crypto/rsa/rsa_saos.c:91: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, +oo] by call to `i2d_ASN1_OCTET_STRING`.
Showing all 22 steps of the trace


crypto/rsa/rsa_saos.c:78:4: Call
76.   
77.   	i=i2d_ASN1_OCTET_STRING(&sig,NULL);
78.   	j=RSA_size(rsa);
         ^
79.   	if ((i-RSA_PKCS1_PADDING) > j)
80.   		{

crypto/rsa/rsa_lib.c:214:9: Call
  212.   int RSA_size(RSA *r)
  213.   	{
  214.   	return(BN_num_bytes(r->n));
                 ^
  215.   	}
  216.   

crypto/bn/bn_lib.c:245:19: Assignment
    243.   	bn_check_top(a);
    244.   
    245.   	if (a->top == 0) return(0);
                             ^
    246.   	l=a->d[a->top-1];
    247.   	i=(a->top-1)*BN_BITS2;

crypto/rsa/rsa_lib.c:214:2: Assignment
  212.   int RSA_size(RSA *r)
  213.   	{
  214.   	return(BN_num_bytes(r->n));
          ^
  215.   	}
  216.   

crypto/rsa/rsa_saos.c:78:2: Assignment
76.   
77.   	i=i2d_ASN1_OCTET_STRING(&sig,NULL);
78.   	j=RSA_size(rsa);
       ^
79.   	if ((i-RSA_PKCS1_PADDING) > j)
80.   		{

crypto/rsa/rsa_saos.c:84:21: Array declaration
82.   		return(0);
83.   		}
84.   	s=(unsigned char *)Malloc((unsigned int)j+1);
                          ^
85.   	if (s == NULL)
86.   		{

crypto/rsa/rsa_saos.c:84:2: Assignment
82.   		return(0);
83.   		}
84.   	s=(unsigned char *)Malloc((unsigned int)j+1);
       ^
85.   	if (s == NULL)
86.   		{

crypto/rsa/rsa_saos.c:90:2: Assignment
88.   		return(0);
89.   		}
90.   	p=s;
       ^
91.   	i2d_ASN1_OCTET_STRING(&sig,&p);
92.   	i=RSA_private_encrypt(i,s,sigret,rsa,RSA_PKCS1_PADDING);

crypto/rsa/rsa_saos.c:91:2: Call
89.   		}
90.   	p=s;
91.   	i2d_ASN1_OCTET_STRING(&sig,&p);
       ^
92.   	i=RSA_private_encrypt(i,s,sigret,rsa,RSA_PKCS1_PADDING);
93.   	if (i <= 0)

crypto/asn1/a_octet.c:78:1: Parameter `**pp`
  76.   { return M_ASN1_OCTET_STRING_set(x, d, len); }
  77.   
  78. > int i2d_ASN1_OCTET_STRING(ASN1_OCTET_STRING *a, unsigned char **pp)
  79.   { return M_i2d_ASN1_OCTET_STRING(a, pp); }
  80.   

crypto/asn1/a_octet.c:79:10: Call
  77.   
  78.   int i2d_ASN1_OCTET_STRING(ASN1_OCTET_STRING *a, unsigned char **pp)
  79.   { return M_i2d_ASN1_OCTET_STRING(a, pp); }
                 ^
  80.   
  81.   ASN1_OCTET_STRING *d2i_ASN1_OCTET_STRING(ASN1_OCTET_STRING **a,

crypto/asn1/a_bytes.c:141:1: Parameter `**pp`
    139.   	}
    140.   
    141. > int i2d_ASN1_bytes(ASN1_STRING *a, unsigned char **pp, int tag, int xclass)
    142.   	{
    143.   	int ret,r,constructed;

crypto/asn1/a_bytes.c:154:2: Assignment
    152.   	r=ASN1_object_size(0,ret,tag);
    153.   	if (pp == NULL) return(r);
    154.   	p= *pp;
            ^
    155.   
    156.   	if ((tag == V_ASN1_SEQUENCE) || (tag == V_ASN1_SET))

crypto/asn1/a_bytes.c:160:2: Call
    158.   	else
    159.   		constructed=0;
    160.   	ASN1_put_object(&p,constructed,ret,tag,xclass);
            ^
    161.   	memcpy(p,a->data,a->length);
    162.   	p+=a->length;

crypto/asn1/asn1_lib.c:180:1: Parameter `**pp`
      178.   /* class 0 is constructed
      179.    * constructed == 2 for indefinitle length constructed */
      180. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
      181.   	     int xclass)
      182.   	{

crypto/asn1/asn1_lib.c:183:2: Assignment
      181.   	     int xclass)
      182.   	{
      183.   	unsigned char *p= *pp;
              ^
      184.   	int i;
      185.   

crypto/asn1/asn1_lib.c:189:5: Assignment
      187.   	i|=(xclass&V_ASN1_PRIVATE);
      188.   	if (tag < 31)
      189.   		*(p++)=i|(tag&V_ASN1_PRIMITIVE_TAG);
                 ^
      190.   	else
      191.   		{

crypto/asn1/asn1_lib.c:203:3: Call
      201.   		*(p++)=0x80; /* der_put_length would output 0 instead */
      202.   	else
      203.   		asn1_put_length(&p,length);
               ^
      204.   	*pp=p;
      205.   	}

crypto/asn1/asn1_lib.c:207:1: <Length trace>
205.   	}
206.   
207. > static void asn1_put_length(unsigned char **pp, int length)
208.   	{
209.   	unsigned char *p= *pp;

crypto/asn1/asn1_lib.c:207:1: Parameter `**pp`
        205.   	}
        206.   
        207. > static void asn1_put_length(unsigned char **pp, int length)
        208.   	{
        209.   	unsigned char *p= *pp;

crypto/asn1/asn1_lib.c:209:2: Assignment
        207.   static void asn1_put_length(unsigned char **pp, int length)
        208.   	{
        209.   	unsigned char *p= *pp;
                ^
        210.   	int i,l;
        211.   	if (length <= 127)

crypto/asn1/asn1_lib.c:218:3: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `i2d_ASN1_OCTET_STRING` 
        216.   		for (i=0; l > 0; i++)
        217.   			l>>=8;
        218.   		*(p++)=i|0x80;
                 ^
        219.   		l=i;
        220.   		while (i-- > 0)

static void asn1_put_length(unsigned char **pp, int length)
	{
	unsigned char *p= *pp;
	int i,l;
	if (length <= 127)
		*(p++)=(unsigned char)length;
	else
		{
		l=length;
		for (i=0; l > 0; i++)
			l>>=8;
		*(p++)=i|0x80;
		l=i;
		while (i-- > 0)
			{
			p[i]=length&0xff;
			length>>=8;
			}
		p+=l;
		}
	*pp=p;
	}
['int RSA_sign_ASN1_OCTET_STRING(int type, unsigned char *m, unsigned int m_len,\n\t     unsigned char *sigret, unsigned int *siglen, RSA *rsa)\n\t{\n\tASN1_OCTET_STRING sig;\n\tint i,j,ret=1;\n\tunsigned char *p,*s;\n\tsig.type=V_ASN1_OCTET_STRING;\n\tsig.length=m_len;\n\tsig.data=m;\n\ti=i2d_ASN1_OCTET_STRING(&sig,NULL);\n\tj=RSA_size(rsa);\n\tif ((i-RSA_PKCS1_PADDING) > j)\n\t\t{\n\t\tRSAerr(RSA_F_RSA_SIGN_ASN1_OCTET_STRING,RSA_R_DIGEST_TOO_BIG_FOR_RSA_KEY);\n\t\treturn(0);\n\t\t}\n\ts=(unsigned char *)Malloc((unsigned int)j+1);\n\tif (s == NULL)\n\t\t{\n\t\tRSAerr(RSA_F_RSA_SIGN_ASN1_OCTET_STRING,ERR_R_MALLOC_FAILURE);\n\t\treturn(0);\n\t\t}\n\tp=s;\n\ti2d_ASN1_OCTET_STRING(&sig,&p);\n\ti=RSA_private_encrypt(i,s,sigret,rsa,RSA_PKCS1_PADDING);\n\tif (i <= 0)\n\t\tret=0;\n\telse\n\t\t*siglen=i;\n\tmemset(s,0,(unsigned int)j+1);\n\tFree(s);\n\treturn(ret);\n\t}', 'int RSA_size(RSA *r)\n\t{\n\treturn(BN_num_bytes(r->n));\n\t}', 'int BN_num_bits(const BIGNUM *a)\n\t{\n\tBN_ULONG l;\n\tint i;\n\tbn_check_top(a);\n\tif (a->top == 0) return(0);\n\tl=a->d[a->top-1];\n\ti=(a->top-1)*BN_BITS2;\n\tif (l == 0)\n\t\t{\n#if !defined(NO_STDIO) && !defined(WIN16)\n\t\tfprintf(stderr,"BAD TOP VALUE\\n");\n#endif\n\t\tabort();\n\t\t}\n\treturn(i+BN_num_bits_word(l));\n\t}', 'int i2d_ASN1_OCTET_STRING(ASN1_OCTET_STRING *a, unsigned char **pp)\n{ return M_i2d_ASN1_OCTET_STRING(a, pp); }', 'int i2d_ASN1_bytes(ASN1_STRING *a, unsigned char **pp, int tag, int xclass)\n\t{\n\tint ret,r,constructed;\n\tunsigned char *p;\n\tif (a == NULL)  return(0);\n\tif (tag == V_ASN1_BIT_STRING)\n\t\treturn(i2d_ASN1_BIT_STRING(a,pp));\n\tret=a->length;\n\tr=ASN1_object_size(0,ret,tag);\n\tif (pp == NULL) return(r);\n\tp= *pp;\n\tif ((tag == V_ASN1_SEQUENCE) || (tag == V_ASN1_SET))\n\t\tconstructed=1;\n\telse\n\t\tconstructed=0;\n\tASN1_put_object(&p,constructed,ret,tag,xclass);\n\tmemcpy(p,a->data,a->length);\n\tp+=a->length;\n\t*pp= p;\n\treturn(r);\n\t}', 'void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,\n\t     int xclass)\n\t{\n\tunsigned char *p= *pp;\n\tint i;\n\ti=(constructed)?V_ASN1_CONSTRUCTED:0;\n\ti|=(xclass&V_ASN1_PRIVATE);\n\tif (tag < 31)\n\t\t*(p++)=i|(tag&V_ASN1_PRIMITIVE_TAG);\n\telse\n\t\t{\n\t\t*(p++)=i|V_ASN1_PRIMITIVE_TAG;\n\t\twhile (tag > 0x7f)\n\t\t\t{\n\t\t\t*(p++)=(tag&0x7f)|0x80;\n\t\t\ttag>>=7;\n\t\t\t}\n\t\t*(p++)=(tag&0x7f);\n\t\t}\n\tif ((constructed == 2) && (length == 0))\n\t\t*(p++)=0x80;\n\telse\n\t\tasn1_put_length(&p,length);\n\t*pp=p;\n\t}', 'static void asn1_put_length(unsigned char **pp, int length)\n\t{\n\tunsigned char *p= *pp;\n\tint i,l;\n\tif (length <= 127)\n\t\t*(p++)=(unsigned char)length;\n\telse\n\t\t{\n\t\tl=length;\n\t\tfor (i=0; l > 0; i++)\n\t\t\tl>>=8;\n\t\t*(p++)=i|0x80;\n\t\tl=i;\n\t\twhile (i-- > 0)\n\t\t\t{\n\t\t\tp[i]=length&0xff;\n\t\t\tlength>>=8;\n\t\t\t}\n\t\tp+=l;\n\t\t}\n\t*pp=p;\n\t}']