crypto/pkcs12/p12_crt.c:154: error: BUFFER_OVERRUN_L3
  Offset: [0, 7] Size: [0, 8] by call to `PKCS12_set_mac`.
Showing all 13 steps of the trace


crypto/pkcs12/p12_crt.c:154:6: Call
152.   	sk_pop_free(safes, PKCS7_free);
153.   
154.   	if(!PKCS12_set_mac (p12, pass, -1, NULL, 0, mac_iter, NULL)) return NULL;
            ^
155.   
156.   	return p12;

crypto/pkcs12/p12_mutl.c:117:1: Parameter `saltlen`
  115.   /* Set a mac */
  116.   
  117. > int PKCS12_set_mac (PKCS12 *p12, unsigned char *pass, int passlen,
  118.   	     unsigned char *salt, int saltlen, int iter, EVP_MD *md_type)
  119.   {

crypto/pkcs12/p12_mutl.c:123:6: Call
  121.   	int maclen;
  122.   	if (!md_type) md_type = EVP_sha1();
  123.   	if (PKCS12_setup_mac (p12, iter, salt, saltlen, md_type) ==
              ^
  124.   				 	PKCS12_ERROR) {
  125.   		PKCS12err(PKCS12_F_PKCS12_SET_MAC, PKCS12_R_MAC_SETUP_ERROR);

crypto/pkcs12/p12_mutl.c:140:1: Parameter `saltlen`
    138.   
    139.   /* Set up a mac structure */
    140. > int PKCS12_setup_mac (PKCS12 *p12, int iter, unsigned char *salt, int saltlen,
    141.   	     EVP_MD *md_type)
    142.   {

crypto/pkcs12/p12_mutl.c:152:2: Assignment
    150.   	}
    151.   	if (!saltlen) saltlen = PKCS12_SALT_LEN;
    152.   	p12->mac->salt->length = saltlen;
            ^
    153.   	if (!(p12->mac->salt->data = Malloc (saltlen))) {
    154.   		PKCS12err(PKCS12_F_PKCS12_SETUP_MAC, ERR_R_MALLOC_FAILURE);

crypto/pkcs12/p12_mutl.c:128:7: Call
  126.   		return 0;
  127.   	}
  128.   	if (!PKCS12_gen_mac (p12, pass, passlen, mac, &maclen)) {
               ^
  129.   		PKCS12err(PKCS12_F_PKCS12_SET_MAC, PKCS12_R_MAC_GENERATION_ERROR);
  130.   		return 0;

crypto/pkcs12/p12_mutl.c:66:1: Parameter `*p12->mac->iter->data`
    64.   
    65.   /* Generate a MAC */
    66. > int PKCS12_gen_mac (PKCS12 *p12, unsigned char *pass, int passlen,
    67.   	     unsigned char *mac, unsigned int *maclen)
    68.   {

crypto/pkcs12/p12_mutl.c:76:14: Call
    74.   	saltlen = p12->mac->salt->length;
    75.   	if (!p12->mac->iter) iter = 1;
    76.   	else iter = ASN1_INTEGER_get (p12->mac->iter);
                       ^
    77.       	if(!(md_type =
    78.   		 EVP_get_digestbyobj (p12->mac->dinfo->algor->algorithm))) {

crypto/asn1/a_int.c:233:1: <Offset trace>
231.   	}
232.   
233. > long ASN1_INTEGER_get(ASN1_INTEGER *a)
234.   	{
235.   	int neg=0,i;

crypto/asn1/a_int.c:233:1: Parameter `a->length`
      231.   	}
      232.   
      233. > long ASN1_INTEGER_get(ASN1_INTEGER *a)
      234.   	{
      235.   	int neg=0,i;

crypto/asn1/a_int.c:233:1: <Length trace>
231.   	}
232.   
233. > long ASN1_INTEGER_get(ASN1_INTEGER *a)
234.   	{
235.   	int neg=0,i;

crypto/asn1/a_int.c:233:1: Parameter `*a->data`
      231.   	}
      232.   
      233. > long ASN1_INTEGER_get(ASN1_INTEGER *a)
      234.   	{
      235.   	int neg=0,i;

crypto/asn1/a_int.c:256:21: Array access: Offset: [0, 7] Size: [0, 8] by call to `PKCS12_set_mac` 
      254.   		{
      255.   		r<<=8;
      256.   		r|=(unsigned char)a->data[i];
                                 ^
      257.   		}
      258.   	if (neg) r= -r;

long ASN1_INTEGER_get(ASN1_INTEGER *a)
	{
	int neg=0,i;
	long r=0;
	if (a == NULL) return(0L);
	i=a->type;
	if (i == V_ASN1_NEG_INTEGER)
		neg=1;
	else if (i != V_ASN1_INTEGER)
		return(0);
	if (a->length > sizeof(long))
		{
		return(0xffffffffL);
		}
	if (a->data == NULL)
		return(0);
	for (i=0; i<a->length; i++)
		{
		r<<=8;
		r|=(unsigned char)a->data[i];
		}
	if (neg) r= -r;
	return(r);
	}
['PKCS12 *PKCS12_create(char *pass, char *name, EVP_PKEY *pkey, X509 *cert,\n\t     STACK *ca, int nid_key, int nid_cert, int iter, int mac_iter,\n\t     int keytype)\n{\n\tPKCS12 *p12;\n\tSTACK *bags, *safes;\n\tPKCS12_SAFEBAG *bag;\n\tPKCS8_PRIV_KEY_INFO *p8;\n\tPKCS7 *authsafe;\n\tX509 *tcert;\n\tint i;\n\tunsigned char keyid[EVP_MAX_MD_SIZE];\n\tint keyidlen;\n\tif(!nid_cert) nid_cert = NID_pbe_WithSHA1And40BitRC2_CBC;\n\tif(!nid_key) nid_key = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;\n\tif(!iter) iter = 1000;\n\tif(!mac_iter) mac_iter = 1;\n\tif(!pkey || !cert) {\n\t\tPKCS12err(PKCS12_F_PKCS12_CREATE,PKCS12_R_INVALID_NULL_ARGUMENT);\n\t\treturn NULL;\n\t}\n\tif(!(bags = sk_new (NULL))) {\n\t\tPKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE);\n\t\treturn NULL;\n\t}\n\tif(!(bag = M_PKCS12_x5092certbag(cert))) return NULL;\n\tif(name && !PKCS12_add_friendlyname(bag, name, -1)) return NULL;\n\tX509_digest(cert, EVP_sha1(), keyid, &keyidlen);\n\tif(!PKCS12_add_localkeyid(bag, keyid, keyidlen)) return NULL;\n\tif(!sk_push(bags, (char *)bag)) {\n\t\tPKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE);\n\t\treturn NULL;\n\t}\n\tif(ca) {\n\t\tfor(i = 0; i < sk_num(ca); i++) {\n\t\t\ttcert = (X509 *)sk_value(ca, i);\n\t\t\tif(!(bag = M_PKCS12_x5092certbag(tcert))) return NULL;\n\t\t\tif(!sk_push(bags, (char *)bag)) {\n\t\t\t\tPKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE);\n\t\t\t\treturn NULL;\n\t\t\t}\n\t\t}\n\t}\n\tauthsafe = PKCS12_pack_p7encdata (nid_cert, pass, -1, NULL, 0,\n\t\t\t\t\t\t\t\t iter, bags);\n\tsk_pop_free(bags, PKCS12_SAFEBAG_free);\n\tif (!authsafe) return NULL;\n\tif(!(safes = sk_new (NULL)) || !sk_push(safes, (char *)authsafe)) {\n\t\tPKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE);\n\t\treturn NULL;\n\t}\n\tif(!(p8 = EVP_PKEY2PKCS8 (pkey))) return NULL;\n\tif(keytype && !PKCS8_add_keyusage(p8, keytype)) return NULL;\n\tbag = PKCS12_MAKE_SHKEYBAG (nid_key, pass, -1, NULL, 0, iter, p8);\n\tif(!bag) return NULL;\n\tPKCS8_PRIV_KEY_INFO_free(p8);\n        if (name && !PKCS12_add_friendlyname (bag, name, -1)) return NULL;\n\tif(!PKCS12_add_localkeyid (bag, keyid, keyidlen)) return NULL;\n\tif(!(bags = sk_new(NULL)) || !sk_push (bags, (char *)bag)) {\n\t\tPKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE);\n\t\treturn NULL;\n\t}\n\tif(!(authsafe = PKCS12_pack_p7data (bags))) return NULL;\n\tsk_pop_free(bags, PKCS12_SAFEBAG_free);\n\tif(!sk_push(safes, (char *)authsafe)) {\n\t\tPKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE);\n\t\treturn NULL;\n\t}\n\tif(!(p12 = PKCS12_init (NID_pkcs7_data))) return NULL;\n\tif(!M_PKCS12_pack_authsafes (p12, safes)) return NULL;\n\tsk_pop_free(safes, PKCS7_free);\n\tif(!PKCS12_set_mac (p12, pass, -1, NULL, 0, mac_iter, NULL)) return NULL;\n\treturn p12;\n}', 'int PKCS12_set_mac (PKCS12 *p12, unsigned char *pass, int passlen,\n\t     unsigned char *salt, int saltlen, int iter, EVP_MD *md_type)\n{\n\tunsigned char mac[EVP_MAX_MD_SIZE];\n\tint maclen;\n\tif (!md_type) md_type = EVP_sha1();\n\tif (PKCS12_setup_mac (p12, iter, salt, saltlen, md_type) ==\n\t\t\t\t \tPKCS12_ERROR) {\n\t\tPKCS12err(PKCS12_F_PKCS12_SET_MAC, PKCS12_R_MAC_SETUP_ERROR);\n\t\treturn 0;\n\t}\n\tif (!PKCS12_gen_mac (p12, pass, passlen, mac, &maclen)) {\n\t\tPKCS12err(PKCS12_F_PKCS12_SET_MAC, PKCS12_R_MAC_GENERATION_ERROR);\n\t\treturn 0;\n\t}\n\tif (!(ASN1_OCTET_STRING_set (p12->mac->dinfo->digest, mac, maclen))) {\n\t\tPKCS12err(PKCS12_F_PKCS12_PKCS12_SET_MAC,PKCS12_R_MAC_STRING_SET_ERROR);\n\t\t\t\t\t\treturn 0;\n\t}\n\treturn 1;\n}', 'int PKCS12_setup_mac (PKCS12 *p12, int iter, unsigned char *salt, int saltlen,\n\t     EVP_MD *md_type)\n{\n\tif (!(p12->mac = PKCS12_MAC_DATA_new ())) return PKCS12_ERROR;\n\tif (iter > 1) {\n\t\tif(!(p12->mac->iter = ASN1_INTEGER_new())) {\n\t\t\tPKCS12err(PKCS12_F_PKCS12_SETUP_MAC, ERR_R_MALLOC_FAILURE);\n\t\t\treturn 0;\n\t\t}\n\t\tASN1_INTEGER_set (p12->mac->iter, iter);\n\t}\n\tif (!saltlen) saltlen = PKCS12_SALT_LEN;\n\tp12->mac->salt->length = saltlen;\n\tif (!(p12->mac->salt->data = Malloc (saltlen))) {\n\t\tPKCS12err(PKCS12_F_PKCS12_SETUP_MAC, ERR_R_MALLOC_FAILURE);\n\t\treturn 0;\n\t}\n\tif (!salt) RAND_bytes (p12->mac->salt->data, saltlen);\n\telse memcpy (p12->mac->salt->data, salt, saltlen);\n\tp12->mac->dinfo->algor->algorithm = OBJ_nid2obj(EVP_MD_type(md_type));\n\tif (!(p12->mac->dinfo->algor->parameter = ASN1_TYPE_new())) {\n\t\tPKCS12err(PKCS12_F_PKCS12_SETUP_MAC, ERR_R_MALLOC_FAILURE);\n\t\treturn 0;\n\t}\n\tp12->mac->dinfo->algor->parameter->type = V_ASN1_NULL;\n\treturn 1;\n}', 'int PKCS12_gen_mac (PKCS12 *p12, unsigned char *pass, int passlen,\n\t     unsigned char *mac, unsigned int *maclen)\n{\n\tconst EVP_MD *md_type;\n\tHMAC_CTX hmac;\n\tunsigned char key[PKCS12_MAC_KEY_LENGTH], *salt;\n\tint saltlen, iter;\n\tsalt = p12->mac->salt->data;\n\tsaltlen = p12->mac->salt->length;\n\tif (!p12->mac->iter) iter = 1;\n\telse iter = ASN1_INTEGER_get (p12->mac->iter);\n    \tif(!(md_type =\n\t\t EVP_get_digestbyobj (p12->mac->dinfo->algor->algorithm))) {\n\t\tPKCS12err(PKCS12_F_PKCS12_GEN_MAC,PKCS12_R_UNKNOWN_DIGEST_ALGORITHM);\n\t\treturn 0;\n\t}\n\tif(!PKCS12_key_gen (pass, passlen, salt, saltlen, PKCS12_MAC_ID, iter,\n\t\t\t\t PKCS12_MAC_KEY_LENGTH, key, md_type)) {\n\t\tPKCS12err(PKCS12_F_PKCS12_GEN_MAC,PKCS12_R_KEY_GEN_ERROR);\n\t\treturn 0;\n\t}\n\tHMAC_Init (&hmac, key, PKCS12_MAC_KEY_LENGTH, md_type);\n    \tHMAC_Update (&hmac, p12->authsafes->d.data->data,\n\t\t\t\t\t p12->authsafes->d.data->length);\n    \tHMAC_Final (&hmac, mac, maclen);\n\treturn 1;\n}', 'long ASN1_INTEGER_get(ASN1_INTEGER *a)\n\t{\n\tint neg=0,i;\n\tlong r=0;\n\tif (a == NULL) return(0L);\n\ti=a->type;\n\tif (i == V_ASN1_NEG_INTEGER)\n\t\tneg=1;\n\telse if (i != V_ASN1_INTEGER)\n\t\treturn(0);\n\tif (a->length > sizeof(long))\n\t\t{\n\t\treturn(0xffffffffL);\n\t\t}\n\tif (a->data == NULL)\n\t\treturn(0);\n\tfor (i=0; i<a->length; i++)\n\t\t{\n\t\tr<<=8;\n\t\tr|=(unsigned char)a->data[i];\n\t\t}\n\tif (neg) r= -r;\n\treturn(r);\n\t}']