crypto/pkcs7/example.c:262: error: BUFFER_OVERRUN_L3
  Offset: [4, +oo] (⇐ [4, +oo] + [0, +oo]) Size: [2, +oo] by call to `i2d_ASN1_OCTET_STRING`.
Showing all 51 steps of the trace


crypto/pkcs7/example.c:252:6: Call
250.   
251.   	os1=ASN1_OCTET_STRING_new();
252.   	os2=ASN1_OCTET_STRING_new();
            ^
253.   	ASN1_OCTET_STRING_set(os1,(unsigned char*)str1,strlen(str1));
254.   	ASN1_OCTET_STRING_set(os2,(unsigned char*)str1,strlen(str1));

crypto/asn1/a_octet.c:64:10: Call
  62.   
  63.   ASN1_OCTET_STRING *ASN1_OCTET_STRING_new(void)
  64.   { return M_ASN1_OCTET_STRING_new(); }
                 ^
  65.   
  66.   void ASN1_OCTET_STRING_free(ASN1_OCTET_STRING *x)

crypto/asn1/asn1_lib.c:374:2: Assignment
    372.   		return(NULL);
    373.   		}
    374.   	ret->length=0;
            ^
    375.   	ret->type=type;
    376.   	ret->data=NULL;

crypto/pkcs7/example.c:253:2: Call
251.   	os1=ASN1_OCTET_STRING_new();
252.   	os2=ASN1_OCTET_STRING_new();
253.   	ASN1_OCTET_STRING_set(os1,(unsigned char*)str1,strlen(str1));
        ^
254.   	ASN1_OCTET_STRING_set(os2,(unsigned char*)str1,strlen(str1));
255.   	i =i2d_ASN1_OCTET_STRING(os1,NULL);

crypto/asn1/a_octet.c:75:1: Parameter `x->length`
  73.   { return M_ASN1_OCTET_STRING_cmp(a, b); }
  74.   
  75. > int ASN1_OCTET_STRING_set(ASN1_OCTET_STRING *x, unsigned char *d, int len)
  76.   { return M_ASN1_OCTET_STRING_set(x, d, len); }
  77.   

crypto/asn1/a_octet.c:76:10: Call
  74.   
  75.   int ASN1_OCTET_STRING_set(ASN1_OCTET_STRING *x, unsigned char *d, int len)
  76.   { return M_ASN1_OCTET_STRING_set(x, d, len); }
                 ^
  77.   
  78.   int i2d_ASN1_OCTET_STRING(ASN1_OCTET_STRING *a, unsigned char **pp)

crypto/asn1/asn1_lib.c:322:1: Parameter `len`
    320.   	}
    321.   
    322. > int ASN1_STRING_set(ASN1_STRING *str, const void *_data, int len)
    323.   	{
    324.   	unsigned char *c;

crypto/pkcs7/example.c:254:2: Call
252.   	os2=ASN1_OCTET_STRING_new();
253.   	ASN1_OCTET_STRING_set(os1,(unsigned char*)str1,strlen(str1));
254.   	ASN1_OCTET_STRING_set(os2,(unsigned char*)str1,strlen(str1));
        ^
255.   	i =i2d_ASN1_OCTET_STRING(os1,NULL);
256.   	i+=i2d_ASN1_OCTET_STRING(os2,NULL);

crypto/asn1/a_octet.c:75:1: Parameter `x->length`
  73.   { return M_ASN1_OCTET_STRING_cmp(a, b); }
  74.   
  75. > int ASN1_OCTET_STRING_set(ASN1_OCTET_STRING *x, unsigned char *d, int len)
  76.   { return M_ASN1_OCTET_STRING_set(x, d, len); }
  77.   

crypto/asn1/a_octet.c:76:10: Call
  74.   
  75.   int ASN1_OCTET_STRING_set(ASN1_OCTET_STRING *x, unsigned char *d, int len)
  76.   { return M_ASN1_OCTET_STRING_set(x, d, len); }
                 ^
  77.   
  78.   int i2d_ASN1_OCTET_STRING(ASN1_OCTET_STRING *a, unsigned char **pp)

crypto/asn1/asn1_lib.c:322:1: Parameter `len`
    320.   	}
    321.   
    322. > int ASN1_STRING_set(ASN1_STRING *str, const void *_data, int len)
    323.   	{
    324.   	unsigned char *c;

crypto/pkcs7/example.c:256:5: Call
254.   	ASN1_OCTET_STRING_set(os2,(unsigned char*)str1,strlen(str1));
255.   	i =i2d_ASN1_OCTET_STRING(os1,NULL);
256.   	i+=i2d_ASN1_OCTET_STRING(os2,NULL);
           ^
257.   	total=ASN1_object_size(1,i,V_ASN1_SEQUENCE);
258.   

crypto/asn1/a_octet.c:78:1: Parameter `a->length`
  76.   { return M_ASN1_OCTET_STRING_set(x, d, len); }
  77.   
  78. > int i2d_ASN1_OCTET_STRING(ASN1_OCTET_STRING *a, unsigned char **pp)
  79.   { return M_i2d_ASN1_OCTET_STRING(a, pp); }
  80.   

crypto/asn1/a_octet.c:79:10: Call
  77.   
  78.   int i2d_ASN1_OCTET_STRING(ASN1_OCTET_STRING *a, unsigned char **pp)
  79.   { return M_i2d_ASN1_OCTET_STRING(a, pp); }
                 ^
  80.   
  81.   ASN1_OCTET_STRING *d2i_ASN1_OCTET_STRING(ASN1_OCTET_STRING **a,

crypto/asn1/a_bytes.c:146:18: Assignment
    144.   	unsigned char *p;
    145.   
    146.   	if (a == NULL)  return(0);
                            ^
    147.   
    148.   	if (tag == V_ASN1_BIT_STRING)

crypto/asn1/a_octet.c:79:3: Assignment
  77.   
  78.   int i2d_ASN1_OCTET_STRING(ASN1_OCTET_STRING *a, unsigned char **pp)
  79.   { return M_i2d_ASN1_OCTET_STRING(a, pp); }
          ^
  80.   
  81.   ASN1_OCTET_STRING *d2i_ASN1_OCTET_STRING(ASN1_OCTET_STRING **a,

crypto/pkcs7/example.c:256:2: Assignment
254.   	ASN1_OCTET_STRING_set(os2,(unsigned char*)str1,strlen(str1));
255.   	i =i2d_ASN1_OCTET_STRING(os1,NULL);
256.   	i+=i2d_ASN1_OCTET_STRING(os2,NULL);
        ^
257.   	total=ASN1_object_size(1,i,V_ASN1_SEQUENCE);
258.   

crypto/pkcs7/example.c:257:8: Call
255.   	i =i2d_ASN1_OCTET_STRING(os1,NULL);
256.   	i+=i2d_ASN1_OCTET_STRING(os2,NULL);
257.   	total=ASN1_object_size(1,i,V_ASN1_SEQUENCE);
              ^
258.   
259.   	data=malloc(total);

crypto/asn1/asn1_lib.c:230:1: Parameter `length`
  228.   	}
  229.   
  230. > int ASN1_object_size(int constructed, int length, int tag)
  231.   	{
  232.   	int ret;

crypto/asn1/asn1_lib.c:234:2: Assignment
  232.   	int ret;
  233.   
  234.   	ret=length;
          ^
  235.   	ret++;
  236.   	if (tag >= 31)

crypto/asn1/asn1_lib.c:235:2: Assignment
  233.   
  234.   	ret=length;
  235.   	ret++;
          ^
  236.   	if (tag >= 31)
  237.   		{

crypto/asn1/asn1_lib.c:246:2: Assignment
  244.   	if ((length == 0) && (constructed == 2))
  245.   		ret+=2;
  246.   	ret++;
          ^
  247.   	if (length > 127)
  248.   		{

crypto/asn1/asn1_lib.c:255:2: Assignment
  253.   			}
  254.   		}
  255.   	return(ret);
          ^
  256.   	}
  257.   

crypto/pkcs7/example.c:257:2: Assignment
255.   	i =i2d_ASN1_OCTET_STRING(os1,NULL);
256.   	i+=i2d_ASN1_OCTET_STRING(os2,NULL);
257.   	total=ASN1_object_size(1,i,V_ASN1_SEQUENCE);
        ^
258.   
259.   	data=malloc(total);

crypto/pkcs7/example.c:259:7: Array declaration
257.   	total=ASN1_object_size(1,i,V_ASN1_SEQUENCE);
258.   
259.   	data=malloc(total);
             ^
260.   	p=data;
261.   	ASN1_put_object(&p,1,i,V_ASN1_SEQUENCE,V_ASN1_UNIVERSAL);

crypto/pkcs7/example.c:259:2: Assignment
257.   	total=ASN1_object_size(1,i,V_ASN1_SEQUENCE);
258.   
259.   	data=malloc(total);
        ^
260.   	p=data;
261.   	ASN1_put_object(&p,1,i,V_ASN1_SEQUENCE,V_ASN1_UNIVERSAL);

crypto/pkcs7/example.c:260:2: Assignment
258.   
259.   	data=malloc(total);
260.   	p=data;
        ^
261.   	ASN1_put_object(&p,1,i,V_ASN1_SEQUENCE,V_ASN1_UNIVERSAL);
262.   	i2d_ASN1_OCTET_STRING(os1,&p);

crypto/pkcs7/example.c:261:2: Call
259.   	data=malloc(total);
260.   	p=data;
261.   	ASN1_put_object(&p,1,i,V_ASN1_SEQUENCE,V_ASN1_UNIVERSAL);
        ^
262.   	i2d_ASN1_OCTET_STRING(os1,&p);
263.   	i2d_ASN1_OCTET_STRING(os2,&p);

crypto/asn1/asn1_lib.c:180:1: Parameter `**pp`
  178.   /* class 0 is constructed
  179.    * constructed == 2 for indefinitle length constructed */
  180. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
  181.   	     int xclass)
  182.   	{

crypto/asn1/asn1_lib.c:183:2: Assignment
  181.   	     int xclass)
  182.   	{
  183.   	unsigned char *p= *pp;
          ^
  184.   	int i;
  185.   

crypto/asn1/asn1_lib.c:189:5: Assignment
  187.   	i|=(xclass&V_ASN1_PRIVATE);
  188.   	if (tag < 31)
  189.   		*(p++)=i|(tag&V_ASN1_PRIMITIVE_TAG);
             ^
  190.   	else
  191.   		{

crypto/asn1/asn1_lib.c:201:5: Assignment
  199.   		}
  200.   	if ((constructed == 2) && (length == 0))
  201.   		*(p++)=0x80; /* der_put_length would output 0 instead */
             ^
  202.   	else
  203.   		asn1_put_length(&p,length);

crypto/asn1/asn1_lib.c:204:2: Assignment
  202.   	else
  203.   		asn1_put_length(&p,length);
  204.   	*pp=p;
          ^
  205.   	}
  206.   

crypto/pkcs7/example.c:262:2: Call
260.   	p=data;
261.   	ASN1_put_object(&p,1,i,V_ASN1_SEQUENCE,V_ASN1_UNIVERSAL);
262.   	i2d_ASN1_OCTET_STRING(os1,&p);
        ^
263.   	i2d_ASN1_OCTET_STRING(os2,&p);
264.   

crypto/asn1/a_octet.c:78:1: Parameter `**pp`
  76.   { return M_ASN1_OCTET_STRING_set(x, d, len); }
  77.   
  78. > int i2d_ASN1_OCTET_STRING(ASN1_OCTET_STRING *a, unsigned char **pp)
  79.   { return M_i2d_ASN1_OCTET_STRING(a, pp); }
  80.   

crypto/asn1/a_octet.c:79:10: Call
  77.   
  78.   int i2d_ASN1_OCTET_STRING(ASN1_OCTET_STRING *a, unsigned char **pp)
  79.   { return M_i2d_ASN1_OCTET_STRING(a, pp); }
                 ^
  80.   
  81.   ASN1_OCTET_STRING *d2i_ASN1_OCTET_STRING(ASN1_OCTET_STRING **a,

crypto/asn1/a_bytes.c:141:1: Parameter `**pp`
    139.   	}
    140.   
    141. > int i2d_ASN1_bytes(ASN1_STRING *a, unsigned char **pp, int tag, int xclass)
    142.   	{
    143.   	int ret,r,constructed;

crypto/asn1/a_bytes.c:154:2: Assignment
    152.   	r=ASN1_object_size(0,ret,tag);
    153.   	if (pp == NULL) return(r);
    154.   	p= *pp;
            ^
    155.   
    156.   	if ((tag == V_ASN1_SEQUENCE) || (tag == V_ASN1_SET))

crypto/asn1/a_bytes.c:160:2: Call
    158.   	else
    159.   		constructed=0;
    160.   	ASN1_put_object(&p,constructed,ret,tag,xclass);
            ^
    161.   	memcpy(p,a->data,a->length);
    162.   	p+=a->length;

crypto/asn1/asn1_lib.c:180:1: Parameter `**pp`
      178.   /* class 0 is constructed
      179.    * constructed == 2 for indefinitle length constructed */
      180. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
      181.   	     int xclass)
      182.   	{

crypto/asn1/asn1_lib.c:183:2: Assignment
      181.   	     int xclass)
      182.   	{
      183.   	unsigned char *p= *pp;
              ^
      184.   	int i;
      185.   

crypto/asn1/asn1_lib.c:189:5: Assignment
      187.   	i|=(xclass&V_ASN1_PRIVATE);
      188.   	if (tag < 31)
      189.   		*(p++)=i|(tag&V_ASN1_PRIMITIVE_TAG);
                 ^
      190.   	else
      191.   		{

crypto/asn1/asn1_lib.c:203:3: Call
      201.   		*(p++)=0x80; /* der_put_length would output 0 instead */
      202.   	else
      203.   		asn1_put_length(&p,length);
               ^
      204.   	*pp=p;
      205.   	}

crypto/asn1/asn1_lib.c:216:8: <Offset trace>
214.   		{
215.   		l=length;
216.   		for (i=0; l > 0; i++)
              ^
217.   			l>>=8;
218.   		*(p++)=i|0x80;

crypto/asn1/asn1_lib.c:216:8: Assignment
        214.   		{
        215.   		l=length;
        216.   		for (i=0; l > 0; i++)
                      ^
        217.   			l>>=8;
        218.   		*(p++)=i|0x80;

crypto/asn1/asn1_lib.c:220:10: Assignment
        218.   		*(p++)=i|0x80;
        219.   		l=i;
        220.   		while (i-- > 0)
                        ^
        221.   			{
        222.   			p[i]=length&0xff;

crypto/asn1/asn1_lib.c:207:1: <Length trace>
205.   	}
206.   
207. > static void asn1_put_length(unsigned char **pp, int length)
208.   	{
209.   	unsigned char *p= *pp;

crypto/asn1/asn1_lib.c:207:1: Parameter `**pp`
        205.   	}
        206.   
        207. > static void asn1_put_length(unsigned char **pp, int length)
        208.   	{
        209.   	unsigned char *p= *pp;

crypto/asn1/asn1_lib.c:209:2: Assignment
        207.   static void asn1_put_length(unsigned char **pp, int length)
        208.   	{
        209.   	unsigned char *p= *pp;
                ^
        210.   	int i,l;
        211.   	if (length <= 127)

crypto/asn1/asn1_lib.c:218:5: Assignment
        216.   		for (i=0; l > 0; i++)
        217.   			l>>=8;
        218.   		*(p++)=i|0x80;
                   ^
        219.   		l=i;
        220.   		while (i-- > 0)

crypto/asn1/asn1_lib.c:222:4: Array access: Offset: [4, +oo] (⇐ [4, +oo] + [0, +oo]) Size: [2, +oo] by call to `i2d_ASN1_OCTET_STRING` 
        220.   		while (i-- > 0)
        221.   			{
        222.   			p[i]=length&0xff;
                  ^
        223.   			length>>=8;
        224.   			}

static void asn1_put_length(unsigned char **pp, int length)
	{
	unsigned char *p= *pp;
	int i,l;
	if (length <= 127)
		*(p++)=(unsigned char)length;
	else
		{
		l=length;
		for (i=0; l > 0; i++)
			l>>=8;
		*(p++)=i|0x80;
		l=i;
		while (i-- > 0)
			{
			p[i]=length&0xff;
			length>>=8;
			}
		p+=l;
		}
	*pp=p;
	}
['X509_ATTRIBUTE *add_seq2string(PKCS7_SIGNER_INFO *si, char *str1, char *str2)\n\t{\n\tunsigned char *p;\n\tASN1_OCTET_STRING *os1,*os2;\n\tASN1_STRING *seq;\n\tX509_ATTRIBUTE *ret;\n\tunsigned char *data;\n\tint i,total;\n\tif (signed_seq2string_nid == -1)\n\t\tsigned_seq2string_nid=\n\t\t\tOBJ_create("1.9.9999","OID_example","Our example OID");\n\tos1=ASN1_OCTET_STRING_new();\n\tos2=ASN1_OCTET_STRING_new();\n\tASN1_OCTET_STRING_set(os1,(unsigned char*)str1,strlen(str1));\n\tASN1_OCTET_STRING_set(os2,(unsigned char*)str1,strlen(str1));\n\ti =i2d_ASN1_OCTET_STRING(os1,NULL);\n\ti+=i2d_ASN1_OCTET_STRING(os2,NULL);\n\ttotal=ASN1_object_size(1,i,V_ASN1_SEQUENCE);\n\tdata=malloc(total);\n\tp=data;\n\tASN1_put_object(&p,1,i,V_ASN1_SEQUENCE,V_ASN1_UNIVERSAL);\n\ti2d_ASN1_OCTET_STRING(os1,&p);\n\ti2d_ASN1_OCTET_STRING(os2,&p);\n\tseq=ASN1_STRING_new();\n\tASN1_STRING_set(seq,data,total);\n\tfree(data);\n\tASN1_OCTET_STRING_free(os1);\n\tASN1_OCTET_STRING_free(os2);\n\tret=X509_ATTRIBUTE_create(signed_seq2string_nid,\n\t\tV_ASN1_SEQUENCE,(char *)seq);\n\treturn(ret);\n\t}', 'ASN1_OCTET_STRING *ASN1_OCTET_STRING_new(void)\n{ return M_ASN1_OCTET_STRING_new(); }', 'ASN1_STRING *ASN1_STRING_type_new(int type)\n\t{\n\tASN1_STRING *ret;\n\tret=(ASN1_STRING *)Malloc(sizeof(ASN1_STRING));\n\tif (ret == NULL)\n\t\t{\n\t\tASN1err(ASN1_F_ASN1_STRING_TYPE_NEW,ERR_R_MALLOC_FAILURE);\n\t\treturn(NULL);\n\t\t}\n\tret->length=0;\n\tret->type=type;\n\tret->data=NULL;\n\tret->flags=0;\n\treturn(ret);\n\t}', 'int ASN1_OCTET_STRING_set(ASN1_OCTET_STRING *x, unsigned char *d, int len)\n{ return M_ASN1_OCTET_STRING_set(x, d, len); }', "int ASN1_STRING_set(ASN1_STRING *str, const void *_data, int len)\n\t{\n\tunsigned char *c;\n\tconst char *data=_data;\n\tif (len < 0)\n\t\t{\n\t\tif (data == NULL)\n\t\t\treturn(0);\n\t\telse\n\t\t\tlen=strlen(data);\n\t\t}\n\tif ((str->length < len) || (str->data == NULL))\n\t\t{\n\t\tc=str->data;\n\t\tif (c == NULL)\n\t\t\tstr->data=Malloc(len+1);\n\t\telse\n\t\t\tstr->data=Realloc(c,len+1);\n\t\tif (str->data == NULL)\n\t\t\t{\n\t\t\tstr->data=c;\n\t\t\treturn(0);\n\t\t\t}\n\t\t}\n\tstr->length=len;\n\tif (data != NULL)\n\t\t{\n\t\tmemcpy(str->data,data,len);\n\t\tstr->data[len]='\\0';\n\t\t}\n\treturn(1);\n\t}", 'int i2d_ASN1_OCTET_STRING(ASN1_OCTET_STRING *a, unsigned char **pp)\n{ return M_i2d_ASN1_OCTET_STRING(a, pp); }', 'int i2d_ASN1_bytes(ASN1_STRING *a, unsigned char **pp, int tag, int xclass)\n\t{\n\tint ret,r,constructed;\n\tunsigned char *p;\n\tif (a == NULL)  return(0);\n\tif (tag == V_ASN1_BIT_STRING)\n\t\treturn(i2d_ASN1_BIT_STRING(a,pp));\n\tret=a->length;\n\tr=ASN1_object_size(0,ret,tag);\n\tif (pp == NULL) return(r);\n\tp= *pp;\n\tif ((tag == V_ASN1_SEQUENCE) || (tag == V_ASN1_SET))\n\t\tconstructed=1;\n\telse\n\t\tconstructed=0;\n\tASN1_put_object(&p,constructed,ret,tag,xclass);\n\tmemcpy(p,a->data,a->length);\n\tp+=a->length;\n\t*pp= p;\n\treturn(r);\n\t}', 'int ASN1_object_size(int constructed, int length, int tag)\n\t{\n\tint ret;\n\tret=length;\n\tret++;\n\tif (tag >= 31)\n\t\t{\n\t\twhile (tag > 0)\n\t\t\t{\n\t\t\ttag>>=7;\n\t\t\tret++;\n\t\t\t}\n\t\t}\n\tif ((length == 0) && (constructed == 2))\n\t\tret+=2;\n\tret++;\n\tif (length > 127)\n\t\t{\n\t\twhile (length > 0)\n\t\t\t{\n\t\t\tlength>>=8;\n\t\t\tret++;\n\t\t\t}\n\t\t}\n\treturn(ret);\n\t}', 'void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,\n\t     int xclass)\n\t{\n\tunsigned char *p= *pp;\n\tint i;\n\ti=(constructed)?V_ASN1_CONSTRUCTED:0;\n\ti|=(xclass&V_ASN1_PRIVATE);\n\tif (tag < 31)\n\t\t*(p++)=i|(tag&V_ASN1_PRIMITIVE_TAG);\n\telse\n\t\t{\n\t\t*(p++)=i|V_ASN1_PRIMITIVE_TAG;\n\t\twhile (tag > 0x7f)\n\t\t\t{\n\t\t\t*(p++)=(tag&0x7f)|0x80;\n\t\t\ttag>>=7;\n\t\t\t}\n\t\t*(p++)=(tag&0x7f);\n\t\t}\n\tif ((constructed == 2) && (length == 0))\n\t\t*(p++)=0x80;\n\telse\n\t\tasn1_put_length(&p,length);\n\t*pp=p;\n\t}', 'static void asn1_put_length(unsigned char **pp, int length)\n\t{\n\tunsigned char *p= *pp;\n\tint i,l;\n\tif (length <= 127)\n\t\t*(p++)=(unsigned char)length;\n\telse\n\t\t{\n\t\tl=length;\n\t\tfor (i=0; l > 0; i++)\n\t\t\tl>>=8;\n\t\t*(p++)=i|0x80;\n\t\tl=i;\n\t\twhile (i-- > 0)\n\t\t\t{\n\t\t\tp[i]=length&0xff;\n\t\t\tlength>>=8;\n\t\t\t}\n\t\tp+=l;\n\t\t}\n\t*pp=p;\n\t}']