apps/pkeyutl.c:315: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] Size: [1, +oo] by call to `ASN1_parse_dump`.
Showing all 16 steps of the trace


apps/pkeyutl.c:124:5: Assignment
122.       char *infile = NULL, *outfile = NULL, *sigfile = NULL, *passinarg = NULL;
123.       char hexdump = 0, asn1parse = 0, rev = 0, *prog;
124.       unsigned char *buf_in = NULL, *buf_out = NULL, *sig = NULL;
           ^
125.       OPTION_CHOICE o;
126.       int buf_inlen = 0, siglen = -1, keyform = FORMAT_PEM, peerform =

apps/pkeyutl.c:315:14: Call
313.   
314.       if (asn1parse) {
315.           if (!ASN1_parse_dump(out, buf_out, buf_outlen, 1, -1))
                    ^
316.               ERR_print_errors(bio_err);
317.       } else if (hexdump)

crypto/asn1/asn1_par.c:112:1: Parameter `*pp`
  110.   }
  111.   
  112. > int ASN1_parse_dump(BIO *bp, const unsigned char *pp, long len, int indent,
  113.                       int dump)
  114.   {

crypto/asn1/asn1_par.c:115:13: Call
  113.                       int dump)
  114.   {
  115.       return (asn1_parse2(bp, &pp, len, 0, 0, indent, dump));
                     ^
  116.   }
  117.   

crypto/asn1/asn1_par.c:118:1: Parameter `**pp`
    116.   }
    117.   
    118. > static int asn1_parse2(BIO *bp, const unsigned char **pp, long length,
    119.                          int offset, int depth, int indent, int dump)
    120.   {

crypto/asn1/asn1_par.c:136:5: Assignment
    134.   
    135.       dump_indent = 6;            /* Because we know BIO_dump_indent() */
    136.       p = *pp;
               ^
    137.       tot = p + length;
    138.       op = p - 1;

crypto/asn1/asn1_par.c:141:13: Call
    139.       while ((p < tot) && (op < p)) {
    140.           op = p;
    141.           j = ASN1_get_object(&p, &len, &tag, &xclass, length);
                       ^
    142.           if (j & 0x80) {
    143.               if (BIO_write(bp, "Error in encoding\n", 18) <= 0)

crypto/asn1/asn1_lib.c:92:1: Parameter `**pp`
      90.   }
      91.   
      92. > int ASN1_get_object(const unsigned char **pp, long *plength, int *ptag,
      93.                       int *pclass, long omax)
      94.   {

crypto/asn1/asn1_lib.c:97:5: Assignment
      95.       int i, ret;
      96.       long l;
      97.       const unsigned char *p = *pp;
                 ^
      98.       int tag, xclass, inf;
      99.       long max = omax;

crypto/asn1/asn1_lib.c:126:9: Assignment
      124.       } else {
      125.           tag = i;
      126.           p++;
                     ^
      127.           if (--max == 0)
      128.               goto err;

crypto/asn1/asn1_lib.c:132:10: Call
      130.       *ptag = tag;
      131.       *pclass = xclass;
      132.       if (!asn1_get_length(&p, &inf, plength, (int)max))
                      ^
      133.           goto err;
      134.   

crypto/asn1/asn1_lib.c:153:1: <Length trace>
151.   }
152.   
153. > static int asn1_get_length(const unsigned char **pp, int *inf, long *rl,
154.                              int max)
155.   {

crypto/asn1/asn1_lib.c:153:1: Parameter `**pp`
        151.   }
        152.   
        153. > static int asn1_get_length(const unsigned char **pp, int *inf, long *rl,
        154.                              int max)
        155.   {

crypto/asn1/asn1_lib.c:156:5: Assignment
        154.                              int max)
        155.   {
        156.       const unsigned char *p = *pp;
                   ^
        157.       unsigned long ret = 0;
        158.       unsigned int i;

crypto/asn1/asn1_lib.c:169:15: Assignment
        167.           *inf = 0;
        168.           i = *p & 0x7f;
        169.           if (*(p++) & 0x80) {
                             ^
        170.               if (max < (int)i)
        171.                   return 0;

crypto/asn1/asn1_lib.c:173:25: Array access: Offset: [2, +oo] Size: [1, +oo] by call to `ASN1_parse_dump` 
        171.                   return 0;
        172.               /* Skip leading zeroes */
        173.               while (i && *p == 0) {
                                       ^
        174.                   p++;
        175.                   i--;

static int asn1_get_length(const unsigned char **pp, int *inf, long *rl,
                           int max)
{
    const unsigned char *p = *pp;
    unsigned long ret = 0;
    unsigned int i;
    if (max-- < 1)
        return (0);
    if (*p == 0x80) {
        *inf = 1;
        ret = 0;
        p++;
    } else {
        *inf = 0;
        i = *p & 0x7f;
        if (*(p++) & 0x80) {
            if (max < (int)i)
                return 0;
            while (i && *p == 0) {
                p++;
                i--;
            }
            if (i > sizeof(long))
                return 0;
            while (i-- > 0) {
                ret <<= 8L;
                ret |= *(p++);
            }
        } else
            ret = i;
    }
    if (ret > LONG_MAX)
        return 0;
    *pp = p;
    *rl = (long)ret;
    return (1);
}
['int pkeyutl_main(int argc, char **argv)\n{\n    BIO *in = NULL, *out = NULL;\n    ENGINE *e = NULL;\n    EVP_PKEY_CTX *ctx = NULL;\n    char *infile = NULL, *outfile = NULL, *sigfile = NULL, *passinarg = NULL;\n    char hexdump = 0, asn1parse = 0, rev = 0, *prog;\n    unsigned char *buf_in = NULL, *buf_out = NULL, *sig = NULL;\n    OPTION_CHOICE o;\n    int buf_inlen = 0, siglen = -1, keyform = FORMAT_PEM, peerform =\n        FORMAT_PEM;\n    int keysize = -1, pkey_op = EVP_PKEY_OP_SIGN, key_type = KEY_PRIVKEY;\n    int ret = 1, rv = -1;\n    size_t buf_outlen;\n    prog = opt_init(argc, argv, pkeyutl_options);\n    while ((o = opt_next()) != OPT_EOF) {\n        switch (o) {\n        case OPT_EOF:\n        case OPT_ERR:\n opthelp:\n            BIO_printf(bio_err, "%s: Use -help for summary.\\n", prog);\n            goto end;\n        case OPT_HELP:\n            opt_help(pkeyutl_options);\n            ret = 0;\n            goto end;\n        case OPT_IN:\n            infile = opt_arg();\n            break;\n        case OPT_OUT:\n            outfile = opt_arg();\n            break;\n        case OPT_SIGFILE:\n            sigfile = opt_arg();\n            break;\n        case OPT_INKEY:\n            ctx = init_ctx(&keysize, opt_arg(), keyform, key_type,\n                           passinarg, pkey_op, e);\n            if (ctx == NULL) {\n                BIO_puts(bio_err, "%s: Error initializing context\\n");\n                ERR_print_errors(bio_err);\n                goto opthelp;\n            }\n            break;\n        case OPT_PEERKEY:\n            if (!setup_peer(ctx, peerform, opt_arg()))\n                goto opthelp;\n            break;\n        case OPT_PASSIN:\n            passinarg = opt_arg();\n            break;\n        case OPT_PEERFORM:\n            if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &peerform))\n                goto opthelp;\n            break;\n        case OPT_KEYFORM:\n            if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &keyform))\n                goto opthelp;\n            break;\n        case OPT_ENGINE:\n            e = setup_engine(opt_arg(), 0);\n            break;\n        case OPT_PUBIN:\n            key_type = KEY_PUBKEY;\n            break;\n        case OPT_CERTIN:\n            key_type = KEY_CERT;\n            break;\n        case OPT_ASN1PARSE:\n            asn1parse = 1;\n            break;\n        case OPT_HEXDUMP:\n            hexdump = 1;\n            break;\n        case OPT_SIGN:\n            pkey_op = EVP_PKEY_OP_SIGN;\n            break;\n        case OPT_VERIFY:\n            pkey_op = EVP_PKEY_OP_VERIFY;\n            break;\n        case OPT_VERIFYRECOVER:\n            pkey_op = EVP_PKEY_OP_VERIFYRECOVER;\n            break;\n        case OPT_REV:\n            rev = 1;\n            break;\n        case OPT_ENCRYPT:\n            pkey_op = EVP_PKEY_OP_ENCRYPT;\n            break;\n        case OPT_DECRYPT:\n            pkey_op = EVP_PKEY_OP_DECRYPT;\n            break;\n        case OPT_DERIVE:\n            pkey_op = EVP_PKEY_OP_DERIVE;\n            break;\n        case OPT_PKEYOPT:\n            if (ctx == NULL) {\n                BIO_printf(bio_err,\n                           "%s: Must have -inkey before -pkeyopt\\n", prog);\n                goto opthelp;\n            }\n            if (pkey_ctrl_string(ctx, opt_arg()) <= 0) {\n                BIO_printf(bio_err, "%s: Can\'t set parameter:\\n", prog);\n                ERR_print_errors(bio_err);\n                goto end;\n            }\n            break;\n        }\n    }\n    argc = opt_num_rest();\n    argv = opt_rest();\n    if (ctx == NULL)\n        goto opthelp;\n    if (sigfile && (pkey_op != EVP_PKEY_OP_VERIFY)) {\n        BIO_printf(bio_err,\n                   "%s: Signature file specified for non verify\\n", prog);\n        goto end;\n    }\n    if (!sigfile && (pkey_op == EVP_PKEY_OP_VERIFY)) {\n        BIO_printf(bio_err,\n                   "%s: No signature file specified for verify\\n", prog);\n        goto end;\n    }\n    app_RAND_load_file(NULL, 0);\n    if (pkey_op != EVP_PKEY_OP_DERIVE) {\n        in = bio_open_default(infile, \'r\', FORMAT_BINARY);\n        if (in == NULL)\n            goto end;\n    }\n    out = bio_open_default(outfile, \'w\', FORMAT_BINARY);\n    if (out == NULL)\n        goto end;\n    if (sigfile) {\n        BIO *sigbio = BIO_new_file(sigfile, "rb");\n        if (!sigbio) {\n            BIO_printf(bio_err, "Can\'t open signature file %s\\n", sigfile);\n            goto end;\n        }\n        siglen = bio_to_mem(&sig, keysize * 10, sigbio);\n        BIO_free(sigbio);\n        if (siglen <= 0) {\n            BIO_printf(bio_err, "Error reading signature data\\n");\n            goto end;\n        }\n    }\n    if (in) {\n        buf_inlen = bio_to_mem(&buf_in, keysize * 10, in);\n        if (buf_inlen <= 0) {\n            BIO_printf(bio_err, "Error reading input Data\\n");\n            exit(1);\n        }\n        if (rev) {\n            size_t i;\n            unsigned char ctmp;\n            size_t l = (size_t)buf_inlen;\n            for (i = 0; i < l / 2; i++) {\n                ctmp = buf_in[i];\n                buf_in[i] = buf_in[l - 1 - i];\n                buf_in[l - 1 - i] = ctmp;\n            }\n        }\n    }\n    if (pkey_op == EVP_PKEY_OP_VERIFY) {\n        rv = EVP_PKEY_verify(ctx, sig, (size_t)siglen,\n                             buf_in, (size_t)buf_inlen);\n        if (rv == 1) {\n            BIO_puts(out, "Signature Verified Successfully\\n");\n            ret = 0;\n        } else\n            BIO_puts(out, "Signature Verification Failure\\n");\n        goto end;\n    }\n    rv = do_keyop(ctx, pkey_op, NULL, (size_t *)&buf_outlen,\n                  buf_in, (size_t)buf_inlen);\n    if (rv > 0) {\n        buf_out = app_malloc(buf_outlen, "buffer output");\n        rv = do_keyop(ctx, pkey_op,\n                      buf_out, (size_t *)&buf_outlen,\n                      buf_in, (size_t)buf_inlen);\n    }\n    if (rv <= 0) {\n        ERR_print_errors(bio_err);\n        goto end;\n    }\n    ret = 0;\n    if (asn1parse) {\n        if (!ASN1_parse_dump(out, buf_out, buf_outlen, 1, -1))\n            ERR_print_errors(bio_err);\n    } else if (hexdump)\n        BIO_dump(out, (char *)buf_out, buf_outlen);\n    else\n        BIO_write(out, buf_out, buf_outlen);\n end:\n    EVP_PKEY_CTX_free(ctx);\n    BIO_free(in);\n    BIO_free_all(out);\n    OPENSSL_free(buf_in);\n    OPENSSL_free(buf_out);\n    OPENSSL_free(sig);\n    return ret;\n}', 'int ASN1_parse_dump(BIO *bp, const unsigned char *pp, long len, int indent,\n                    int dump)\n{\n    return (asn1_parse2(bp, &pp, len, 0, 0, indent, dump));\n}', 'static int asn1_parse2(BIO *bp, const unsigned char **pp, long length,\n                       int offset, int depth, int indent, int dump)\n{\n    const unsigned char *p, *ep, *tot, *op, *opp;\n    long len;\n    int tag, xclass, ret = 0;\n    int nl, hl, j, r;\n    ASN1_OBJECT *o = NULL;\n    ASN1_OCTET_STRING *os = NULL;\n    int dump_indent;\n    if (depth > ASN1_PARSE_MAXDEPTH) {\n            BIO_puts(bp, "BAD RECURSION DEPTH\\n");\n            return 0;\n    }\n    dump_indent = 6;\n    p = *pp;\n    tot = p + length;\n    op = p - 1;\n    while ((p < tot) && (op < p)) {\n        op = p;\n        j = ASN1_get_object(&p, &len, &tag, &xclass, length);\n        if (j & 0x80) {\n            if (BIO_write(bp, "Error in encoding\\n", 18) <= 0)\n                goto end;\n            ret = 0;\n            goto end;\n        }\n        hl = (p - op);\n        length -= hl;\n        if (BIO_printf(bp, "%5ld:", (long)offset + (long)(op - *pp))\n            <= 0)\n            goto end;\n        if (j != (V_ASN1_CONSTRUCTED | 1)) {\n            if (BIO_printf(bp, "d=%-2d hl=%ld l=%4ld ",\n                           depth, (long)hl, len) <= 0)\n                goto end;\n        } else {\n            if (BIO_printf(bp, "d=%-2d hl=%ld l=inf  ", depth, (long)hl) <= 0)\n                goto end;\n        }\n        if (!asn1_print_info(bp, tag, xclass, j, (indent) ? depth : 0))\n            goto end;\n        if (j & V_ASN1_CONSTRUCTED) {\n            ep = p + len;\n            if (BIO_write(bp, "\\n", 1) <= 0)\n                goto end;\n            if (len > length) {\n                BIO_printf(bp, "length is greater than %ld\\n", length);\n                ret = 0;\n                goto end;\n            }\n            if ((j == 0x21) && (len == 0)) {\n                for (;;) {\n                    r = asn1_parse2(bp, &p, (long)(tot - p),\n                                    offset + (p - *pp), depth + 1,\n                                    indent, dump);\n                    if (r == 0) {\n                        ret = 0;\n                        goto end;\n                    }\n                    if ((r == 2) || (p >= tot))\n                        break;\n                }\n            } else\n                while (p < ep) {\n                    r = asn1_parse2(bp, &p, (long)len,\n                                    offset + (p - *pp), depth + 1,\n                                    indent, dump);\n                    if (r == 0) {\n                        ret = 0;\n                        goto end;\n                    }\n                }\n        } else if (xclass != 0) {\n            p += len;\n            if (BIO_write(bp, "\\n", 1) <= 0)\n                goto end;\n        } else {\n            nl = 0;\n            if ((tag == V_ASN1_PRINTABLESTRING) ||\n                (tag == V_ASN1_T61STRING) ||\n                (tag == V_ASN1_IA5STRING) ||\n                (tag == V_ASN1_VISIBLESTRING) ||\n                (tag == V_ASN1_NUMERICSTRING) ||\n                (tag == V_ASN1_UTF8STRING) ||\n                (tag == V_ASN1_UTCTIME) || (tag == V_ASN1_GENERALIZEDTIME)) {\n                if (BIO_write(bp, ":", 1) <= 0)\n                    goto end;\n                if ((len > 0) && BIO_write(bp, (const char *)p, (int)len)\n                    != (int)len)\n                    goto end;\n            } else if (tag == V_ASN1_OBJECT) {\n                opp = op;\n                if (d2i_ASN1_OBJECT(&o, &opp, len + hl) != NULL) {\n                    if (BIO_write(bp, ":", 1) <= 0)\n                        goto end;\n                    i2a_ASN1_OBJECT(bp, o);\n                } else {\n                    if (BIO_write(bp, ":BAD OBJECT", 11) <= 0)\n                        goto end;\n                }\n            } else if (tag == V_ASN1_BOOLEAN) {\n                if (len != 1) {\n                    if (BIO_write(bp, "Bad boolean\\n", 12) <= 0)\n                        goto end;\n                }\n                BIO_printf(bp, ":%u", p[0]);\n            } else if (tag == V_ASN1_BMPSTRING) {\n            } else if (tag == V_ASN1_OCTET_STRING) {\n                int i, printable = 1;\n                opp = op;\n                os = d2i_ASN1_OCTET_STRING(NULL, &opp, len + hl);\n                if (os != NULL && os->length > 0) {\n                    opp = os->data;\n                    for (i = 0; i < os->length; i++) {\n                        if (((opp[i] < \' \') &&\n                             (opp[i] != \'\\n\') &&\n                             (opp[i] != \'\\r\') &&\n                             (opp[i] != \'\\t\')) || (opp[i] > \'~\')) {\n                            printable = 0;\n                            break;\n                        }\n                    }\n                    if (printable)\n                    {\n                        if (BIO_write(bp, ":", 1) <= 0)\n                            goto end;\n                        if (BIO_write(bp, (const char *)opp, os->length) <= 0)\n                            goto end;\n                    } else if (!dump)\n                    {\n                        if (BIO_write(bp, "[HEX DUMP]:", 11) <= 0)\n                            goto end;\n                        for (i = 0; i < os->length; i++) {\n                            if (BIO_printf(bp, "%02X", opp[i]) <= 0)\n                                goto end;\n                        }\n                    } else\n                    {\n                        if (!nl) {\n                            if (BIO_write(bp, "\\n", 1) <= 0)\n                                goto end;\n                        }\n                        if (BIO_dump_indent(bp,\n                                            (const char *)opp,\n                                            ((dump == -1 || dump >\n                                              os->\n                                              length) ? os->length : dump),\n                                            dump_indent) <= 0)\n                            goto end;\n                        nl = 1;\n                    }\n                }\n                ASN1_OCTET_STRING_free(os);\n                os = NULL;\n            } else if (tag == V_ASN1_INTEGER) {\n                ASN1_INTEGER *bs;\n                int i;\n                opp = op;\n                bs = d2i_ASN1_INTEGER(NULL, &opp, len + hl);\n                if (bs != NULL) {\n                    if (BIO_write(bp, ":", 1) <= 0)\n                        goto end;\n                    if (bs->type == V_ASN1_NEG_INTEGER)\n                        if (BIO_write(bp, "-", 1) <= 0)\n                            goto end;\n                    for (i = 0; i < bs->length; i++) {\n                        if (BIO_printf(bp, "%02X", bs->data[i]) <= 0)\n                            goto end;\n                    }\n                    if (bs->length == 0) {\n                        if (BIO_write(bp, "00", 2) <= 0)\n                            goto end;\n                    }\n                } else {\n                    if (BIO_write(bp, "BAD INTEGER", 11) <= 0)\n                        goto end;\n                }\n                ASN1_INTEGER_free(bs);\n            } else if (tag == V_ASN1_ENUMERATED) {\n                ASN1_ENUMERATED *bs;\n                int i;\n                opp = op;\n                bs = d2i_ASN1_ENUMERATED(NULL, &opp, len + hl);\n                if (bs != NULL) {\n                    if (BIO_write(bp, ":", 1) <= 0)\n                        goto end;\n                    if (bs->type == V_ASN1_NEG_ENUMERATED)\n                        if (BIO_write(bp, "-", 1) <= 0)\n                            goto end;\n                    for (i = 0; i < bs->length; i++) {\n                        if (BIO_printf(bp, "%02X", bs->data[i]) <= 0)\n                            goto end;\n                    }\n                    if (bs->length == 0) {\n                        if (BIO_write(bp, "00", 2) <= 0)\n                            goto end;\n                    }\n                } else {\n                    if (BIO_write(bp, "BAD ENUMERATED", 14) <= 0)\n                        goto end;\n                }\n                ASN1_ENUMERATED_free(bs);\n            } else if (len > 0 && dump) {\n                if (!nl) {\n                    if (BIO_write(bp, "\\n", 1) <= 0)\n                        goto end;\n                }\n                if (BIO_dump_indent(bp, (const char *)p,\n                                    ((dump == -1 || dump > len) ? len : dump),\n                                    dump_indent) <= 0)\n                    goto end;\n                nl = 1;\n            }\n            if (!nl) {\n                if (BIO_write(bp, "\\n", 1) <= 0)\n                    goto end;\n            }\n            p += len;\n            if ((tag == V_ASN1_EOC) && (xclass == 0)) {\n                ret = 2;\n                goto end;\n            }\n        }\n        length -= len;\n    }\n    ret = 1;\n end:\n    ASN1_OBJECT_free(o);\n    ASN1_OCTET_STRING_free(os);\n    *pp = p;\n    return (ret);\n}', 'int ASN1_get_object(const unsigned char **pp, long *plength, int *ptag,\n                    int *pclass, long omax)\n{\n    int i, ret;\n    long l;\n    const unsigned char *p = *pp;\n    int tag, xclass, inf;\n    long max = omax;\n    if (!max)\n        goto err;\n    ret = (*p & V_ASN1_CONSTRUCTED);\n    xclass = (*p & V_ASN1_PRIVATE);\n    i = *p & V_ASN1_PRIMITIVE_TAG;\n    if (i == V_ASN1_PRIMITIVE_TAG) {\n        p++;\n        if (--max == 0)\n            goto err;\n        l = 0;\n        while (*p & 0x80) {\n            l <<= 7L;\n            l |= *(p++) & 0x7f;\n            if (--max == 0)\n                goto err;\n            if (l > (INT_MAX >> 7L))\n                goto err;\n        }\n        l <<= 7L;\n        l |= *(p++) & 0x7f;\n        tag = (int)l;\n        if (--max == 0)\n            goto err;\n    } else {\n        tag = i;\n        p++;\n        if (--max == 0)\n            goto err;\n    }\n    *ptag = tag;\n    *pclass = xclass;\n    if (!asn1_get_length(&p, &inf, plength, (int)max))\n        goto err;\n    if (inf && !(ret & V_ASN1_CONSTRUCTED))\n        goto err;\n    if (*plength > (omax - (p - *pp))) {\n        ASN1err(ASN1_F_ASN1_GET_OBJECT, ASN1_R_TOO_LONG);\n        ret |= 0x80;\n    }\n    *pp = p;\n    return (ret | inf);\n err:\n    ASN1err(ASN1_F_ASN1_GET_OBJECT, ASN1_R_HEADER_TOO_LONG);\n    return (0x80);\n}', 'static int asn1_get_length(const unsigned char **pp, int *inf, long *rl,\n                           int max)\n{\n    const unsigned char *p = *pp;\n    unsigned long ret = 0;\n    unsigned int i;\n    if (max-- < 1)\n        return (0);\n    if (*p == 0x80) {\n        *inf = 1;\n        ret = 0;\n        p++;\n    } else {\n        *inf = 0;\n        i = *p & 0x7f;\n        if (*(p++) & 0x80) {\n            if (max < (int)i)\n                return 0;\n            while (i && *p == 0) {\n                p++;\n                i--;\n            }\n            if (i > sizeof(long))\n                return 0;\n            while (i-- > 0) {\n                ret <<= 8L;\n                ret |= *(p++);\n            }\n        } else\n            ret = i;\n    }\n    if (ret > LONG_MAX)\n        return 0;\n    *pp = p;\n    *rl = (long)ret;\n    return (1);\n}']