apps/x509.c:1066: error: BUFFER_OVERRUN_L3
  Offset added: [-2, +oo] Size: [1, +oo] by call to `set_cert_times`.
Showing all 26 steps of the trace


apps/x509.c:1064:10: Call
1062.   {
1063.   
1064.       if (!X509_set_issuer_name(x, X509_get_subject_name(x)))
                 ^
1065.           goto err;
1066.       if (!preserve_dates && !set_cert_times(x, NULL, NULL, days))

crypto/x509/x509_set.c:54:12: Call
  52.       if (x == NULL)
  53.           return 0;
  54.       return X509_NAME_set(&x->cert_info.issuer, name);
                   ^
  55.   }
  56.   

crypto/x509/x_name.c:476:17: Call
    474.   int X509_NAME_set(X509_NAME **xn, X509_NAME *name)
    475.   {
    476.       if ((name = X509_NAME_dup(name)) == NULL)
                           ^
    477.           return 0;
    478.       X509_NAME_free(*xn);

crypto/x509/x_name.c:88:1: Call
      86.   IMPLEMENT_ASN1_FUNCTIONS(X509_NAME)
      87.   
      88. > IMPLEMENT_ASN1_DUP_FUNCTION(X509_NAME)
      89.   
      90.   static int x509_name_ex_new(ASN1_VALUE **val, const ASN1_ITEM *it)

crypto/asn1/a_dup.c:59:9: Call
        57.           return NULL;
        58.   
        59.       i = ASN1_item_i2d(x, &b, it);
                      ^
        60.       if (b == NULL) {
        61.           ASN1err(ASN1_F_ASN1_ITEM_DUP, ERR_R_MALLOC_FAILURE);

crypto/asn1/tasn_enc.c:44:12: Call
          42.   int ASN1_item_i2d(ASN1_VALUE *val, unsigned char **out, const ASN1_ITEM *it)
          43.   {
          44.       return asn1_item_flags_i2d(val, out, it, 0);
                           ^
          45.   }
          46.   

crypto/asn1/tasn_enc.c:54:1: Parameter `(*out)->strlen`
            52.    */
            53.   
            54. > static int asn1_item_flags_i2d(ASN1_VALUE *val, unsigned char **out,
            55.                                  const ASN1_ITEM *it, int flags)
            56.   {

apps/x509.c:1066:29: Call
1064.       if (!X509_set_issuer_name(x, X509_get_subject_name(x)))
1065.           goto err;
1066.       if (!preserve_dates && !set_cert_times(x, NULL, NULL, days))
                                    ^
1067.           goto err;
1068.       if (!X509_set_pubkey(x, pkey))

apps/apps.c:2667:1: Parameter `startdate->strlen`
  2665.   }
  2666.   
  2667. > int set_cert_times(X509 *x, const char *startdate, const char *enddate,
  2668.                      int days)
  2669.   {

apps/apps.c:2674:14: Call
  2672.               return 0;
  2673.       } else {
  2674.           if (!ASN1_TIME_set_string_X509(X509_getm_notBefore(x), startdate))
                       ^
  2675.               return 0;
  2676.       }

crypto/asn1/a_time.c:374:1: <Offset trace>
372.   }
373.   
374. > int ASN1_TIME_set_string_X509(ASN1_TIME *s, const char *str)
375.   {
376.       ASN1_TIME t;

crypto/asn1/a_time.c:374:1: Parameter `str->strlen`
    372.   }
    373.   
    374. > int ASN1_TIME_set_string_X509(ASN1_TIME *s, const char *str)
    375.   {
    376.       ASN1_TIME t;

crypto/asn1/a_time.c:380:5: Assignment
    378.       int rv = 0;
    379.   
    380.       t.length = strlen(str);
               ^
    381.       t.data = (unsigned char *)str;
    382.       t.flags = ASN1_STRING_FLAG_X509_TIME;

crypto/asn1/a_time.c:410:13: Assignment
    408.               goto out;
    409.           if (is_utc(tm.tm_year)) {
    410.               t.length -= 2;
                       ^
    411.               /*
    412.                * it's OK to let original t.data go since that's assigned

crypto/asn1/a_time.c:374:1: <Length trace>
372.   }
373.   
374. > int ASN1_TIME_set_string_X509(ASN1_TIME *s, const char *str)
375.   {
376.       ASN1_TIME t;

crypto/asn1/a_time.c:374:1: Parameter `str->strlen`
    372.   }
    373.   
    374. > int ASN1_TIME_set_string_X509(ASN1_TIME *s, const char *str)
    375.   {
    376.       ASN1_TIME t;

crypto/asn1/a_time.c:380:5: Assignment
    378.       int rv = 0;
    379.   
    380.       t.length = strlen(str);
               ^
    381.       t.data = (unsigned char *)str;
    382.       t.flags = ASN1_STRING_FLAG_X509_TIME;

crypto/asn1/a_time.c:410:13: Assignment
    408.               goto out;
    409.           if (is_utc(tm.tm_year)) {
    410.               t.length -= 2;
                       ^
    411.               /*
    412.                * it's OK to let original t.data go since that's assigned

crypto/asn1/a_time.c:416:22: Call
    414.                * new t.data would be freed after ASN1_STRING_copy is done.
    415.                */
    416.               t.data = OPENSSL_zalloc(t.length + 1);
                                ^
    417.               if (t.data == NULL)
    418.                   goto out;

crypto/mem.c:218:1: Parameter `num`
      216.   }
      217.   
      218. > void *CRYPTO_zalloc(size_t num, const char *file, int line)
      219.   {
      220.       void *ret = CRYPTO_malloc(num, file, line);

crypto/mem.c:220:17: Call
      218.   void *CRYPTO_zalloc(size_t num, const char *file, int line)
      219.   {
      220.       void *ret = CRYPTO_malloc(num, file, line);
                             ^
      221.   
      222.       FAILTEST();

crypto/mem.c:198:9: Assignment
        196.   
        197.       if (num == 0)
        198.           return NULL;
                       ^
        199.   
        200.       FAILTEST();

crypto/mem.c:220:5: Assignment
      218.   void *CRYPTO_zalloc(size_t num, const char *file, int line)
      219.   {
      220.       void *ret = CRYPTO_malloc(num, file, line);
                 ^
      221.   
      222.       FAILTEST();

crypto/mem.c:225:5: Assignment
      223.       if (ret != NULL)
      224.           memset(ret, 0, num);
      225.       return ret;
                 ^
      226.   }
      227.   

crypto/asn1/a_time.c:416:13: Assignment
    414.                * new t.data would be freed after ASN1_STRING_copy is done.
    415.                */
    416.               t.data = OPENSSL_zalloc(t.length + 1);
                       ^
    417.               if (t.data == NULL)
    418.                   goto out;

crypto/asn1/a_time.c:419:13: Array access: Offset added: [-2, +oo] Size: [1, +oo] by call to `set_cert_times` 
    417.               if (t.data == NULL)
    418.                   goto out;
    419.               memcpy(t.data, str + 2, t.length);
                       ^
    420.               t.type = V_ASN1_UTCTIME;
    421.           }

int ASN1_TIME_set_string_X509(ASN1_TIME *s, const char *str)
{
    ASN1_TIME t;
    struct tm tm;
    int rv = 0;
    t.length = strlen(str);
    t.data = (unsigned char *)str;
    t.flags = ASN1_STRING_FLAG_X509_TIME;
    t.type = V_ASN1_UTCTIME;
    if (!ASN1_TIME_check(&t)) {
        t.type = V_ASN1_GENERALIZEDTIME;
        if (!ASN1_TIME_check(&t))
            goto out;
    }
    if (s != NULL && t.type == V_ASN1_GENERALIZEDTIME) {
        if (!asn1_time_to_tm(&tm, &t))
            goto out;
        if (is_utc(tm.tm_year)) {
            t.length -= 2;
            t.data = OPENSSL_zalloc(t.length + 1);
            if (t.data == NULL)
                goto out;
            memcpy(t.data, str + 2, t.length);
            t.type = V_ASN1_UTCTIME;
        }
    }
    if (s == NULL || ASN1_STRING_copy((ASN1_STRING *)s, (ASN1_STRING *)&t))
        rv = 1;
    if (t.data != (unsigned char *)str)
        OPENSSL_free(t.data);
out:
    return rv;
}
['static int sign(X509 *x, EVP_PKEY *pkey, int days, int clrext,\n                const EVP_MD *digest, CONF *conf, const char *section,\n                int preserve_dates)\n{\n    if (!X509_set_issuer_name(x, X509_get_subject_name(x)))\n        goto err;\n    if (!preserve_dates && !set_cert_times(x, NULL, NULL, days))\n        goto err;\n    if (!X509_set_pubkey(x, pkey))\n        goto err;\n    if (clrext) {\n        while (X509_get_ext_count(x) > 0)\n            X509_delete_ext(x, 0);\n    }\n    if (conf != NULL) {\n        X509V3_CTX ctx;\n        X509_set_version(x, 2);\n        X509V3_set_ctx(&ctx, x, x, NULL, NULL, 0);\n        X509V3_set_nconf(&ctx, conf);\n        if (!X509V3_EXT_add_nconf(conf, &ctx, section, x))\n            goto err;\n    }\n    if (!X509_sign(x, pkey, digest))\n        goto err;\n    return 1;\n err:\n    ERR_print_errors(bio_err);\n    return 0;\n}', 'int X509_set_issuer_name(X509 *x, X509_NAME *name)\n{\n    if (x == NULL)\n        return 0;\n    return X509_NAME_set(&x->cert_info.issuer, name);\n}', 'int X509_NAME_set(X509_NAME **xn, X509_NAME *name)\n{\n    if ((name = X509_NAME_dup(name)) == NULL)\n        return 0;\n    X509_NAME_free(*xn);\n    *xn = name;\n    return 1;\n}', 'IMPLEMENT_ASN1_DUP_FUNCTION(X509_NAME)', 'void *ASN1_item_dup(const ASN1_ITEM *it, void *x)\n{\n    unsigned char *b = NULL;\n    const unsigned char *p;\n    long i;\n    void *ret;\n    if (x == NULL)\n        return NULL;\n    i = ASN1_item_i2d(x, &b, it);\n    if (b == NULL) {\n        ASN1err(ASN1_F_ASN1_ITEM_DUP, ERR_R_MALLOC_FAILURE);\n        return NULL;\n    }\n    p = b;\n    ret = ASN1_item_d2i(NULL, &p, i, it);\n    OPENSSL_free(b);\n    return ret;\n}', 'int ASN1_item_i2d(ASN1_VALUE *val, unsigned char **out, const ASN1_ITEM *it)\n{\n    return asn1_item_flags_i2d(val, out, it, 0);\n}', 'static int asn1_item_flags_i2d(ASN1_VALUE *val, unsigned char **out,\n                               const ASN1_ITEM *it, int flags)\n{\n    if (out && !*out) {\n        unsigned char *p, *buf;\n        int len;\n        len = ASN1_item_ex_i2d(&val, NULL, it, -1, flags);\n        if (len <= 0)\n            return len;\n        buf = OPENSSL_malloc(len);\n        if (buf == NULL)\n            return -1;\n        p = buf;\n        ASN1_item_ex_i2d(&val, &p, it, -1, flags);\n        *out = buf;\n        return len;\n    }\n    return ASN1_item_ex_i2d(&val, out, it, -1, flags);\n}', 'int set_cert_times(X509 *x, const char *startdate, const char *enddate,\n                   int days)\n{\n    if (startdate == NULL || strcmp(startdate, "today") == 0) {\n        if (X509_gmtime_adj(X509_getm_notBefore(x), 0) == NULL)\n            return 0;\n    } else {\n        if (!ASN1_TIME_set_string_X509(X509_getm_notBefore(x), startdate))\n            return 0;\n    }\n    if (enddate == NULL) {\n        if (X509_time_adj_ex(X509_getm_notAfter(x), days, 0, NULL)\n            == NULL)\n            return 0;\n    } else if (!ASN1_TIME_set_string_X509(X509_getm_notAfter(x), enddate)) {\n        return 0;\n    }\n    return 1;\n}', 'int ASN1_TIME_set_string_X509(ASN1_TIME *s, const char *str)\n{\n    ASN1_TIME t;\n    struct tm tm;\n    int rv = 0;\n    t.length = strlen(str);\n    t.data = (unsigned char *)str;\n    t.flags = ASN1_STRING_FLAG_X509_TIME;\n    t.type = V_ASN1_UTCTIME;\n    if (!ASN1_TIME_check(&t)) {\n        t.type = V_ASN1_GENERALIZEDTIME;\n        if (!ASN1_TIME_check(&t))\n            goto out;\n    }\n    if (s != NULL && t.type == V_ASN1_GENERALIZEDTIME) {\n        if (!asn1_time_to_tm(&tm, &t))\n            goto out;\n        if (is_utc(tm.tm_year)) {\n            t.length -= 2;\n            t.data = OPENSSL_zalloc(t.length + 1);\n            if (t.data == NULL)\n                goto out;\n            memcpy(t.data, str + 2, t.length);\n            t.type = V_ASN1_UTCTIME;\n        }\n    }\n    if (s == NULL || ASN1_STRING_copy((ASN1_STRING *)s, (ASN1_STRING *)&t))\n        rv = 1;\n    if (t.data != (unsigned char *)str)\n        OPENSSL_free(t.data);\nout:\n    return rv;\n}', 'void *CRYPTO_zalloc(size_t num, const char *file, int line)\n{\n    void *ret = CRYPTO_malloc(num, file, line);\n    FAILTEST();\n    if (ret != NULL)\n        memset(ret, 0, num);\n    return ret;\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    INCREMENT(malloc_count);\n    if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)\n        return malloc_impl(num, file, line);\n    if (num == 0)\n        return NULL;\n    FAILTEST();\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    (void)(file); (void)(line);\n    ret = malloc(num);\n#endif\n    return ret;\n}']