crypto/asn1/tasn_dec.c:724: error: BUFFER_OVERRUN_L3
  Offset added: [0, 2147483644] Size: [1, 2147483644] by call to `asn1_collect`.
Showing all 16 steps of the trace


crypto/asn1/tasn_dec.c:631:19: Assignment
629.       char cst, inf, free_cont = 0;
630.       const unsigned char *p;
631.       BUF_MEM buf = { 0, NULL, 0, 0 };
                         ^
632.       const unsigned char *cont = NULL;
633.       long len;

crypto/asn1/tasn_dec.c:724:14: Call
722.            * So instead just check for UNIVERSAL class and ignore the tag.
723.            */
724.           if (!asn1_collect(&buf, &p, plen, inf, -1, V_ASN1_UNIVERSAL, 0)) {
                    ^
725.               goto err;
726.           }

crypto/asn1/tasn_dec.c:966:1: Parameter `buf->max`
  964.   #endif
  965.   
  966. > static int asn1_collect(BUF_MEM *buf, const unsigned char **in, long len,
  967.                           char inf, int tag, int aclass, int depth)
  968.   {

crypto/asn1/tasn_dec.c:1011:29: Call
  1009.               if (!asn1_collect(buf, &p, plen, ininf, tag, aclass, depth + 1))
  1010.                   return 0;
  1011.           } else if (plen && !collect_data(buf, &p, plen))
                                      ^
  1012.               return 0;
  1013.           len -= p - q;

crypto/asn1/tasn_dec.c:1023:1: Parameter `buf->max`
    1021.   }
    1022.   
    1023. > static int collect_data(BUF_MEM *buf, const unsigned char **p, long plen)
    1024.   {
    1025.       int len;

crypto/asn1/tasn_dec.c:1028:14: Call
    1026.       if (buf) {
    1027.           len = buf->length;
    1028.           if (!BUF_MEM_grow_clean(buf, len + plen)) {
                         ^
    1029.               ASN1err(ASN1_F_COLLECT_DATA, ERR_R_MALLOC_FAILURE);
    1030.               return 0;

crypto/buffer/buffer.c:109:1: Parameter `len`
      107.   }
      108.   
      109. > size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
      110.   {
      111.       char *ret;

crypto/buffer/buffer.c:134:15: Call
      132.           ret = sec_alloc_realloc(str, n);
      133.       else
      134.           ret = OPENSSL_clear_realloc(str->data, str->max, n);
                           ^
      135.       if (ret == NULL) {
      136.           BUFerr(BUF_F_BUF_MEM_GROW_CLEAN, ERR_R_MALLOC_FAILURE);

crypto/mem.c:225:1: <Offset trace>
223.   }
224.   
225. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
226.                              const char *file, int line)
227.   {

crypto/mem.c:225:1: Parameter `num`
        223.   }
        224.   
        225. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
        226.                              const char *file, int line)
        227.   {

crypto/mem.c:225:1: <Length trace>
223.   }
224.   
225. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
226.                              const char *file, int line)
227.   {

crypto/mem.c:225:1: Parameter `num`
        223.   }
        224.   
        225. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
        226.                              const char *file, int line)
        227.   {

crypto/mem.c:244:11: Call
        242.       }
        243.   
        244.       ret = CRYPTO_malloc(num, file, line);
                         ^
        245.       if (ret != NULL) {
        246.           memcpy(ret, str, old_len);

crypto/mem.c:165:9: Assignment
          163.   
          164.       if (num <= 0)
          165.           return NULL;
                         ^
          166.   
          167.       FAILTEST();

crypto/mem.c:244:5: Assignment
        242.       }
        243.   
        244.       ret = CRYPTO_malloc(num, file, line);
                   ^
        245.       if (ret != NULL) {
        246.           memcpy(ret, str, old_len);

crypto/mem.c:246:9: Array access: Offset added: [0, 2147483644] Size: [1, 2147483644] by call to `asn1_collect` 
        244.       ret = CRYPTO_malloc(num, file, line);
        245.       if (ret != NULL) {
        246.           memcpy(ret, str, old_len);
                       ^
        247.           CRYPTO_clear_free(str, old_len, file, line);
        248.       }

void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
                           const char *file, int line)
{
    void *ret = NULL;
    if (str == NULL)
        return CRYPTO_malloc(num, file, line);
    if (num == 0) {
        CRYPTO_clear_free(str, old_len, file, line);
        return NULL;
    }
    if (num < old_len) {
        OPENSSL_cleanse((char*)str + num, old_len - num);
        return str;
    }
    ret = CRYPTO_malloc(num, file, line);
    if (ret != NULL) {
        memcpy(ret, str, old_len);
        CRYPTO_clear_free(str, old_len, file, line);
    }
    return ret;
}
['static int asn1_d2i_ex_primitive(ASN1_VALUE **pval,\n                                 const unsigned char **in, long inlen,\n                                 const ASN1_ITEM *it,\n                                 int tag, int aclass, char opt, ASN1_TLC *ctx)\n{\n    int ret = 0, utype;\n    long plen;\n    char cst, inf, free_cont = 0;\n    const unsigned char *p;\n    BUF_MEM buf = { 0, NULL, 0, 0 };\n    const unsigned char *cont = NULL;\n    long len;\n    if (!pval) {\n        ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE, ASN1_R_ILLEGAL_NULL);\n        return 0;\n    }\n    if (it->itype == ASN1_ITYPE_MSTRING) {\n        utype = tag;\n        tag = -1;\n    } else\n        utype = it->utype;\n    if (utype == V_ASN1_ANY) {\n        unsigned char oclass;\n        if (tag >= 0) {\n            ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE, ASN1_R_ILLEGAL_TAGGED_ANY);\n            return 0;\n        }\n        if (opt) {\n            ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE,\n                    ASN1_R_ILLEGAL_OPTIONAL_ANY);\n            return 0;\n        }\n        p = *in;\n        ret = asn1_check_tlen(NULL, &utype, &oclass, NULL, NULL,\n                              &p, inlen, -1, 0, 0, ctx);\n        if (!ret) {\n            ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE, ERR_R_NESTED_ASN1_ERROR);\n            return 0;\n        }\n        if (oclass != V_ASN1_UNIVERSAL)\n            utype = V_ASN1_OTHER;\n    }\n    if (tag == -1) {\n        tag = utype;\n        aclass = V_ASN1_UNIVERSAL;\n    }\n    p = *in;\n    ret = asn1_check_tlen(&plen, NULL, NULL, &inf, &cst,\n                          &p, inlen, tag, aclass, opt, ctx);\n    if (!ret) {\n        ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE, ERR_R_NESTED_ASN1_ERROR);\n        return 0;\n    } else if (ret == -1)\n        return -1;\n    ret = 0;\n    if ((utype == V_ASN1_SEQUENCE)\n        || (utype == V_ASN1_SET) || (utype == V_ASN1_OTHER)) {\n        if (utype == V_ASN1_OTHER) {\n            asn1_tlc_clear(ctx);\n        }\n        else if (!cst) {\n            ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE,\n                    ASN1_R_TYPE_NOT_CONSTRUCTED);\n            return 0;\n        }\n        cont = *in;\n        if (inf) {\n            if (!asn1_find_end(&p, plen, inf))\n                goto err;\n            len = p - cont;\n        } else {\n            len = p - cont + plen;\n            p += plen;\n        }\n    } else if (cst) {\n        if (utype == V_ASN1_NULL || utype == V_ASN1_BOOLEAN\n            || utype == V_ASN1_OBJECT || utype == V_ASN1_INTEGER\n            || utype == V_ASN1_ENUMERATED) {\n            ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE, ASN1_R_TYPE_NOT_PRIMITIVE);\n            return 0;\n        }\n        free_cont = 1;\n        if (!asn1_collect(&buf, &p, plen, inf, -1, V_ASN1_UNIVERSAL, 0)) {\n            goto err;\n        }\n        len = buf.length;\n        if (!BUF_MEM_grow_clean(&buf, len + 1)) {\n            ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE, ERR_R_MALLOC_FAILURE);\n            goto err;\n        }\n        buf.data[len] = 0;\n        cont = (const unsigned char *)buf.data;\n    } else {\n        cont = p;\n        len = plen;\n        p += plen;\n    }\n    if (!asn1_ex_c2i(pval, cont, len, utype, &free_cont, it))\n        goto err;\n    *in = p;\n    ret = 1;\n err:\n    if (free_cont)\n        OPENSSL_free(buf.data);\n    return ret;\n}', 'static int asn1_collect(BUF_MEM *buf, const unsigned char **in, long len,\n                        char inf, int tag, int aclass, int depth)\n{\n    const unsigned char *p, *q;\n    long plen;\n    char cst, ininf;\n    p = *in;\n    inf &= 1;\n    if (!buf && !inf) {\n        *in += len;\n        return 1;\n    }\n    while (len > 0) {\n        q = p;\n        if (asn1_check_eoc(&p, len)) {\n            if (!inf) {\n                ASN1err(ASN1_F_ASN1_COLLECT, ASN1_R_UNEXPECTED_EOC);\n                return 0;\n            }\n            inf = 0;\n            break;\n        }\n        if (!asn1_check_tlen(&plen, NULL, NULL, &ininf, &cst, &p,\n                             len, tag, aclass, 0, NULL)) {\n            ASN1err(ASN1_F_ASN1_COLLECT, ERR_R_NESTED_ASN1_ERROR);\n            return 0;\n        }\n        if (cst) {\n            if (depth >= ASN1_MAX_STRING_NEST) {\n                ASN1err(ASN1_F_ASN1_COLLECT, ASN1_R_NESTED_ASN1_STRING);\n                return 0;\n            }\n            if (!asn1_collect(buf, &p, plen, ininf, tag, aclass, depth + 1))\n                return 0;\n        } else if (plen && !collect_data(buf, &p, plen))\n            return 0;\n        len -= p - q;\n    }\n    if (inf) {\n        ASN1err(ASN1_F_ASN1_COLLECT, ASN1_R_MISSING_EOC);\n        return 0;\n    }\n    *in = p;\n    return 1;\n}', 'static int collect_data(BUF_MEM *buf, const unsigned char **p, long plen)\n{\n    int len;\n    if (buf) {\n        len = buf->length;\n        if (!BUF_MEM_grow_clean(buf, len + plen)) {\n            ASN1err(ASN1_F_COLLECT_DATA, ERR_R_MALLOC_FAILURE);\n            return 0;\n        }\n        memcpy(buf->data + len, *p, plen);\n    }\n    *p += plen;\n    return 1;\n}', 'size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)\n{\n    char *ret;\n    size_t n;\n    if (str->length >= len) {\n        if (str->data != NULL)\n            memset(&str->data[len], 0, str->length - len);\n        str->length = len;\n        return (len);\n    }\n    if (str->max >= len) {\n        memset(&str->data[str->length], 0, len - str->length);\n        str->length = len;\n        return (len);\n    }\n    if (len > LIMIT_BEFORE_EXPANSION) {\n        BUFerr(BUF_F_BUF_MEM_GROW_CLEAN, ERR_R_MALLOC_FAILURE);\n        return 0;\n    }\n    n = (len + 3) / 3 * 4;\n    if ((str->flags & BUF_MEM_FLAG_SECURE))\n        ret = sec_alloc_realloc(str, n);\n    else\n        ret = OPENSSL_clear_realloc(str->data, str->max, n);\n    if (ret == NULL) {\n        BUFerr(BUF_F_BUF_MEM_GROW_CLEAN, ERR_R_MALLOC_FAILURE);\n        len = 0;\n    } else {\n        str->data = ret;\n        str->max = n;\n        memset(&str->data[str->length], 0, len - str->length);\n        str->length = len;\n    }\n    return (len);\n}', 'void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,\n                           const char *file, int line)\n{\n    void *ret = NULL;\n    if (str == NULL)\n        return CRYPTO_malloc(num, file, line);\n    if (num == 0) {\n        CRYPTO_clear_free(str, old_len, file, line);\n        return NULL;\n    }\n    if (num < old_len) {\n        OPENSSL_cleanse((char*)str + num, old_len - num);\n        return str;\n    }\n    ret = CRYPTO_malloc(num, file, line);\n    if (ret != NULL) {\n        memcpy(ret, str, old_len);\n        CRYPTO_clear_free(str, old_len, file, line);\n    }\n    return ret;\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)\n        return malloc_impl(num, file, line);\n    if (num <= 0)\n        return NULL;\n    FAILTEST();\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    osslargused(file); osslargused(line);\n    ret = malloc(num);\n#endif\n    return ret;\n}']