apps/ts.c:571: error: BUFFER_OVERRUN_L2
  Offset added: [-oo, 40] (⇐ [0, 20] + [-oo, 20]) Size: 20.
Showing all 6 steps of the trace


apps/ts.c:564:10: <Offset trace>
562.   
563.       /* Find the first non-zero byte and creating ASN1_INTEGER object. */
564.       for (i = 0; i < len && !buf[i]; ++i)
                ^
565.           continue;
566.       if ((nonce = ASN1_INTEGER_new()) == NULL)

apps/ts.c:564:10: Assignment
562.   
563.       /* Find the first non-zero byte and creating ASN1_INTEGER object. */
564.       for (i = 0; i < len && !buf[i]; ++i)
                ^
565.           continue;
566.       if ((nonce = ASN1_INTEGER_new()) == NULL)

apps/ts.c:569:5: Assignment
567.           goto err;
568.       OPENSSL_free(nonce->data);
569.       nonce->length = len - i;
           ^
570.       nonce->data = app_malloc(nonce->length + 1, "nonce buffer");
571.       memcpy(nonce->data, buf + i, nonce->length);

apps/ts.c:551:1: <Length trace>
549.   }
550.   
551. > static ASN1_INTEGER *create_nonce(int bits)
552.   {
553.       unsigned char buf[20];

apps/ts.c:551:1: Array declaration
549.   }
550.   
551. > static ASN1_INTEGER *create_nonce(int bits)
552.   {
553.       unsigned char buf[20];

apps/ts.c:571:5: Array access: Offset added: [-oo, 40] (⇐ [0, 20] + [-oo, 20]) Size: 20
569.       nonce->length = len - i;
570.       nonce->data = app_malloc(nonce->length + 1, "nonce buffer");
571.       memcpy(nonce->data, buf + i, nonce->length);
           ^
572.       return nonce;
573.   

static ASN1_INTEGER *create_nonce(int bits)
{
    unsigned char buf[20];
    ASN1_INTEGER *nonce = NULL;
    int len = (bits - 1) / 8 + 1;
    int i;
    if (len > (int)sizeof(buf))
        goto err;
    if (RAND_bytes(buf, len) <= 0)
        goto err;
    for (i = 0; i < len && !buf[i]; ++i)
        continue;
    if ((nonce = ASN1_INTEGER_new()) == NULL)
        goto err;
    OPENSSL_free(nonce->data);
    nonce->length = len - i;
    nonce->data = app_malloc(nonce->length + 1, "nonce buffer");
    memcpy(nonce->data, buf + i, nonce->length);
    return nonce;
 err:
    BIO_printf(bio_err, "could not create nonce\n");
    ASN1_INTEGER_free(nonce);
    return NULL;
}
['static ASN1_INTEGER *create_nonce(int bits)\n{\n    unsigned char buf[20];\n    ASN1_INTEGER *nonce = NULL;\n    int len = (bits - 1) / 8 + 1;\n    int i;\n    if (len > (int)sizeof(buf))\n        goto err;\n    if (RAND_bytes(buf, len) <= 0)\n        goto err;\n    for (i = 0; i < len && !buf[i]; ++i)\n        continue;\n    if ((nonce = ASN1_INTEGER_new()) == NULL)\n        goto err;\n    OPENSSL_free(nonce->data);\n    nonce->length = len - i;\n    nonce->data = app_malloc(nonce->length + 1, "nonce buffer");\n    memcpy(nonce->data, buf + i, nonce->length);\n    return nonce;\n err:\n    BIO_printf(bio_err, "could not create nonce\\n");\n    ASN1_INTEGER_free(nonce);\n    return NULL;\n}']