crypto/ct/ct_oct.c:458: error: BUFFER_OVERRUN_L3
  Offset added: [44, +oo] (⇐ 43 + [1, +oo]) Size: [1, +oo] by call to `i2o_SCT`.
Showing all 22 steps of the trace


crypto/ct/ct_oct.c:458:28: Call
456.               p2 = p;
457.               p += 2;
458.               if ((sct_len = i2o_SCT(sk_SCT_value(a, i), &p)) == -1)
                                  ^
459.                   goto err;
460.               s2n(sct_len, p2);

crypto/ct/ct_oct.c:306:1: Parameter `sct->ext_len`
  304.   }
  305.   
  306. > int i2o_SCT(const SCT *sct, unsigned char **out)
  307.   {
  308.       size_t len;

crypto/ct/ct_oct.c:458:28: Call
456.               p2 = p;
457.               p += 2;
458.               if ((sct_len = i2o_SCT(sk_SCT_value(a, i), &p)) == -1)
                                  ^
459.                   goto err;
460.               s2n(sct_len, p2);

crypto/ct/ct_oct.c:306:1: Parameter `sct->ext_len`
  304.   }
  305.   
  306. > int i2o_SCT(const SCT *sct, unsigned char **out)
  307.   {
  308.       size_t len;

crypto/ct/ct_oct.c:458:28: Call
456.               p2 = p;
457.               p += 2;
458.               if ((sct_len = i2o_SCT(sk_SCT_value(a, i), &p)) == -1)
                                  ^
459.                   goto err;
460.               s2n(sct_len, p2);

crypto/ct/ct_oct.c:306:1: <Offset trace>
304.   }
305.   
306. > int i2o_SCT(const SCT *sct, unsigned char **out)
307.   {
308.       size_t len;

crypto/ct/ct_oct.c:306:1: Parameter `sct->ext_len`
  304.   }
  305.   
  306. > int i2o_SCT(const SCT *sct, unsigned char **out)
  307.   {
  308.       size_t len;

crypto/ct/ct_oct.c:306:1: <Length trace>
304.   }
305.   
306. > int i2o_SCT(const SCT *sct, unsigned char **out)
307.   {
308.       size_t len;

crypto/ct/ct_oct.c:306:1: Parameter `**out`
  304.   }
  305.   
  306. > int i2o_SCT(const SCT *sct, unsigned char **out)
  307.   {
  308.       size_t len;

crypto/ct/ct_oct.c:330:9: Assignment
  328.   
  329.       if (*out != NULL) {
  330.           p = *out;
                 ^
  331.           *out += len;
  332.       } else {

crypto/ct/ct_oct.c:342:10: Assignment
  340.   
  341.       if (sct->version == SCT_V1) {
  342.           *p++ = sct->version;
                  ^
  343.           memcpy(p, sct->log_id, SCT_V1_HASHLEN);
  344.           p += SCT_V1_HASHLEN;

crypto/ct/ct_oct.c:344:9: Assignment
  342.           *p++ = sct->version;
  343.           memcpy(p, sct->log_id, SCT_V1_HASHLEN);
  344.           p += SCT_V1_HASHLEN;
                 ^
  345.           l2n8(sct->timestamp, p);
  346.           s2n(sct->ext_len, p);

crypto/ct/ct_oct.c:345:9: Assignment
  343.           memcpy(p, sct->log_id, SCT_V1_HASHLEN);
  344.           p += SCT_V1_HASHLEN;
  345.           l2n8(sct->timestamp, p);
                 ^
  346.           s2n(sct->ext_len, p);
  347.           if (sct->ext_len > 0) {

crypto/ct/ct_oct.c:345:9: Assignment
  343.           memcpy(p, sct->log_id, SCT_V1_HASHLEN);
  344.           p += SCT_V1_HASHLEN;
  345.           l2n8(sct->timestamp, p);
                 ^
  346.           s2n(sct->ext_len, p);
  347.           if (sct->ext_len > 0) {

crypto/ct/ct_oct.c:345:9: Assignment
  343.           memcpy(p, sct->log_id, SCT_V1_HASHLEN);
  344.           p += SCT_V1_HASHLEN;
  345.           l2n8(sct->timestamp, p);
                 ^
  346.           s2n(sct->ext_len, p);
  347.           if (sct->ext_len > 0) {

crypto/ct/ct_oct.c:345:9: Assignment
  343.           memcpy(p, sct->log_id, SCT_V1_HASHLEN);
  344.           p += SCT_V1_HASHLEN;
  345.           l2n8(sct->timestamp, p);
                 ^
  346.           s2n(sct->ext_len, p);
  347.           if (sct->ext_len > 0) {

crypto/ct/ct_oct.c:345:9: Assignment
  343.           memcpy(p, sct->log_id, SCT_V1_HASHLEN);
  344.           p += SCT_V1_HASHLEN;
  345.           l2n8(sct->timestamp, p);
                 ^
  346.           s2n(sct->ext_len, p);
  347.           if (sct->ext_len > 0) {

crypto/ct/ct_oct.c:345:9: Assignment
  343.           memcpy(p, sct->log_id, SCT_V1_HASHLEN);
  344.           p += SCT_V1_HASHLEN;
  345.           l2n8(sct->timestamp, p);
                 ^
  346.           s2n(sct->ext_len, p);
  347.           if (sct->ext_len > 0) {

crypto/ct/ct_oct.c:345:9: Assignment
  343.           memcpy(p, sct->log_id, SCT_V1_HASHLEN);
  344.           p += SCT_V1_HASHLEN;
  345.           l2n8(sct->timestamp, p);
                 ^
  346.           s2n(sct->ext_len, p);
  347.           if (sct->ext_len > 0) {

crypto/ct/ct_oct.c:345:9: Assignment
  343.           memcpy(p, sct->log_id, SCT_V1_HASHLEN);
  344.           p += SCT_V1_HASHLEN;
  345.           l2n8(sct->timestamp, p);
                 ^
  346.           s2n(sct->ext_len, p);
  347.           if (sct->ext_len > 0) {

crypto/ct/ct_oct.c:346:9: Assignment
  344.           p += SCT_V1_HASHLEN;
  345.           l2n8(sct->timestamp, p);
  346.           s2n(sct->ext_len, p);
                 ^
  347.           if (sct->ext_len > 0) {
  348.               memcpy(p, sct->ext, sct->ext_len);

crypto/ct/ct_oct.c:348:13: Array access: Offset added: [44, +oo] (⇐ 43 + [1, +oo]) Size: [1, +oo] by call to `i2o_SCT` 
  346.           s2n(sct->ext_len, p);
  347.           if (sct->ext_len > 0) {
  348.               memcpy(p, sct->ext, sct->ext_len);
                     ^
  349.               p += sct->ext_len;
  350.           }

int i2o_SCT(const SCT *sct, unsigned char **out)
{
    size_t len;
    unsigned char *p = NULL;
    if (!SCT_is_valid(sct)) {
        CTerr(CT_F_I2O_SCT, CT_R_SCT_NOT_SET);
        goto err;
    }
    if (sct->version == SCT_V1)
        len = 43 + sct->ext_len + 4 + sct->sig_len;
    else
        len = sct->sct_len;
    if (out == NULL)
        return len;
    if (*out != NULL) {
        p = *out;
        *out += len;
    } else {
        p = OPENSSL_malloc(len);
        if (p == NULL) {
            CTerr(CT_F_I2O_SCT, ERR_R_MALLOC_FAILURE);
            goto err;
        }
        *out = p;
    }
    if (sct->version == SCT_V1) {
        *p++ = sct->version;
        memcpy(p, sct->log_id, SCT_V1_HASHLEN);
        p += SCT_V1_HASHLEN;
        l2n8(sct->timestamp, p);
        s2n(sct->ext_len, p);
        if (sct->ext_len > 0) {
            memcpy(p, sct->ext, sct->ext_len);
            p += sct->ext_len;
        }
        if (i2o_SCT_signature(sct, &p) <= 0)
            goto err;
    } else {
        memcpy(p, sct->sct, len);
    }
    return len;
err:
    OPENSSL_free(p);
    return -1;
}
['int i2o_SCT_LIST(STACK_OF(SCT) *a, unsigned char **pp)\n{\n    int len, sct_len, i, is_pp_new = 0;\n    size_t len2;\n    unsigned char *p = NULL, *p2;\n    if (pp != NULL) {\n        if (*pp == NULL) {\n            if ((len = i2o_SCT_LIST(a, NULL)) == -1) {\n                CTerr(CT_F_I2O_SCT_LIST, CT_R_SCT_LIST_INVALID);\n                return -1;\n            }\n            if ((*pp = OPENSSL_malloc(len)) == NULL) {\n                CTerr(CT_F_I2O_SCT_LIST, ERR_R_MALLOC_FAILURE);\n                return -1;\n            }\n            is_pp_new = 1;\n        }\n        p = *pp + 2;\n    }\n    len2 = 2;\n    for (i = 0; i < sk_SCT_num(a); i++) {\n        if (pp != NULL) {\n            p2 = p;\n            p += 2;\n            if ((sct_len = i2o_SCT(sk_SCT_value(a, i), &p)) == -1)\n                goto err;\n            s2n(sct_len, p2);\n        } else {\n          if ((sct_len = i2o_SCT(sk_SCT_value(a, i), NULL)) == -1)\n              goto err;\n        }\n        len2 += 2 + sct_len;\n    }\n    if (len2 > MAX_SCT_LIST_SIZE)\n        goto err;\n    if (pp != NULL) {\n        p = *pp;\n        s2n(len2 - 2, p);\n    }\n    if (!is_pp_new)\n        *pp += len2;\n    return len2;\n err:\n    if (is_pp_new) {\n        OPENSSL_free(*pp);\n        *pp = NULL;\n    }\n    return -1;\n}', 'int i2o_SCT(const SCT *sct, unsigned char **out)\n{\n    size_t len;\n    unsigned char *p = NULL;\n    if (!SCT_is_valid(sct)) {\n        CTerr(CT_F_I2O_SCT, CT_R_SCT_NOT_SET);\n        goto err;\n    }\n    if (sct->version == SCT_V1)\n        len = 43 + sct->ext_len + 4 + sct->sig_len;\n    else\n        len = sct->sct_len;\n    if (out == NULL)\n        return len;\n    if (*out != NULL) {\n        p = *out;\n        *out += len;\n    } else {\n        p = OPENSSL_malloc(len);\n        if (p == NULL) {\n            CTerr(CT_F_I2O_SCT, ERR_R_MALLOC_FAILURE);\n            goto err;\n        }\n        *out = p;\n    }\n    if (sct->version == SCT_V1) {\n        *p++ = sct->version;\n        memcpy(p, sct->log_id, SCT_V1_HASHLEN);\n        p += SCT_V1_HASHLEN;\n        l2n8(sct->timestamp, p);\n        s2n(sct->ext_len, p);\n        if (sct->ext_len > 0) {\n            memcpy(p, sct->ext, sct->ext_len);\n            p += sct->ext_len;\n        }\n        if (i2o_SCT_signature(sct, &p) <= 0)\n            goto err;\n    } else {\n        memcpy(p, sct->sct, len);\n    }\n    return len;\nerr:\n    OPENSSL_free(p);\n    return -1;\n}']