crypto/ct/ct_oct.c:348: error: BUFFER_OVERRUN_S2
  Offset added: [43+max(1, `sct->ext_len`), `sct->ext_len` + 43] (⇐ 43 + [max(1, `sct->ext_len`), `sct->ext_len`]) Size: [1, +oo].
Showing all 17 steps of the trace


crypto/ct/ct_oct.c:306:1: <Offset trace>
304.   }
305.   
306. > int i2o_SCT(const SCT *sct, unsigned char **out)
307.   {
308.       size_t len;

crypto/ct/ct_oct.c:306:1: Parameter `sct->ext_len`
304.   }
305.   
306. > int i2o_SCT(const SCT *sct, unsigned char **out)
307.   {
308.       size_t len;

crypto/ct/ct_oct.c:306:1: <Length trace>
304.   }
305.   
306. > int i2o_SCT(const SCT *sct, unsigned char **out)
307.   {
308.       size_t len;

crypto/ct/ct_oct.c:306:1: Parameter `**out`
304.   }
305.   
306. > int i2o_SCT(const SCT *sct, unsigned char **out)
307.   {
308.       size_t len;

crypto/ct/ct_oct.c:330:9: Assignment
328.   
329.       if (*out != NULL) {
330.           p = *out;
               ^
331.           *out += len;
332.       } else {

crypto/ct/ct_oct.c:342:10: Assignment
340.   
341.       if (sct->version == SCT_V1) {
342.           *p++ = sct->version;
                ^
343.           memcpy(p, sct->log_id, SCT_V1_HASHLEN);
344.           p += SCT_V1_HASHLEN;

crypto/ct/ct_oct.c:344:9: Assignment
342.           *p++ = sct->version;
343.           memcpy(p, sct->log_id, SCT_V1_HASHLEN);
344.           p += SCT_V1_HASHLEN;
               ^
345.           l2n8(sct->timestamp, p);
346.           s2n(sct->ext_len, p);

crypto/ct/ct_oct.c:345:9: Assignment
343.           memcpy(p, sct->log_id, SCT_V1_HASHLEN);
344.           p += SCT_V1_HASHLEN;
345.           l2n8(sct->timestamp, p);
               ^
346.           s2n(sct->ext_len, p);
347.           if (sct->ext_len > 0) {

crypto/ct/ct_oct.c:345:9: Assignment
343.           memcpy(p, sct->log_id, SCT_V1_HASHLEN);
344.           p += SCT_V1_HASHLEN;
345.           l2n8(sct->timestamp, p);
               ^
346.           s2n(sct->ext_len, p);
347.           if (sct->ext_len > 0) {

crypto/ct/ct_oct.c:345:9: Assignment
343.           memcpy(p, sct->log_id, SCT_V1_HASHLEN);
344.           p += SCT_V1_HASHLEN;
345.           l2n8(sct->timestamp, p);
               ^
346.           s2n(sct->ext_len, p);
347.           if (sct->ext_len > 0) {

crypto/ct/ct_oct.c:345:9: Assignment
343.           memcpy(p, sct->log_id, SCT_V1_HASHLEN);
344.           p += SCT_V1_HASHLEN;
345.           l2n8(sct->timestamp, p);
               ^
346.           s2n(sct->ext_len, p);
347.           if (sct->ext_len > 0) {

crypto/ct/ct_oct.c:345:9: Assignment
343.           memcpy(p, sct->log_id, SCT_V1_HASHLEN);
344.           p += SCT_V1_HASHLEN;
345.           l2n8(sct->timestamp, p);
               ^
346.           s2n(sct->ext_len, p);
347.           if (sct->ext_len > 0) {

crypto/ct/ct_oct.c:345:9: Assignment
343.           memcpy(p, sct->log_id, SCT_V1_HASHLEN);
344.           p += SCT_V1_HASHLEN;
345.           l2n8(sct->timestamp, p);
               ^
346.           s2n(sct->ext_len, p);
347.           if (sct->ext_len > 0) {

crypto/ct/ct_oct.c:345:9: Assignment
343.           memcpy(p, sct->log_id, SCT_V1_HASHLEN);
344.           p += SCT_V1_HASHLEN;
345.           l2n8(sct->timestamp, p);
               ^
346.           s2n(sct->ext_len, p);
347.           if (sct->ext_len > 0) {

crypto/ct/ct_oct.c:345:9: Assignment
343.           memcpy(p, sct->log_id, SCT_V1_HASHLEN);
344.           p += SCT_V1_HASHLEN;
345.           l2n8(sct->timestamp, p);
               ^
346.           s2n(sct->ext_len, p);
347.           if (sct->ext_len > 0) {

crypto/ct/ct_oct.c:346:9: Assignment
344.           p += SCT_V1_HASHLEN;
345.           l2n8(sct->timestamp, p);
346.           s2n(sct->ext_len, p);
               ^
347.           if (sct->ext_len > 0) {
348.               memcpy(p, sct->ext, sct->ext_len);

crypto/ct/ct_oct.c:348:13: Array access: Offset added: [43+max(1, sct->ext_len), sct->ext_len + 43] (⇐ 43 + [max(1, sct->ext_len), sct->ext_len]) Size: [1, +oo]
346.           s2n(sct->ext_len, p);
347.           if (sct->ext_len > 0) {
348.               memcpy(p, sct->ext, sct->ext_len);
                   ^
349.               p += sct->ext_len;
350.           }

int i2o_SCT(const SCT *sct, unsigned char **out)
{
    size_t len;
    unsigned char *p = NULL;
    if (!SCT_is_valid(sct)) {
        CTerr(CT_F_I2O_SCT, CT_R_SCT_NOT_SET);
        goto err;
    }
    if (sct->version == SCT_V1)
        len = 43 + sct->ext_len + 4 + sct->sig_len;
    else
        len = sct->sct_len;
    if (out == NULL)
        return len;
    if (*out != NULL) {
        p = *out;
        *out += len;
    } else {
        p = OPENSSL_malloc(len);
        if (p == NULL) {
            CTerr(CT_F_I2O_SCT, ERR_R_MALLOC_FAILURE);
            goto err;
        }
        *out = p;
    }
    if (sct->version == SCT_V1) {
        *p++ = sct->version;
        memcpy(p, sct->log_id, SCT_V1_HASHLEN);
        p += SCT_V1_HASHLEN;
        l2n8(sct->timestamp, p);
        s2n(sct->ext_len, p);
        if (sct->ext_len > 0) {
            memcpy(p, sct->ext, sct->ext_len);
            p += sct->ext_len;
        }
        if (i2o_SCT_signature(sct, &p) <= 0)
            goto err;
    } else {
        memcpy(p, sct->sct, len);
    }
    return len;
err:
    OPENSSL_free(p);
    return -1;
}
['int i2o_SCT(const SCT *sct, unsigned char **out)\n{\n    size_t len;\n    unsigned char *p = NULL;\n    if (!SCT_is_valid(sct)) {\n        CTerr(CT_F_I2O_SCT, CT_R_SCT_NOT_SET);\n        goto err;\n    }\n    if (sct->version == SCT_V1)\n        len = 43 + sct->ext_len + 4 + sct->sig_len;\n    else\n        len = sct->sct_len;\n    if (out == NULL)\n        return len;\n    if (*out != NULL) {\n        p = *out;\n        *out += len;\n    } else {\n        p = OPENSSL_malloc(len);\n        if (p == NULL) {\n            CTerr(CT_F_I2O_SCT, ERR_R_MALLOC_FAILURE);\n            goto err;\n        }\n        *out = p;\n    }\n    if (sct->version == SCT_V1) {\n        *p++ = sct->version;\n        memcpy(p, sct->log_id, SCT_V1_HASHLEN);\n        p += SCT_V1_HASHLEN;\n        l2n8(sct->timestamp, p);\n        s2n(sct->ext_len, p);\n        if (sct->ext_len > 0) {\n            memcpy(p, sct->ext, sct->ext_len);\n            p += sct->ext_len;\n        }\n        if (i2o_SCT_signature(sct, &p) <= 0)\n            goto err;\n    } else {\n        memcpy(p, sct->sct, len);\n    }\n    return len;\nerr:\n    OPENSSL_free(p);\n    return -1;\n}']