apps/s_client.c:2381: error: BUFFER_OVERRUN_L3
  Offset added: [200, 8192] Size: [1, 2147483644] by call to `X509_NAME_oneline`.
Showing all 6 steps of the trace


apps/s_client.c:2381:17: Call
2379.               BIO_printf(bio, "---\nCertificate chain\n");
2380.               for (i = 0; i < sk_X509_num(sk); i++) {
2381.                   X509_NAME_oneline(X509_get_subject_name(sk_X509_value(sk, i)),
                        ^
2382.                                     buf, sizeof buf);
2383.                   BIO_printf(bio, "%2d s:%s\n", i, buf);

crypto/x509/x509_obj.c:67:1: <Offset trace>
65.   #include "internal/x509_int.h"
66.   
67. > char *X509_NAME_oneline(X509_NAME *a, char *buf, int len)
68.   {
69.       X509_NAME_ENTRY *ne;

crypto/x509/x509_obj.c:67:1: Parameter `len`
  65.   #include "internal/x509_int.h"
  66.   
  67. > char *X509_NAME_oneline(X509_NAME *a, char *buf, int len)
  68.   {
  69.       X509_NAME_ENTRY *ne;

crypto/x509/x509_obj.c:67:1: <Length trace>
65.   #include "internal/x509_int.h"
66.   
67. > char *X509_NAME_oneline(X509_NAME *a, char *buf, int len)
68.   {
69.       X509_NAME_ENTRY *ne;

crypto/x509/x509_obj.c:67:1: Parameter `*buf`
  65.   #include "internal/x509_int.h"
  66.   
  67. > char *X509_NAME_oneline(X509_NAME *a, char *buf, int len)
  68.   {
  69.       X509_NAME_ENTRY *ne;

crypto/x509/x509_obj.c:96:9: Array access: Offset added: [200, 8192] Size: [1, 2147483644] by call to `X509_NAME_oneline` 
  94.               OPENSSL_free(b);
  95.           }
  96.           strncpy(buf, "NO X509_NAME", len);
                ^
  97.           buf[len - 1] = '\0';
  98.           return buf;

char *X509_NAME_oneline(X509_NAME *a, char *buf, int len)
{
    X509_NAME_ENTRY *ne;
    int i;
    int n, lold, l, l1, l2, num, j, type;
    const char *s;
    char *p;
    unsigned char *q;
    BUF_MEM *b = NULL;
    static const char hex[17] = "0123456789ABCDEF";
    int gs_doit[4];
    char tmp_buf[80];
#ifdef CHARSET_EBCDIC
    char ebcdic_buf[1024];
#endif
    if (buf == NULL) {
        if ((b = BUF_MEM_new()) == NULL)
            goto err;
        if (!BUF_MEM_grow(b, 200))
            goto err;
        b->data[0] = '\0';
        len = 200;
    }
    if (a == NULL) {
        if (b) {
            buf = b->data;
            OPENSSL_free(b);
        }
        strncpy(buf, "NO X509_NAME", len);
        buf[len - 1] = '\0';
        return buf;
    }
    len--;
    l = 0;
    for (i = 0; i < sk_X509_NAME_ENTRY_num(a->entries); i++) {
        ne = sk_X509_NAME_ENTRY_value(a->entries, i);
        n = OBJ_obj2nid(ne->object);
        if ((n == NID_undef) || ((s = OBJ_nid2sn(n)) == NULL)) {
            i2t_ASN1_OBJECT(tmp_buf, sizeof(tmp_buf), ne->object);
            s = tmp_buf;
        }
        l1 = strlen(s);
        type = ne->value->type;
        num = ne->value->length;
        q = ne->value->data;
#ifdef CHARSET_EBCDIC
        if (type == V_ASN1_GENERALSTRING ||
            type == V_ASN1_VISIBLESTRING ||
            type == V_ASN1_PRINTABLESTRING ||
            type == V_ASN1_TELETEXSTRING ||
            type == V_ASN1_VISIBLESTRING || type == V_ASN1_IA5STRING) {
            ascii2ebcdic(ebcdic_buf, q, (num > sizeof ebcdic_buf)
                         ? sizeof ebcdic_buf : num);
            q = ebcdic_buf;
        }
#endif
        if ((type == V_ASN1_GENERALSTRING) && ((num % 4) == 0)) {
            gs_doit[0] = gs_doit[1] = gs_doit[2] = gs_doit[3] = 0;
            for (j = 0; j < num; j++)
                if (q[j] != 0)
                    gs_doit[j & 3] = 1;
            if (gs_doit[0] | gs_doit[1] | gs_doit[2])
                gs_doit[0] = gs_doit[1] = gs_doit[2] = gs_doit[3] = 1;
            else {
                gs_doit[0] = gs_doit[1] = gs_doit[2] = 0;
                gs_doit[3] = 1;
            }
        } else
            gs_doit[0] = gs_doit[1] = gs_doit[2] = gs_doit[3] = 1;
        for (l2 = j = 0; j < num; j++) {
            if (!gs_doit[j & 3])
                continue;
            l2++;
#ifndef CHARSET_EBCDIC
            if ((q[j] < ' ') || (q[j] > '~'))
                l2 += 3;
#else
            if ((os_toascii[q[j]] < os_toascii[' ']) ||
                (os_toascii[q[j]] > os_toascii['~']))
                l2 += 3;
#endif
        }
        lold = l;
        l += 1 + l1 + 1 + l2;
        if (b != NULL) {
            if (!BUF_MEM_grow(b, l + 1))
                goto err;
            p = &(b->data[lold]);
        } else if (l > len) {
            break;
        } else
            p = &(buf[lold]);
        *(p++) = '/';
        memcpy(p, s, (unsigned int)l1);
        p += l1;
        *(p++) = '=';
#ifndef CHARSET_EBCDIC
        q = ne->value->data;
#endif
        for (j = 0; j < num; j++) {
            if (!gs_doit[j & 3])
                continue;
#ifndef CHARSET_EBCDIC
            n = q[j];
            if ((n < ' ') || (n > '~')) {
                *(p++) = '\\';
                *(p++) = 'x';
                *(p++) = hex[(n >> 4) & 0x0f];
                *(p++) = hex[n & 0x0f];
            } else
                *(p++) = n;
#else
            n = os_toascii[q[j]];
            if ((n < os_toascii[' ']) || (n > os_toascii['~'])) {
                *(p++) = '\\';
                *(p++) = 'x';
                *(p++) = hex[(n >> 4) & 0x0f];
                *(p++) = hex[n & 0x0f];
            } else
                *(p++) = q[j];
#endif
        }
        *p = '\0';
    }
    if (b != NULL) {
        p = b->data;
        OPENSSL_free(b);
    } else
        p = buf;
    if (i == 0)
        *p = '\0';
    return (p);
 err:
    X509err(X509_F_X509_NAME_ONELINE, ERR_R_MALLOC_FAILURE);
    BUF_MEM_free(b);
    return (NULL);
}
['static void print_stuff(BIO *bio, SSL *s, int full)\n{\n    X509 *peer = NULL;\n    char buf[BUFSIZ];\n    STACK_OF(X509) *sk;\n    STACK_OF(X509_NAME) *sk2;\n    const SSL_CIPHER *c;\n    X509_NAME *xn;\n    int i;\n    int mdpth;\n    EVP_PKEY *mspki;\n    const char *peername;\n#ifndef OPENSSL_NO_COMP\n    const COMP_METHOD *comp, *expansion;\n#endif\n    unsigned char *exportedkeymat;\n    if (full) {\n        int got_a_chain = 0;\n        sk = SSL_get_peer_cert_chain(s);\n        if (sk != NULL) {\n            got_a_chain = 1;\n            BIO_printf(bio, "---\\nCertificate chain\\n");\n            for (i = 0; i < sk_X509_num(sk); i++) {\n                X509_NAME_oneline(X509_get_subject_name(sk_X509_value(sk, i)),\n                                  buf, sizeof buf);\n                BIO_printf(bio, "%2d s:%s\\n", i, buf);\n                X509_NAME_oneline(X509_get_issuer_name(sk_X509_value(sk, i)),\n                                  buf, sizeof buf);\n                BIO_printf(bio, "   i:%s\\n", buf);\n                if (c_showcerts)\n                    PEM_write_bio_X509(bio, sk_X509_value(sk, i));\n            }\n        }\n        BIO_printf(bio, "---\\n");\n        peer = SSL_get_peer_certificate(s);\n        if (peer != NULL) {\n            BIO_printf(bio, "Server certificate\\n");\n            if (!(c_showcerts && got_a_chain))\n                PEM_write_bio_X509(bio, peer);\n            X509_NAME_oneline(X509_get_subject_name(peer), buf, sizeof buf);\n            BIO_printf(bio, "subject=%s\\n", buf);\n            X509_NAME_oneline(X509_get_issuer_name(peer), buf, sizeof buf);\n            BIO_printf(bio, "issuer=%s\\n", buf);\n        } else\n            BIO_printf(bio, "no peer certificate available\\n");\n        sk2 = SSL_get_client_CA_list(s);\n        if ((sk2 != NULL) && (sk_X509_NAME_num(sk2) > 0)) {\n            BIO_printf(bio, "---\\nAcceptable client certificate CA names\\n");\n            for (i = 0; i < sk_X509_NAME_num(sk2); i++) {\n                xn = sk_X509_NAME_value(sk2, i);\n                X509_NAME_oneline(xn, buf, sizeof(buf));\n                BIO_write(bio, buf, strlen(buf));\n                BIO_write(bio, "\\n", 1);\n            }\n        } else {\n            BIO_printf(bio, "---\\nNo client certificate CA names sent\\n");\n        }\n        ssl_print_sigalgs(bio, s);\n        ssl_print_tmp_key(bio, s);\n        BIO_printf(bio,\n                   "---\\nSSL handshake has read %"PRIu64" bytes and written %"PRIu64" bytes\\n",\n                   BIO_number_read(SSL_get_rbio(s)),\n                   BIO_number_written(SSL_get_wbio(s)));\n    }\n    if ((mdpth = SSL_get0_dane_authority(s, NULL, &mspki)) >= 0) {\n        uint8_t usage, selector, mtype;\n        mdpth = SSL_get0_dane_tlsa(s, &usage, &selector, &mtype, NULL, NULL);\n        BIO_printf(bio, "DANE TLSA %d %d %d %s at depth %d\\n",\n                   usage, selector, mtype,\n                   (mspki != NULL) ? "TA public key verified certificate" :\n                   mdpth ? "matched TA certificate" : "matched EE certificate",\n                   mdpth);\n    }\n    if (SSL_get_verify_result(s) == X509_V_OK &&\n        (peername = SSL_get0_peername(s)) != NULL)\n        BIO_printf(bio, "Verified peername: %s\\n", peername);\n    BIO_printf(bio, (SSL_cache_hit(s) ? "---\\nReused, " : "---\\nNew, "));\n    c = SSL_get_current_cipher(s);\n    BIO_printf(bio, "%s, Cipher is %s\\n",\n               SSL_CIPHER_get_version(c), SSL_CIPHER_get_name(c));\n    if (peer != NULL) {\n        EVP_PKEY *pktmp;\n        pktmp = X509_get0_pubkey(peer);\n        BIO_printf(bio, "Server public key is %d bit\\n",\n                   EVP_PKEY_bits(pktmp));\n    }\n    BIO_printf(bio, "Secure Renegotiation IS%s supported\\n",\n               SSL_get_secure_renegotiation_support(s) ? "" : " NOT");\n#ifndef OPENSSL_NO_COMP\n    comp = SSL_get_current_compression(s);\n    expansion = SSL_get_current_expansion(s);\n    BIO_printf(bio, "Compression: %s\\n",\n               comp ? SSL_COMP_get_name(comp) : "NONE");\n    BIO_printf(bio, "Expansion: %s\\n",\n               expansion ? SSL_COMP_get_name(expansion) : "NONE");\n#endif\n#ifdef SSL_DEBUG\n    {\n        int sock;\n        struct sockaddr_in ladd;\n        socklen_t ladd_size = sizeof(ladd);\n        sock = SSL_get_fd(s);\n        getsockname(sock, (struct sockaddr *)&ladd, &ladd_size);\n        BIO_printf(bio_c_out, "LOCAL PORT is %u\\n", ntohs(ladd.sin_port));\n    }\n#endif\n#if !defined(OPENSSL_NO_NEXTPROTONEG)\n    if (next_proto.status != -1) {\n        const unsigned char *proto;\n        unsigned int proto_len;\n        SSL_get0_next_proto_negotiated(s, &proto, &proto_len);\n        BIO_printf(bio, "Next protocol: (%d) ", next_proto.status);\n        BIO_write(bio, proto, proto_len);\n        BIO_write(bio, "\\n", 1);\n    }\n#endif\n    {\n        const unsigned char *proto;\n        unsigned int proto_len;\n        SSL_get0_alpn_selected(s, &proto, &proto_len);\n        if (proto_len > 0) {\n            BIO_printf(bio, "ALPN protocol: ");\n            BIO_write(bio, proto, proto_len);\n            BIO_write(bio, "\\n", 1);\n        } else\n            BIO_printf(bio, "No ALPN negotiated\\n");\n    }\n#ifndef OPENSSL_NO_SRTP\n    {\n        SRTP_PROTECTION_PROFILE *srtp_profile =\n            SSL_get_selected_srtp_profile(s);\n        if (srtp_profile)\n            BIO_printf(bio, "SRTP Extension negotiated, profile=%s\\n",\n                       srtp_profile->name);\n    }\n#endif\n    SSL_SESSION_print(bio, SSL_get_session(s));\n    if (keymatexportlabel != NULL) {\n        BIO_printf(bio, "Keying material exporter:\\n");\n        BIO_printf(bio, "    Label: \'%s\'\\n", keymatexportlabel);\n        BIO_printf(bio, "    Length: %i bytes\\n", keymatexportlen);\n        exportedkeymat = app_malloc(keymatexportlen, "export key");\n        if (!SSL_export_keying_material(s, exportedkeymat,\n                                        keymatexportlen,\n                                        keymatexportlabel,\n                                        strlen(keymatexportlabel),\n                                        NULL, 0, 0)) {\n            BIO_printf(bio, "    Error\\n");\n        } else {\n            BIO_printf(bio, "    Keying material: ");\n            for (i = 0; i < keymatexportlen; i++)\n                BIO_printf(bio, "%02X", exportedkeymat[i]);\n            BIO_printf(bio, "\\n");\n        }\n        OPENSSL_free(exportedkeymat);\n    }\n    BIO_printf(bio, "---\\n");\n    X509_free(peer);\n    (void)BIO_flush(bio);\n}', 'char *X509_NAME_oneline(X509_NAME *a, char *buf, int len)\n{\n    X509_NAME_ENTRY *ne;\n    int i;\n    int n, lold, l, l1, l2, num, j, type;\n    const char *s;\n    char *p;\n    unsigned char *q;\n    BUF_MEM *b = NULL;\n    static const char hex[17] = "0123456789ABCDEF";\n    int gs_doit[4];\n    char tmp_buf[80];\n#ifdef CHARSET_EBCDIC\n    char ebcdic_buf[1024];\n#endif\n    if (buf == NULL) {\n        if ((b = BUF_MEM_new()) == NULL)\n            goto err;\n        if (!BUF_MEM_grow(b, 200))\n            goto err;\n        b->data[0] = \'\\0\';\n        len = 200;\n    }\n    if (a == NULL) {\n        if (b) {\n            buf = b->data;\n            OPENSSL_free(b);\n        }\n        strncpy(buf, "NO X509_NAME", len);\n        buf[len - 1] = \'\\0\';\n        return buf;\n    }\n    len--;\n    l = 0;\n    for (i = 0; i < sk_X509_NAME_ENTRY_num(a->entries); i++) {\n        ne = sk_X509_NAME_ENTRY_value(a->entries, i);\n        n = OBJ_obj2nid(ne->object);\n        if ((n == NID_undef) || ((s = OBJ_nid2sn(n)) == NULL)) {\n            i2t_ASN1_OBJECT(tmp_buf, sizeof(tmp_buf), ne->object);\n            s = tmp_buf;\n        }\n        l1 = strlen(s);\n        type = ne->value->type;\n        num = ne->value->length;\n        q = ne->value->data;\n#ifdef CHARSET_EBCDIC\n        if (type == V_ASN1_GENERALSTRING ||\n            type == V_ASN1_VISIBLESTRING ||\n            type == V_ASN1_PRINTABLESTRING ||\n            type == V_ASN1_TELETEXSTRING ||\n            type == V_ASN1_VISIBLESTRING || type == V_ASN1_IA5STRING) {\n            ascii2ebcdic(ebcdic_buf, q, (num > sizeof ebcdic_buf)\n                         ? sizeof ebcdic_buf : num);\n            q = ebcdic_buf;\n        }\n#endif\n        if ((type == V_ASN1_GENERALSTRING) && ((num % 4) == 0)) {\n            gs_doit[0] = gs_doit[1] = gs_doit[2] = gs_doit[3] = 0;\n            for (j = 0; j < num; j++)\n                if (q[j] != 0)\n                    gs_doit[j & 3] = 1;\n            if (gs_doit[0] | gs_doit[1] | gs_doit[2])\n                gs_doit[0] = gs_doit[1] = gs_doit[2] = gs_doit[3] = 1;\n            else {\n                gs_doit[0] = gs_doit[1] = gs_doit[2] = 0;\n                gs_doit[3] = 1;\n            }\n        } else\n            gs_doit[0] = gs_doit[1] = gs_doit[2] = gs_doit[3] = 1;\n        for (l2 = j = 0; j < num; j++) {\n            if (!gs_doit[j & 3])\n                continue;\n            l2++;\n#ifndef CHARSET_EBCDIC\n            if ((q[j] < \' \') || (q[j] > \'~\'))\n                l2 += 3;\n#else\n            if ((os_toascii[q[j]] < os_toascii[\' \']) ||\n                (os_toascii[q[j]] > os_toascii[\'~\']))\n                l2 += 3;\n#endif\n        }\n        lold = l;\n        l += 1 + l1 + 1 + l2;\n        if (b != NULL) {\n            if (!BUF_MEM_grow(b, l + 1))\n                goto err;\n            p = &(b->data[lold]);\n        } else if (l > len) {\n            break;\n        } else\n            p = &(buf[lold]);\n        *(p++) = \'/\';\n        memcpy(p, s, (unsigned int)l1);\n        p += l1;\n        *(p++) = \'=\';\n#ifndef CHARSET_EBCDIC\n        q = ne->value->data;\n#endif\n        for (j = 0; j < num; j++) {\n            if (!gs_doit[j & 3])\n                continue;\n#ifndef CHARSET_EBCDIC\n            n = q[j];\n            if ((n < \' \') || (n > \'~\')) {\n                *(p++) = \'\\\\\';\n                *(p++) = \'x\';\n                *(p++) = hex[(n >> 4) & 0x0f];\n                *(p++) = hex[n & 0x0f];\n            } else\n                *(p++) = n;\n#else\n            n = os_toascii[q[j]];\n            if ((n < os_toascii[\' \']) || (n > os_toascii[\'~\'])) {\n                *(p++) = \'\\\\\';\n                *(p++) = \'x\';\n                *(p++) = hex[(n >> 4) & 0x0f];\n                *(p++) = hex[n & 0x0f];\n            } else\n                *(p++) = q[j];\n#endif\n        }\n        *p = \'\\0\';\n    }\n    if (b != NULL) {\n        p = b->data;\n        OPENSSL_free(b);\n    } else\n        p = buf;\n    if (i == 0)\n        *p = \'\\0\';\n    return (p);\n err:\n    X509err(X509_F_X509_NAME_ONELINE, ERR_R_MALLOC_FAILURE);\n    BUF_MEM_free(b);\n    return (NULL);\n}']