crypto/pem/pem_seal.c:106: error: BUFFER_OVERRUN_L3
  Offset added: [1, +oo] Size: [0, +oo].
Showing all 10 steps of the trace


crypto/pem/pem_seal.c:103:5: <Offset trace>
101.   	for (i=0; i<npubk; i++)
102.   		{
103.   		j=EVP_EncodeBlock((unsigned char *)s,ek[i],
           ^
104.   			RSA_size(pubk[i]->pkey.rsa));
105.   		ekl[i]=j;

crypto/pem/pem_seal.c:103:5: Call
101.   	for (i=0; i<npubk; i++)
102.   		{
103.   		j=EVP_EncodeBlock((unsigned char *)s,ek[i],
           ^
104.   			RSA_size(pubk[i]->pkey.rsa));
105.   		ekl[i]=j;

crypto/evp/encode.c:190:2: Assignment
  188.   int EVP_EncodeBlock(unsigned char *t, const unsigned char *f, int dlen)
  189.   	{
  190.   	int i,ret=0;
          ^
  191.   	unsigned long l;
  192.   

crypto/evp/encode.c:219:2: Assignment
  217.   
  218.   	*t='\0';
  219.   	return(ret);
          ^
  220.   	}
  221.   

crypto/pem/pem_seal.c:103:3: Assignment
101.   	for (i=0; i<npubk; i++)
102.   		{
103.   		j=EVP_EncodeBlock((unsigned char *)s,ek[i],
         ^
104.   			RSA_size(pubk[i]->pkey.rsa));
105.   		ekl[i]=j;

crypto/pem/pem_seal.c:74:2: <Length trace>
72.   	unsigned char key[EVP_MAX_KEY_LENGTH];
73.   	int ret= -1;
74.   	int i,j,max=0;
       ^
75.   	char *s=NULL;
76.   

crypto/pem/pem_seal.c:74:2: Assignment
72.   	unsigned char key[EVP_MAX_KEY_LENGTH];
73.   	int ret= -1;
74.   	int i,j,max=0;
       ^
75.   	char *s=NULL;
76.   

crypto/pem/pem_seal.c:87:12: Array declaration
85.   		if (j > max) max=j;
86.   		}
87.   	s=(char *)Malloc(max*2);
                 ^
88.   	if (s == NULL)
89.   		{

crypto/pem/pem_seal.c:87:2: Assignment
85.   		if (j > max) max=j;
86.   		}
87.   	s=(char *)Malloc(max*2);
       ^
88.   	if (s == NULL)
89.   		{

crypto/pem/pem_seal.c:106:3: Array access: Offset added: [1, +oo] Size: [0, +oo]
104.   			RSA_size(pubk[i]->pkey.rsa));
105.   		ekl[i]=j;
106.   		memcpy(ek[i],s,j+1);
         ^
107.   		}
108.   

int PEM_SealInit(PEM_ENCODE_SEAL_CTX *ctx, EVP_CIPHER *type, EVP_MD *md_type,
	     unsigned char **ek, int *ekl, unsigned char *iv, EVP_PKEY **pubk,
	     int npubk)
	{
	unsigned char key[EVP_MAX_KEY_LENGTH];
	int ret= -1;
	int i,j,max=0;
	char *s=NULL;
	for (i=0; i<npubk; i++)
		{
		if (pubk[i]->type != EVP_PKEY_RSA)
			{
			PEMerr(PEM_F_PEM_SEALINIT,PEM_R_PUBLIC_KEY_NO_RSA);
			goto err;
			}
		j=RSA_size(pubk[i]->pkey.rsa);
		if (j > max) max=j;
		}
	s=(char *)Malloc(max*2);
	if (s == NULL)
		{
		PEMerr(PEM_F_PEM_SEALINIT,ERR_R_MALLOC_FAILURE);
		goto err;
		}
	EVP_EncodeInit(&(ctx->encode));
	EVP_SignInit(&(ctx->md),md_type);
	ret=EVP_SealInit(&(ctx->cipher),type,ek,ekl,iv,pubk,npubk);
	if (!ret) goto err;
	for (i=0; i<npubk; i++)
		{
		j=EVP_EncodeBlock((unsigned char *)s,ek[i],
			RSA_size(pubk[i]->pkey.rsa));
		ekl[i]=j;
		memcpy(ek[i],s,j+1);
		}
	ret=npubk;
err:
	if (s != NULL) Free(s);
	memset(key,0,EVP_MAX_KEY_LENGTH);
	return(ret);
	}
['int PEM_SealInit(PEM_ENCODE_SEAL_CTX *ctx, EVP_CIPHER *type, EVP_MD *md_type,\n\t     unsigned char **ek, int *ekl, unsigned char *iv, EVP_PKEY **pubk,\n\t     int npubk)\n\t{\n\tunsigned char key[EVP_MAX_KEY_LENGTH];\n\tint ret= -1;\n\tint i,j,max=0;\n\tchar *s=NULL;\n\tfor (i=0; i<npubk; i++)\n\t\t{\n\t\tif (pubk[i]->type != EVP_PKEY_RSA)\n\t\t\t{\n\t\t\tPEMerr(PEM_F_PEM_SEALINIT,PEM_R_PUBLIC_KEY_NO_RSA);\n\t\t\tgoto err;\n\t\t\t}\n\t\tj=RSA_size(pubk[i]->pkey.rsa);\n\t\tif (j > max) max=j;\n\t\t}\n\ts=(char *)Malloc(max*2);\n\tif (s == NULL)\n\t\t{\n\t\tPEMerr(PEM_F_PEM_SEALINIT,ERR_R_MALLOC_FAILURE);\n\t\tgoto err;\n\t\t}\n\tEVP_EncodeInit(&(ctx->encode));\n\tEVP_SignInit(&(ctx->md),md_type);\n\tret=EVP_SealInit(&(ctx->cipher),type,ek,ekl,iv,pubk,npubk);\n\tif (!ret) goto err;\n\tfor (i=0; i<npubk; i++)\n\t\t{\n\t\tj=EVP_EncodeBlock((unsigned char *)s,ek[i],\n\t\t\tRSA_size(pubk[i]->pkey.rsa));\n\t\tekl[i]=j;\n\t\tmemcpy(ek[i],s,j+1);\n\t\t}\n\tret=npubk;\nerr:\n\tif (s != NULL) Free(s);\n\tmemset(key,0,EVP_MAX_KEY_LENGTH);\n\treturn(ret);\n\t}', "int EVP_EncodeBlock(unsigned char *t, const unsigned char *f, int dlen)\n\t{\n\tint i,ret=0;\n\tunsigned long l;\n\tfor (i=dlen; i > 0; i-=3)\n\t\t{\n\t\tif (i >= 3)\n\t\t\t{\n\t\t\tl=\t(((unsigned long)f[0])<<16L)|\n\t\t\t\t(((unsigned long)f[1])<< 8L)|f[2];\n\t\t\t*(t++)=conv_bin2ascii(l>>18L);\n\t\t\t*(t++)=conv_bin2ascii(l>>12L);\n\t\t\t*(t++)=conv_bin2ascii(l>> 6L);\n\t\t\t*(t++)=conv_bin2ascii(l     );\n\t\t\t}\n\t\telse\n\t\t\t{\n\t\t\tl=((unsigned long)f[0])<<16L;\n\t\t\tif (i == 2) l|=((unsigned long)f[1]<<8L);\n\t\t\t*(t++)=conv_bin2ascii(l>>18L);\n\t\t\t*(t++)=conv_bin2ascii(l>>12L);\n\t\t\t*(t++)=(i == 1)?'=':conv_bin2ascii(l>> 6L);\n\t\t\t*(t++)='=';\n\t\t\t}\n\t\tret+=4;\n\t\tf+=3;\n\t\t}\n\t*t='\\0';\n\treturn(ret);\n\t}"]