crypto/x509v3/v3_conf.c:278: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] Size: [1, +oo] by call to `X509V3_EXT_conf`.
Showing all 21 steps of the trace


crypto/x509v3/v3_conf.c:278:14: Call
276.   	for(i = 0; i < sk_num(nval); i++) {
277.   		val = (CONF_VALUE *)sk_value(nval, i);
278.   		if(!(ext = X509V3_EXT_conf(conf, ctx, val->name, val->value)))
                    ^
279.   								return 0;
280.   		if(crl) X509_CRL_add_ext(crl, ext, -1);

crypto/x509v3/v3_conf.c:97:8: Call
  95.   	if((ext_type = v3_check_generic(&value))) 
  96.   		return v3_generic_extension(name, value, crit, ext_type);
  97.   	ret = do_ext_conf(conf, ctx, OBJ_sn2nid(name), crit, value);
                ^
  98.   	if(!ret) {
  99.   		X509V3err(X509V3_F_X509V3_EXT_CONF,X509V3_R_ERROR_IN_EXTENSION);

crypto/x509v3/v3_conf.c:142:15: Call
    140.   	if(method->v2i) {
    141.   		if(*value == '@') nval = CONF_get_section(conf, value + 1);
    142.   		else nval = X509V3_parse_list(value);
                         ^
    143.   		if(!nval) {
    144.   			X509V3err(X509V3_F_X509V3_EXT_CONF,X509V3_R_INVALID_EXTENSION_STRING);

crypto/x509v3/v3_utl.c:238:12: Call
      236.   			} else if(c == ',') {
      237.   				*p = 0;
      238.   				ntmp = strip_spaces(q);
                        ^
      239.   				q = p + 1;
      240.   #ifdef DEBUG

crypto/x509v3/v3_utl.c:303:1: Parameter `name->strlen`
        301.   
        302.   /* Delete leading and trailing spaces from a string */
        303. > static char *strip_spaces(char *name)
        304.   {
        305.   	char *p, *q;

crypto/x509v3/v3_utl.c:247:5: Call
      245.   					goto err;
      246.   				}
      247.   				X509V3_add_value(ntmp, NULL, &values);
                 ^
      248.   			}
      249.   			break ;

crypto/x509v3/v3_utl.c:74:2: Assignment
        72.   {
        73.   	CONF_VALUE *vtmp = NULL;
        74.   	char *tname = NULL, *tvalue = NULL;
               ^
        75.   	if(name && !(tname = BUF_strdup(name))) goto err;
        76.   	if(value && !(tvalue = BUF_strdup(value))) goto err;;

crypto/x509v3/v3_utl.c:80:2: Assignment
        78.   	if(!*extlist && !(*extlist = sk_new(NULL))) goto err;
        79.   	vtmp->section = NULL;
        80.   	vtmp->name = tname;
               ^
        81.   	vtmp->value = tvalue;
        82.   	if(!sk_push(*extlist, (char *)vtmp)) goto err;

crypto/x509v3/v3_conf.c:278:14: Call
276.   	for(i = 0; i < sk_num(nval); i++) {
277.   		val = (CONF_VALUE *)sk_value(nval, i);
278.   		if(!(ext = X509V3_EXT_conf(conf, ctx, val->name, val->value)))
                    ^
279.   								return 0;
280.   		if(crl) X509_CRL_add_ext(crl, ext, -1);

crypto/x509v3/v3_conf.c:88:1: Parameter `*name`
  86.   /* char *name:  Name    */
  87.   /* char *value:  Value    */
  88. > X509_EXTENSION *X509V3_EXT_conf(LHASH *conf, X509V3_CTX *ctx, char *name,
  89.   	     char *value)
  90.   {

crypto/x509v3/v3_conf.c:96:10: Call
  94.   	crit = v3_check_critical(&value);
  95.   	if((ext_type = v3_check_generic(&value))) 
  96.   		return v3_generic_extension(name, value, crit, ext_type);
                 ^
  97.   	ret = do_ext_conf(conf, ctx, OBJ_sn2nid(name), crit, value);
  98.   	if(!ret) {

crypto/x509v3/v3_conf.c:205:1: Parameter `*ext`
    203.   
    204.   /* Create a generic extension: for now just handle RAW type */
    205. > static X509_EXTENSION *v3_generic_extension(const char *ext, char *value,
    206.   	     int crit, int type)
    207.   {

crypto/x509v3/v3_conf.c:213:12: Call
    211.   ASN1_OCTET_STRING *oct=NULL;
    212.   X509_EXTENSION *extension=NULL;
    213.   if(!(obj = OBJ_txt2obj(ext, 0))) {
                      ^
    214.   	X509V3err(X509V3_F_V3_GENERIC_EXTENSION,X509V3_R_EXTENSION_NAME_ERROR);
    215.   	ERR_add_error_data(2, "name=", ext);

crypto/objects/obj_dat.c:391:1: Parameter `*s`
      389.    */
      390.   
      391. > ASN1_OBJECT *OBJ_txt2obj(const char *s, int no_name)
      392.   	{
      393.   	int nid = NID_undef;

crypto/objects/obj_dat.c:405:4: Call
      403.   
      404.   	/* Work out size of content octets */
      405.   	i=a2d_ASN1_OBJECT(NULL,0,s,-1);
                ^
      406.   	if (i <= 0) {
      407.   		/* Clear the error */

crypto/asn1/a_object.c:88:1: <Length trace>
86.   	}
87.   
88. > int a2d_ASN1_OBJECT(unsigned char *out, int olen, const char *buf, int num)
89.   	{
90.   	int i,first,len=0,c;

crypto/asn1/a_object.c:88:1: Parameter `*buf`
        86.   	}
        87.   
        88. > int a2d_ASN1_OBJECT(unsigned char *out, int olen, const char *buf, int num)
        89.   	{
        90.   	int i,first,len=0,c;

crypto/asn1/a_object.c:100:2: Assignment
        98.   		num=strlen(buf);
        99.   
        100.   	p=buf;
                ^
        101.   	c= *(p++);
        102.   	num--;

crypto/asn1/a_object.c:101:7: Assignment
        99.   
        100.   	p=buf;
        101.   	c= *(p++);
                     ^
        102.   	num--;
        103.   	if ((c >= '0') && (c <= '2'))

crypto/asn1/a_object.c:118:7: Assignment
        116.   		goto err;
        117.   		}
        118.   	c= *(p++);
                     ^
        119.   	num--;
        120.   	for (;;)

crypto/asn1/a_object.c:133:7: Array access: Offset: [2, +oo] Size: [1, +oo] by call to `X509V3_EXT_conf` 
        131.   			if (num <= 0) break;
        132.   			num--;
        133.   			c= *(p++);
                     ^
        134.   			if ((c == ' ') || (c == '.'))
        135.   				break;

int a2d_ASN1_OBJECT(unsigned char *out, int olen, const char *buf, int num)
	{
	int i,first,len=0,c;
	char tmp[24];
	const char *p;
	unsigned long l;
	if (num == 0)
		return(0);
	else if (num == -1)
		num=strlen(buf);
	p=buf;
	c= *(p++);
	num--;
	if ((c >= '0') && (c <= '2'))
		{
		first=(c-'0')*40;
		}
	else
		{
		ASN1err(ASN1_F_A2D_ASN1_OBJECT,ASN1_R_FIRST_NUM_TOO_LARGE);
		goto err;
		}
	if (num <= 0)
		{
		ASN1err(ASN1_F_A2D_ASN1_OBJECT,ASN1_R_MISSING_SECOND_NUMBER);
		goto err;
		}
	c= *(p++);
	num--;
	for (;;)
		{
		if (num <= 0) break;
		if ((c != '.') && (c != ' '))
			{
			ASN1err(ASN1_F_A2D_ASN1_OBJECT,ASN1_R_INVALID_SEPARATOR);
			goto err;
			}
		l=0;
		for (;;)
			{
			if (num <= 0) break;
			num--;
			c= *(p++);
			if ((c == ' ') || (c == '.'))
				break;
			if ((c < '0') || (c > '9'))
				{
				ASN1err(ASN1_F_A2D_ASN1_OBJECT,ASN1_R_INVALID_DIGIT);
				goto err;
				}
			l=l*10L+(long)(c-'0');
			}
		if (len == 0)
			{
			if ((first < 2) && (l >= 40))
				{
				ASN1err(ASN1_F_A2D_ASN1_OBJECT,ASN1_R_SECOND_NUMBER_TOO_LARGE);
				goto err;
				}
			l+=(long)first;
			}
		i=0;
		for (;;)
			{
			tmp[i++]=(unsigned char)l&0x7f;
			l>>=7L;
			if (l == 0L) break;
			}
		if (out != NULL)
			{
			if (len+i > olen)
				{
				ASN1err(ASN1_F_A2D_ASN1_OBJECT,ASN1_R_BUFFER_TOO_SMALL);
				goto err;
				}
			while (--i > 0)
				out[len++]=tmp[i]|0x80;
			out[len++]=tmp[0];
			}
		else
			len+=i;
		}
	return(len);
err:
	return(0);
	}
['int X509V3_EXT_CRL_add_conf(LHASH *conf, X509V3_CTX *ctx, char *section,\n\t     X509_CRL *crl)\n{\n\tX509_EXTENSION *ext;\n\tSTACK *nval;\n\tCONF_VALUE *val;\n\tint i;\n\tif(!(nval = CONF_get_section(conf, section))) return 0;\n\tfor(i = 0; i < sk_num(nval); i++) {\n\t\tval = (CONF_VALUE *)sk_value(nval, i);\n\t\tif(!(ext = X509V3_EXT_conf(conf, ctx, val->name, val->value)))\n\t\t\t\t\t\t\t\treturn 0;\n\t\tif(crl) X509_CRL_add_ext(crl, ext, -1);\n\t\tX509_EXTENSION_free(ext);\n\t}\n\treturn 1;\n}', 'X509_EXTENSION *X509V3_EXT_conf(LHASH *conf, X509V3_CTX *ctx, char *name,\n\t     char *value)\n{\n\tint crit;\n\tint ext_type;\n\tX509_EXTENSION *ret;\n\tcrit = v3_check_critical(&value);\n\tif((ext_type = v3_check_generic(&value)))\n\t\treturn v3_generic_extension(name, value, crit, ext_type);\n\tret = do_ext_conf(conf, ctx, OBJ_sn2nid(name), crit, value);\n\tif(!ret) {\n\t\tX509V3err(X509V3_F_X509V3_EXT_CONF,X509V3_R_ERROR_IN_EXTENSION);\n\t\tERR_add_error_data(4,"name=", name, ", value=", value);\n\t}\n\treturn ret;\n}', 'static X509_EXTENSION *do_ext_conf(LHASH *conf, X509V3_CTX *ctx, int ext_nid,\n\t     int crit, char *value)\n{\n\tX509_EXTENSION *ext = NULL;\n\tX509V3_EXT_METHOD *method;\n\tSTACK *nval;\n\tchar *ext_struc;\n\tunsigned char *ext_der, *p;\n\tint ext_len;\n\tASN1_OCTET_STRING *ext_oct;\n\tif(ext_nid == NID_undef) {\n\t\tX509V3err(X509V3_F_DO_EXT_CONF,X509V3_R_UNKNOWN_EXTENSION_NAME);\n\t\treturn NULL;\n\t}\n\tif(!(method = X509V3_EXT_get_nid(ext_nid))) {\n\t\tX509V3err(X509V3_F_DO_EXT_CONF,X509V3_R_UNKNOWN_EXTENSION);\n\t\treturn NULL;\n\t}\n\tif(method->v2i) {\n\t\tif(*value == \'@\') nval = CONF_get_section(conf, value + 1);\n\t\telse nval = X509V3_parse_list(value);\n\t\tif(!nval) {\n\t\t\tX509V3err(X509V3_F_X509V3_EXT_CONF,X509V3_R_INVALID_EXTENSION_STRING);\n\t\t\tERR_add_error_data(4, "name=", OBJ_nid2sn(ext_nid), ",section=", value);\n\t\t\treturn NULL;\n\t\t}\n\t\text_struc = method->v2i(method, ctx, nval);\n\t\tif(*value != \'@\') sk_pop_free(nval, X509V3_conf_free);\n\t\tif(!ext_struc) return NULL;\n\t} else if(method->s2i) {\n\t\tif(!(ext_struc = method->s2i(method, ctx, value))) return NULL;\n\t} else if(method->r2i) {\n\t\tif(!ctx->db) {\n\t\t\tX509V3err(X509V3_F_X509V3_EXT_CONF,X509V3_R_NO_CONFIG_DATABASE);\n\t\t\treturn NULL;\n\t\t}\n\t\tif(!(ext_struc = method->r2i(method, ctx, value))) return NULL;\n\t} else {\n\t\tX509V3err(X509V3_F_X509V3_EXT_CONF,X509V3_R_EXTENSION_SETTING_NOT_SUPPORTED);\n\t\tERR_add_error_data(2, "name=", OBJ_nid2sn(ext_nid));\n\t\treturn NULL;\n\t}\n\text_len = method->i2d(ext_struc, NULL);\n\text_der = Malloc(ext_len);\n\tp = ext_der;\n\tmethod->i2d(ext_struc, &p);\n\tmethod->ext_free(ext_struc);\n\text_oct = ASN1_OCTET_STRING_new();\n\text_oct->data = ext_der;\n\text_oct->length = ext_len;\n\text = X509_EXTENSION_create_by_NID(NULL, ext_nid, crit, ext_oct);\n\tASN1_OCTET_STRING_free(ext_oct);\n\treturn ext;\n}', 'STACK *X509V3_parse_list(char *line)\n{\n\tchar *p, *q, c;\n\tchar *ntmp, *vtmp;\n\tSTACK *values = NULL;\n\tchar *linebuf;\n\tint state;\n\tlinebuf = BUF_strdup(line);\n\tstate = HDR_NAME;\n\tntmp = NULL;\n\tfor(p = linebuf, q = linebuf; (c = *p) && (c!=\'\\r\') && (c!=\'\\n\'); p++) {\n\t\tswitch(state) {\n\t\t\tcase HDR_NAME:\n\t\t\tif(c == \':\') {\n\t\t\t\tstate = HDR_VALUE;\n\t\t\t\t*p = 0;\n\t\t\t\tntmp = strip_spaces(q);\n\t\t\t\tif(!ntmp) {\n\t\t\t\t\tX509V3err(X509V3_F_X509V3_PARSE_LIST, X509V3_R_INVALID_NULL_NAME);\n\t\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\t\tq = p + 1;\n\t\t\t} else if(c == \',\') {\n\t\t\t\t*p = 0;\n\t\t\t\tntmp = strip_spaces(q);\n\t\t\t\tq = p + 1;\n#ifdef DEBUG\n\t\t\t\tprintf("%s\\n", ntmp);\n#endif\n\t\t\t\tif(!ntmp) {\n\t\t\t\t\tX509V3err(X509V3_F_X509V3_PARSE_LIST, X509V3_R_INVALID_NULL_NAME);\n\t\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\t\tX509V3_add_value(ntmp, NULL, &values);\n\t\t\t}\n\t\t\tbreak ;\n\t\t\tcase HDR_VALUE:\n\t\t\tif(c == \',\') {\n\t\t\t\tstate = HDR_NAME;\n\t\t\t\t*p = 0;\n\t\t\t\tvtmp = strip_spaces(q);\n#ifdef DEBUG\n\t\t\t\tprintf("%s\\n", ntmp);\n#endif\n\t\t\t\tif(!vtmp) {\n\t\t\t\t\tX509V3err(X509V3_F_X509V3_PARSE_LIST, X509V3_R_INVALID_NULL_VALUE);\n\t\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\t\tX509V3_add_value(ntmp, vtmp, &values);\n\t\t\t\tntmp = NULL;\n\t\t\t\tq = p + 1;\n\t\t\t}\n\t\t}\n\t}\n\tif(state == HDR_VALUE) {\n\t\tvtmp = strip_spaces(q);\n#ifdef DEBUG\n\t\tprintf("%s=%s\\n", ntmp, vtmp);\n#endif\n\t\tif(!vtmp) {\n\t\t\tX509V3err(X509V3_F_X509V3_PARSE_LIST, X509V3_R_INVALID_NULL_VALUE);\n\t\t\tgoto err;\n\t\t}\n\t\tX509V3_add_value(ntmp, vtmp, &values);\n\t} else {\n\t\tntmp = strip_spaces(q);\n#ifdef DEBUG\n\t\tprintf("%s\\n", ntmp);\n#endif\n\t\tif(!ntmp) {\n\t\t\tX509V3err(X509V3_F_X509V3_PARSE_LIST, X509V3_R_INVALID_NULL_NAME);\n\t\t\tgoto err;\n\t\t}\n\t\tX509V3_add_value(ntmp, NULL, &values);\n\t}\nFree(linebuf);\nreturn values;\nerr:\nFree(linebuf);\nsk_pop_free(values, X509V3_conf_free);\nreturn NULL;\n}', 'static char *strip_spaces(char *name)\n{\n\tchar *p, *q;\n\tp = name;\n\twhile(*p && isspace(*p)) p++;\n\tif(!*p) return NULL;\n\tq = p + strlen(p) - 1;\n\twhile((q != p) && isspace(*q)) q--;\n\tif(p != q) q[1] = 0;\n\tif(!*p) return NULL;\n\treturn p;\n}', 'int X509V3_add_value(const char *name, const char *value, STACK **extlist)\n{\n\tCONF_VALUE *vtmp = NULL;\n\tchar *tname = NULL, *tvalue = NULL;\n\tif(name && !(tname = BUF_strdup(name))) goto err;\n\tif(value && !(tvalue = BUF_strdup(value))) goto err;;\n\tif(!(vtmp = (CONF_VALUE *)Malloc(sizeof(CONF_VALUE)))) goto err;\n\tif(!*extlist && !(*extlist = sk_new(NULL))) goto err;\n\tvtmp->section = NULL;\n\tvtmp->name = tname;\n\tvtmp->value = tvalue;\n\tif(!sk_push(*extlist, (char *)vtmp)) goto err;\n\treturn 1;\n\terr:\n\tX509V3err(X509V3_F_X509V3_ADD_VALUE,ERR_R_MALLOC_FAILURE);\n\tif(vtmp) Free(vtmp);\n\tif(tname) Free(tname);\n\tif(tvalue) Free(tvalue);\n\treturn 0;\n}', 'static X509_EXTENSION *v3_generic_extension(const char *ext, char *value,\n\t     int crit, int type)\n{\nunsigned char *ext_der=NULL;\nlong ext_len;\nASN1_OBJECT *obj=NULL;\nASN1_OCTET_STRING *oct=NULL;\nX509_EXTENSION *extension=NULL;\nif(!(obj = OBJ_txt2obj(ext, 0))) {\n\tX509V3err(X509V3_F_V3_GENERIC_EXTENSION,X509V3_R_EXTENSION_NAME_ERROR);\n\tERR_add_error_data(2, "name=", ext);\n\tgoto err;\n}\nif(!(ext_der = string_to_hex(value, &ext_len))) {\n\tX509V3err(X509V3_F_V3_GENERIC_EXTENSION,X509V3_R_EXTENSION_VALUE_ERROR);\n\tERR_add_error_data(2, "value=", value);\n\tgoto err;\n}\nif(!(oct = ASN1_OCTET_STRING_new())) {\n\tX509V3err(X509V3_F_V3_GENERIC_EXTENSION,ERR_R_MALLOC_FAILURE);\n\tgoto err;\n}\noct->data = ext_der;\noct->length = ext_len;\next_der = NULL;\nextension = X509_EXTENSION_create_by_OBJ(NULL, obj, crit, oct);\nerr:\nASN1_OBJECT_free(obj);\nASN1_OCTET_STRING_free(oct);\nif(ext_der) Free(ext_der);\nreturn extension;\n}', 'ASN1_OBJECT *OBJ_txt2obj(const char *s, int no_name)\n\t{\n\tint nid = NID_undef;\n\tASN1_OBJECT *op=NULL;\n\tunsigned char *buf,*p;\n\tint i, j;\n\tif(!no_name) {\n\t\tif( ((nid = OBJ_sn2nid(s)) != NID_undef) ||\n\t\t\t((nid = OBJ_ln2nid(s)) != NID_undef) )\n\t\t\t\t\treturn OBJ_nid2obj(nid);\n\t}\n\ti=a2d_ASN1_OBJECT(NULL,0,s,-1);\n\tif (i <= 0) {\n\t\tERR_get_error();\n\t\treturn NULL;\n\t}\n\tj = ASN1_object_size(0,i,V_ASN1_OBJECT);\n\tif((buf=(unsigned char *)Malloc(j)) == NULL) return NULL;\n\tp = buf;\n\tASN1_put_object(&p,0,i,V_ASN1_OBJECT,V_ASN1_UNIVERSAL);\n\ta2d_ASN1_OBJECT(p,i,s,-1);\n\tp=buf;\n\top=d2i_ASN1_OBJECT(NULL,&p,i);\n\tFree(buf);\n\treturn op;\n\t}', "int a2d_ASN1_OBJECT(unsigned char *out, int olen, const char *buf, int num)\n\t{\n\tint i,first,len=0,c;\n\tchar tmp[24];\n\tconst char *p;\n\tunsigned long l;\n\tif (num == 0)\n\t\treturn(0);\n\telse if (num == -1)\n\t\tnum=strlen(buf);\n\tp=buf;\n\tc= *(p++);\n\tnum--;\n\tif ((c >= '0') && (c <= '2'))\n\t\t{\n\t\tfirst=(c-'0')*40;\n\t\t}\n\telse\n\t\t{\n\t\tASN1err(ASN1_F_A2D_ASN1_OBJECT,ASN1_R_FIRST_NUM_TOO_LARGE);\n\t\tgoto err;\n\t\t}\n\tif (num <= 0)\n\t\t{\n\t\tASN1err(ASN1_F_A2D_ASN1_OBJECT,ASN1_R_MISSING_SECOND_NUMBER);\n\t\tgoto err;\n\t\t}\n\tc= *(p++);\n\tnum--;\n\tfor (;;)\n\t\t{\n\t\tif (num <= 0) break;\n\t\tif ((c != '.') && (c != ' '))\n\t\t\t{\n\t\t\tASN1err(ASN1_F_A2D_ASN1_OBJECT,ASN1_R_INVALID_SEPARATOR);\n\t\t\tgoto err;\n\t\t\t}\n\t\tl=0;\n\t\tfor (;;)\n\t\t\t{\n\t\t\tif (num <= 0) break;\n\t\t\tnum--;\n\t\t\tc= *(p++);\n\t\t\tif ((c == ' ') || (c == '.'))\n\t\t\t\tbreak;\n\t\t\tif ((c < '0') || (c > '9'))\n\t\t\t\t{\n\t\t\t\tASN1err(ASN1_F_A2D_ASN1_OBJECT,ASN1_R_INVALID_DIGIT);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tl=l*10L+(long)(c-'0');\n\t\t\t}\n\t\tif (len == 0)\n\t\t\t{\n\t\t\tif ((first < 2) && (l >= 40))\n\t\t\t\t{\n\t\t\t\tASN1err(ASN1_F_A2D_ASN1_OBJECT,ASN1_R_SECOND_NUMBER_TOO_LARGE);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tl+=(long)first;\n\t\t\t}\n\t\ti=0;\n\t\tfor (;;)\n\t\t\t{\n\t\t\ttmp[i++]=(unsigned char)l&0x7f;\n\t\t\tl>>=7L;\n\t\t\tif (l == 0L) break;\n\t\t\t}\n\t\tif (out != NULL)\n\t\t\t{\n\t\t\tif (len+i > olen)\n\t\t\t\t{\n\t\t\t\tASN1err(ASN1_F_A2D_ASN1_OBJECT,ASN1_R_BUFFER_TOO_SMALL);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\twhile (--i > 0)\n\t\t\t\tout[len++]=tmp[i]|0x80;\n\t\t\tout[len++]=tmp[0];\n\t\t\t}\n\t\telse\n\t\t\tlen+=i;\n\t\t}\n\treturn(len);\nerr:\n\treturn(0);\n\t}"]