crypto/x509v3/v3_utl.c:153: error: BUFFER_OVERRUN_L3
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, 8388607] by call to `BN_bn2dec`.
Showing all 12 steps of the trace


crypto/x509v3/v3_utl.c:152:18: Call
150.       if (!a)
151.           return NULL;
152.       if ((bntmp = ASN1_ENUMERATED_to_BN(a, NULL)) == NULL
                        ^
153.           || (strtmp = BN_bn2dec(bntmp)) == NULL)
154.           X509V3err(X509V3_F_I2S_ASN1_ENUMERATED, ERR_R_MALLOC_FAILURE);

crypto/asn1/a_int.c:672:12: Call
  670.   BIGNUM *ASN1_ENUMERATED_to_BN(const ASN1_ENUMERATED *ai, BIGNUM *bn)
  671.   {
  672.       return asn1_string_to_bn(ai, bn, V_ASN1_ENUMERATED);
                    ^
  673.   }

crypto/asn1/a_int.c:563:1: Parameter `bn->d`
    561.   }
    562.   
    563. > static BIGNUM *asn1_string_to_bn(const ASN1_INTEGER *ai, BIGNUM *bn,
    564.                                    int itype)
    565.   {

crypto/x509v3/v3_utl.c:153:22: Call
151.           return NULL;
152.       if ((bntmp = ASN1_ENUMERATED_to_BN(a, NULL)) == NULL
153.           || (strtmp = BN_bn2dec(bntmp)) == NULL)
                            ^
154.           X509V3err(X509V3_F_I2S_ASN1_ENUMERATED, ERR_R_MALLOC_FAILURE);
155.       BN_free(bntmp);

crypto/bn/bn_print.c:106:1: Parameter `*a->d`
  104.   
  105.   /* Must 'OPENSSL_free' the returned data */
  106. > char *BN_bn2dec(const BIGNUM *a)
  107.   {
  108.       int i = 0, num, ok = 0;

crypto/bn/bn_print.c:128:14: Call
  126.           goto err;
  127.       }
  128.       if ((t = BN_dup(a)) == NULL)
                      ^
  129.           goto err;
  130.   

crypto/bn/bn_lib.c:410:1: Parameter `*a->d`
    408.   }
    409.   
    410. > BIGNUM *BN_dup(const BIGNUM *a)
    411.   {
    412.       BIGNUM *t;

crypto/bn/bn_lib.c:421:10: Call
    419.       if (t == NULL)
    420.           return NULL;
    421.       if (!BN_copy(t, a)) {
                    ^
    422.           BN_free(t);
    423.           return NULL;

crypto/bn/bn_lib.c:429:1: <Length trace>
427.   }
428.   
429. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
430.   {
431.       int i;

crypto/bn/bn_lib.c:429:1: Parameter `*b->d`
      427.   }
      428.   
      429. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      430.   {
      431.       int i;

crypto/bn/bn_lib.c:444:5: Assignment
      442.   #if 1
      443.       A = a->d;
      444.       B = b->d;
                 ^
      445.       for (i = b->top >> 2; i > 0; i--, A += 4, B += 4) {
      446.           BN_ULONG a0, a1, a2, a3;

crypto/bn/bn_lib.c:450:14: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, 8388607] by call to `BN_bn2dec` 
      448.           a1 = B[1];
      449.           a2 = B[2];
      450.           a3 = B[3];
                          ^
      451.           A[0] = a0;
      452.           A[1] = a1;

BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
{
    int i;
    BN_ULONG *A;
    const BN_ULONG *B;
    bn_check_top(b);
    if (a == b)
        return (a);
    if (bn_wexpand(a, b->top) == NULL)
        return (NULL);
#if 1
    A = a->d;
    B = b->d;
    for (i = b->top >> 2; i > 0; i--, A += 4, B += 4) {
        BN_ULONG a0, a1, a2, a3;
        a0 = B[0];
        a1 = B[1];
        a2 = B[2];
        a3 = B[3];
        A[0] = a0;
        A[1] = a1;
        A[2] = a2;
        A[3] = a3;
    }
    switch (b->top & 3) {
    case 3:
        A[2] = B[2];
    case 2:
        A[1] = B[1];
    case 1:
        A[0] = B[0];
    case 0:;
    }
#else
    memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
#endif
    a->top = b->top;
    a->neg = b->neg;
    bn_check_top(a);
    return (a);
}
['char *i2s_ASN1_ENUMERATED(X509V3_EXT_METHOD *method, ASN1_ENUMERATED *a)\n{\n    BIGNUM *bntmp = NULL;\n    char *strtmp = NULL;\n    if (!a)\n        return NULL;\n    if ((bntmp = ASN1_ENUMERATED_to_BN(a, NULL)) == NULL\n        || (strtmp = BN_bn2dec(bntmp)) == NULL)\n        X509V3err(X509V3_F_I2S_ASN1_ENUMERATED, ERR_R_MALLOC_FAILURE);\n    BN_free(bntmp);\n    return strtmp;\n}', 'BIGNUM *ASN1_ENUMERATED_to_BN(const ASN1_ENUMERATED *ai, BIGNUM *bn)\n{\n    return asn1_string_to_bn(ai, bn, V_ASN1_ENUMERATED);\n}', 'static BIGNUM *asn1_string_to_bn(const ASN1_INTEGER *ai, BIGNUM *bn,\n                                 int itype)\n{\n    BIGNUM *ret;\n    if ((ai->type & ~V_ASN1_NEG) != itype) {\n        ASN1err(ASN1_F_ASN1_STRING_TO_BN, ASN1_R_WRONG_INTEGER_TYPE);\n        return NULL;\n    }\n    ret = BN_bin2bn(ai->data, ai->length, bn);\n    if (ret == 0) {\n        ASN1err(ASN1_F_ASN1_STRING_TO_BN, ASN1_R_BN_LIB);\n        return NULL;\n    }\n    if (ai->type & V_ASN1_NEG)\n        BN_set_negative(ret, 1);\n    return ret;\n}', "char *BN_bn2dec(const BIGNUM *a)\n{\n    int i = 0, num, ok = 0;\n    char *buf = NULL;\n    char *p;\n    BIGNUM *t = NULL;\n    BN_ULONG *bn_data = NULL, *lp;\n    i = BN_num_bits(a) * 3;\n    num = (i / 10 + i / 1000 + 1) + 1;\n    bn_data = OPENSSL_malloc((num / BN_DEC_NUM + 1) * sizeof(BN_ULONG));\n    buf = OPENSSL_malloc(num + 3);\n    if ((buf == NULL) || (bn_data == NULL)) {\n        BNerr(BN_F_BN_BN2DEC, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    if ((t = BN_dup(a)) == NULL)\n        goto err;\n#define BUF_REMAIN (num+3 - (size_t)(p - buf))\n    p = buf;\n    lp = bn_data;\n    if (BN_is_zero(t)) {\n        *(p++) = '0';\n        *(p++) = '\\0';\n    } else {\n        if (BN_is_negative(t))\n            *p++ = '-';\n        i = 0;\n        while (!BN_is_zero(t)) {\n            *lp = BN_div_word(t, BN_DEC_CONV);\n            lp++;\n        }\n        lp--;\n        BIO_snprintf(p, BUF_REMAIN, BN_DEC_FMT1, *lp);\n        while (*p)\n            p++;\n        while (lp != bn_data) {\n            lp--;\n            BIO_snprintf(p, BUF_REMAIN, BN_DEC_FMT2, *lp);\n            while (*p)\n                p++;\n        }\n    }\n    ok = 1;\n err:\n    OPENSSL_free(bn_data);\n    BN_free(t);\n    if (ok)\n        return buf;\n    OPENSSL_free(buf);\n    return NULL;\n}", 'BIGNUM *BN_dup(const BIGNUM *a)\n{\n    BIGNUM *t;\n    if (a == NULL)\n        return NULL;\n    bn_check_top(a);\n    t = BN_get_flags(a, BN_FLG_SECURE) ? BN_secure_new() : BN_new();\n    if (t == NULL)\n        return NULL;\n    if (!BN_copy(t, a)) {\n        BN_free(t);\n        return NULL;\n    }\n    bn_check_top(t);\n    return t;\n}', 'BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)\n{\n    int i;\n    BN_ULONG *A;\n    const BN_ULONG *B;\n    bn_check_top(b);\n    if (a == b)\n        return (a);\n    if (bn_wexpand(a, b->top) == NULL)\n        return (NULL);\n#if 1\n    A = a->d;\n    B = b->d;\n    for (i = b->top >> 2; i > 0; i--, A += 4, B += 4) {\n        BN_ULONG a0, a1, a2, a3;\n        a0 = B[0];\n        a1 = B[1];\n        a2 = B[2];\n        a3 = B[3];\n        A[0] = a0;\n        A[1] = a1;\n        A[2] = a2;\n        A[3] = a3;\n    }\n    switch (b->top & 3) {\n    case 3:\n        A[2] = B[2];\n    case 2:\n        A[1] = B[1];\n    case 1:\n        A[0] = B[0];\n    case 0:;\n    }\n#else\n    memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);\n#endif\n    a->top = b->top;\n    a->neg = b->neg;\n    bn_check_top(a);\n    return (a);\n}']