apps/ts.c:564: error: INTEGER_OVERFLOW_L2
  ([1, max(18446744073709551615, `md->md_size`)] + 1):unsigned64 by call to `TS_MSG_IMPRINT_set_msg`.
Showing all 12 steps of the trace


apps/ts.c:530:1: Parameter `md->md_size`
528.   	}
529.   
530. > static TS_REQ *create_query(BIO *data_bio, char *digest, const EVP_MD *md,
531.   			    const char *policy, int no_nonce, int cert)
532.   	{

apps/ts.c:562:13: Call
560.   
561.   	/* Adding message digest. */
562.   	if ((len = create_digest(data_bio, digest, md, &data)) == 0)
                   ^
563.   		goto err;
564.   	if (!TS_MSG_IMPRINT_set_msg(msg_imprint, data, len)) goto err;

apps/ts.c:635:2: Assignment
  633.   	return md_value_len;
  634.    err:
  635.   	return 0;
          ^
  636.   	}
  637.   

apps/ts.c:562:7: Assignment
560.   
561.   	/* Adding message digest. */
562.   	if ((len = create_digest(data_bio, digest, md, &data)) == 0)
             ^
563.   		goto err;
564.   	if (!TS_MSG_IMPRINT_set_msg(msg_imprint, data, len)) goto err;

apps/ts.c:564:7: Call
562.   	if ((len = create_digest(data_bio, digest, md, &data)) == 0)
563.   		goto err;
564.   	if (!TS_MSG_IMPRINT_set_msg(msg_imprint, data, len)) goto err;
             ^
565.   
566.   	if (!TS_REQ_set_msg_imprint(ts_req, msg_imprint)) goto err;

crypto/ts/ts_req_utils.c:119:1: Parameter `len`
  117.   	}
  118.   
  119. > int TS_MSG_IMPRINT_set_msg(TS_MSG_IMPRINT *a, unsigned char *d, int len)
  120.   	{
  121.   	return ASN1_OCTET_STRING_set(a->hashed_msg, d, len);

crypto/ts/ts_req_utils.c:121:9: Call
  119.   int TS_MSG_IMPRINT_set_msg(TS_MSG_IMPRINT *a, unsigned char *d, int len)
  120.   	{
  121.   	return ASN1_OCTET_STRING_set(a->hashed_msg, d, len);
                 ^
  122.   	}
  123.   

crypto/asn1/a_octet.c:70:1: Parameter `len`
    68.   	{ return M_ASN1_OCTET_STRING_cmp(a, b); }
    69.   
    70. > int ASN1_OCTET_STRING_set(ASN1_OCTET_STRING *x, const unsigned char *d,
    71.   			  size_t len)
    72.   	{ return M_ASN1_OCTET_STRING_set(x, d, len); }

crypto/asn1/a_octet.c:72:11: Call
    70.   int ASN1_OCTET_STRING_set(ASN1_OCTET_STRING *x, const unsigned char *d,
    71.   			  size_t len)
    72.   	{ return M_ASN1_OCTET_STRING_set(x, d, len); }
                    ^
    73.   

crypto/asn1/asn1_lib.c:374:1: <LHS trace>
372.   	}
373.   
374. > int ASN1_STRING_set(ASN1_STRING *str, const void *_data, size_t len)
375.   	{
376.   	unsigned char *c;

crypto/asn1/asn1_lib.c:374:1: Parameter `len`
      372.   	}
      373.   
      374. > int ASN1_STRING_set(ASN1_STRING *str, const void *_data, size_t len)
      375.   	{
      376.   	unsigned char *c;

crypto/asn1/asn1_lib.c:390:14: Binary operation: ([1, max(18446744073709551615, md->md_size)] + 1):unsigned64 by call to `TS_MSG_IMPRINT_set_msg` 
      388.   		c=str->data;
      389.   		if (c == NULL)
      390.   			str->data=OPENSSL_malloc(len+1);
                          ^
      391.   		else
      392.   			str->data=OPENSSL_realloc(c,len+1);

int ASN1_STRING_set(ASN1_STRING *str, const void *_data, size_t len)
	{
	unsigned char *c;
	const char *data=_data;
	if (len < 0)
		{
		if (data == NULL)
			return(0);
		else
			len=strlen(data);
		}
	if ((str->length < len) || (str->data == NULL))
		{
		c=str->data;
		if (c == NULL)
			str->data=OPENSSL_malloc(len+1);
		else
			str->data=OPENSSL_realloc(c,len+1);
		if (str->data == NULL)
			{
			ASN1err(ASN1_F_ASN1_STRING_SET,ERR_R_MALLOC_FAILURE);
			str->data=c;
			return(0);
			}
		}
	str->length=len;
	if (data != NULL)
		{
		memcpy(str->data,data,len);
		str->data[len]='\0';
		}
	return(1);
	}
['static TS_REQ *create_query(BIO *data_bio, char *digest, const EVP_MD *md,\n\t\t\t    const char *policy, int no_nonce, int cert)\n\t{\n\tint ret = 0;\n\tTS_REQ *ts_req = NULL;\n\tint len;\n\tTS_MSG_IMPRINT *msg_imprint = NULL;\n\tX509_ALGOR *algo = NULL;\n\tunsigned char *data = NULL;\n\tASN1_OBJECT *policy_obj = NULL;\n\tASN1_INTEGER *nonce_asn1 = NULL;\n\tif (!md && !(md = EVP_get_digestbyname("sha1"))) goto err;\n\tif (!(ts_req = TS_REQ_new())) goto err;\n\tif (!TS_REQ_set_version(ts_req, 1)) goto err;\n\tif (!(msg_imprint = TS_MSG_IMPRINT_new())) goto err;\n\tif (!(algo = X509_ALGOR_new())) goto err;\n\tif (!(algo->algorithm = OBJ_nid2obj(EVP_MD_type(md)))) goto err;\n\tif (!(algo->parameter = ASN1_TYPE_new())) goto err;\n\talgo->parameter->type = V_ASN1_NULL;\n\tif (!TS_MSG_IMPRINT_set_algo(msg_imprint, algo)) goto err;\n\tif ((len = create_digest(data_bio, digest, md, &data)) == 0)\n\t\tgoto err;\n\tif (!TS_MSG_IMPRINT_set_msg(msg_imprint, data, len)) goto err;\n\tif (!TS_REQ_set_msg_imprint(ts_req, msg_imprint)) goto err;\n\tif (policy && !(policy_obj = txt2obj(policy))) goto err;\n\tif (policy_obj && !TS_REQ_set_policy_id(ts_req, policy_obj)) goto err;\n\tif (!no_nonce && !(nonce_asn1 = create_nonce(NONCE_LENGTH))) goto err;\n\tif (nonce_asn1 && !TS_REQ_set_nonce(ts_req, nonce_asn1)) goto err;\n\tif (!TS_REQ_set_cert_req(ts_req, cert)) goto err;\n\tret = 1;\n err:\n\tif (!ret)\n\t\t{\n\t\tTS_REQ_free(ts_req);\n\t\tts_req = NULL;\n\t\tBIO_printf(bio_err, "could not create query\\n");\n\t\t}\n\tTS_MSG_IMPRINT_free(msg_imprint);\n\tX509_ALGOR_free(algo);\n\tOPENSSL_free(data);\n\tASN1_OBJECT_free(policy_obj);\n\tASN1_INTEGER_free(nonce_asn1);\n\treturn ts_req;\n\t}', 'static int create_digest(BIO *input, char *digest, const EVP_MD *md,\n\t\t\t unsigned char **md_value)\n\t{\n\tint md_value_len;\n\tmd_value_len = EVP_MD_size(md);\n\tif (input)\n\t\t{\n\t\tEVP_MD_CTX md_ctx;\n\t\tunsigned char buffer[4096];\n\t\tint length;\n\t\t*md_value = OPENSSL_malloc(md_value_len);\n\t\tif (*md_value == 0) goto err;\n\t\tEVP_DigestInit(&md_ctx, md);\n\t\twhile ((length = BIO_read(input, buffer, sizeof(buffer))) > 0)\n\t\t\t{\n\t\t\tEVP_DigestUpdate(&md_ctx, buffer, length);\n\t\t\t}\n\t\tEVP_DigestFinal(&md_ctx, *md_value, NULL);\n\t\t}\n\telse\n\t\t{\n\t\tlong digest_len;\n\t\t*md_value = string_to_hex(digest, &digest_len);\n\t\tif (!*md_value || md_value_len != digest_len)\n\t\t\t{\n\t\t\tOPENSSL_free(*md_value);\n\t\t\t*md_value = NULL;\n\t\t\tBIO_printf(bio_err, "bad digest, %d bytes "\n\t\t\t\t   "must be specified\\n", md_value_len);\n\t\t\tgoto err;\n\t\t\t}\n\t\t}\n\treturn md_value_len;\n err:\n\treturn 0;\n\t}', 'int TS_MSG_IMPRINT_set_msg(TS_MSG_IMPRINT *a, unsigned char *d, int len)\n\t{\n\treturn ASN1_OCTET_STRING_set(a->hashed_msg, d, len);\n\t}', 'int ASN1_OCTET_STRING_set(ASN1_OCTET_STRING *x, const unsigned char *d,\n\t\t\t  size_t len)\n\t{ return M_ASN1_OCTET_STRING_set(x, d, len); }', "int ASN1_STRING_set(ASN1_STRING *str, const void *_data, size_t len)\n\t{\n\tunsigned char *c;\n\tconst char *data=_data;\n\tif (len < 0)\n\t\t{\n\t\tif (data == NULL)\n\t\t\treturn(0);\n\t\telse\n\t\t\tlen=strlen(data);\n\t\t}\n\tif ((str->length < len) || (str->data == NULL))\n\t\t{\n\t\tc=str->data;\n\t\tif (c == NULL)\n\t\t\tstr->data=OPENSSL_malloc(len+1);\n\t\telse\n\t\t\tstr->data=OPENSSL_realloc(c,len+1);\n\t\tif (str->data == NULL)\n\t\t\t{\n\t\t\tASN1err(ASN1_F_ASN1_STRING_SET,ERR_R_MALLOC_FAILURE);\n\t\t\tstr->data=c;\n\t\t\treturn(0);\n\t\t\t}\n\t\t}\n\tstr->length=len;\n\tif (data != NULL)\n\t\t{\n\t\tmemcpy(str->data,data,len);\n\t\tstr->data[len]='\\0';\n\t\t}\n\treturn(1);\n\t}"]