, &p);\n\tEVP_EncodeBlock((unsigned char *)b64_str, der_spki, der_len);\n\tFree(der_spki);\n\treturn b64_str;\n}', 'int i2d_NETSCAPE_SPKI(NETSCAPE_SPKI *a, unsigned char **pp)\n\t{\n\tM_ASN1_I2D_vars(a);\n\tM_ASN1_I2D_len(a->spkac,\ti2d_NETSCAPE_SPKAC);\n\tM_ASN1_I2D_len(a->sig_algor,\ti2d_X509_ALGOR);\n\tM_ASN1_I2D_len(a->signature,\ti2d_ASN1_BIT_STRING);\n\tM_ASN1_I2D_seq_total();\n\tM_ASN1_I2D_put(a->spkac,\ti2d_NETSCAPE_SPKAC);\n\tM_ASN1_I2D_put(a->sig_algor,\ti2d_X509_ALGOR);\n\tM_ASN1_I2D_put(a->signature,\ti2d_ASN1_BIT_STRING);\n\tM_ASN1_I2D_finish();\n\t}', 'void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,\n\t     int xclass)\n\t{\n\tunsigned char *p= *pp;\n\tint i;\n\ti=(constructed)?V_ASN1_CONSTRUCTED:0;\n\ti|=(xclass&V_ASN1_PRIVATE);\n\tif (tag < 31)\n\t\t*(p++)=i|(tag&V_ASN1_PRIMITIVE_TAG);\n\telse\n\t\t{\n\t\t*(p++)=i|V_ASN1_PRIMITIVE_TAG;\n\t\twhile (tag > 0x7f)\n\t\t\t{\n\t\t\t*(p++)=(tag&0x7f)|0x80;\n\t\t\ttag>>=7;\n\t\t\t}\n\t\t*(p++)=(tag&0x7f);\n\t\t}\n\tif ((constructed == 2) && (length == 0))\n\t\t*(p++)=0x80;\n\telse\n\t\tasn1_put_length(&p,length);\n\t*pp=p;\n\t}', 'int i2d_NETSCAPE_SPKAC(NETSCAPE_SPKAC *a, unsigned char **pp)\n\t{\n\tM_ASN1_I2D_vars(a);\n\tM_ASN1_I2D_len(a->pubkey,\ti2d_X509_PUBKEY);\n\tM_ASN1_I2D_len(a->challenge,\ti2d_ASN1_IA5STRING);\n\tM_ASN1_I2D_seq_total();\n\tM_ASN1_I2D_put(a->pubkey,\ti2d_X509_PUBKEY);\n\tM_ASN1_I2D_put(a->challenge,\ti2d_ASN1_IA5STRING);\n\tM_ASN1_I2D_finish();\n\t}', 'int i2d_X509_PUBKEY(X509_PUBKEY *a, unsigned char **pp)\n\t{\n\tM_ASN1_I2D_vars(a);\n\tM_ASN1_I2D_len(a->algor,\ti2d_X509_ALGOR);\n\tM_ASN1_I2D_len(a->public_key,\ti2d_ASN1_BIT_STRING);\n\tM_ASN1_I2D_seq_total();\n\tM_ASN1_I2D_put(a->algor,\ti2d_X509_ALGOR);\n\tM_ASN1_I2D_put(a->public_key,\ti2d_ASN1_BIT_STRING);\n\tM_ASN1_I2D_finish();\n\t}', 'int i2d_X509_ALGOR(X509_ALGOR *a, unsigned char **pp)\n\t{\n\tM_ASN1_I2D_vars(a);\n\tM_ASN1_I2D_len(a->algorithm,i2d_ASN1_OBJECT);\n\tif (a->parameter != NULL)\n\t\t{ M_ASN1_I2D_len(a->parameter,i2d_ASN1_TYPE); }\n\tM_ASN1_I2D_seq_total();\n\tM_ASN1_I2D_put(a->algorithm,i2d_ASN1_OBJECT);\n\tif (a->parameter != NULL)\n\t\t{ M_ASN1_I2D_put(a->parameter,i2d_ASN1_TYPE); }\n\tM_ASN1_I2D_finish();\n\t}', 'int i2d_ASN1_OBJECT(ASN1_OBJECT *a, unsigned char **pp)\n\t{\n\tunsigned char *p;\n\tif ((a == NULL) || (a->data == NULL)) return(0);\n\tif (pp == NULL)\n\t\treturn(ASN1_object_size(0,a->length,V_ASN1_OBJECT));\n\tp= *pp;\n\tASN1_put_object(&p,0,a->length,V_ASN1_OBJECT,V_ASN1_UNIVERSAL);\n\tmemcpy(p,a->data,a->length);\n\tp+=a->length;\n\t*pp=p;\n\treturn(a->length);\n\t}', 'static void asn1_put_length(unsigned char **pp, int length)\n\t{\n\tunsigned char *p= *pp;\n\tint i,l;\n\tif (length <= 127)\n\t\t*(p++)=(unsigned char)length;\n\telse\n\t\t{\n\t\tl=length;\n\t\tfor (i=0; l > 0; i++)\n\t\t\tl>>=8;\n\t\t*(p++)=i|0x80;\n\t\tl=i;\n\t\twhile (i-- > 0)\n\t\t\t{\n\t\t\tp[i]=length&0xff;\n\t\t\tlength>>=8;\n\t\t\t}\n\t\tp+=l;\n\t\t}\n\t*pp=p;\n\t}']