crypto/asn1/x_pubkey.c:160: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, +oo] by call to `i2d_DSAparams`.
Showing all 15 steps of the trace


crypto/asn1/x_pubkey.c:157:5: Call
155.   		dsa->write_params=0;
156.   		ASN1_TYPE_free(a->parameter);
157.   		i=i2d_DSAparams(dsa,NULL);
           ^
158.   		p=(unsigned char *)Malloc(i);
159.   		pp=p;

crypto/asn1/i2d_dsap.c:74:17: Assignment
  72.   	unsigned char *p;
  73.   
  74.   	if (a == NULL) return(0);
                        ^
  75.   	num[0]=a->p;
  76.   	num[1]=a->q;

crypto/asn1/x_pubkey.c:157:3: Assignment
155.   		dsa->write_params=0;
156.   		ASN1_TYPE_free(a->parameter);
157.   		i=i2d_DSAparams(dsa,NULL);
         ^
158.   		p=(unsigned char *)Malloc(i);
159.   		pp=p;

crypto/asn1/x_pubkey.c:158:22: Array declaration
156.   		ASN1_TYPE_free(a->parameter);
157.   		i=i2d_DSAparams(dsa,NULL);
158.   		p=(unsigned char *)Malloc(i);
                            ^
159.   		pp=p;
160.   		i2d_DSAparams(dsa,&pp);

crypto/asn1/x_pubkey.c:158:3: Assignment
156.   		ASN1_TYPE_free(a->parameter);
157.   		i=i2d_DSAparams(dsa,NULL);
158.   		p=(unsigned char *)Malloc(i);
         ^
159.   		pp=p;
160.   		i2d_DSAparams(dsa,&pp);

crypto/asn1/x_pubkey.c:159:3: Assignment
157.   		i=i2d_DSAparams(dsa,NULL);
158.   		p=(unsigned char *)Malloc(i);
159.   		pp=p;
         ^
160.   		i2d_DSAparams(dsa,&pp);
161.   		a->parameter=ASN1_TYPE_new();

crypto/asn1/x_pubkey.c:160:3: Call
158.   		p=(unsigned char *)Malloc(i);
159.   		pp=p;
160.   		i2d_DSAparams(dsa,&pp);
         ^
161.   		a->parameter=ASN1_TYPE_new();
162.   		a->parameter->type=V_ASN1_SEQUENCE;

crypto/asn1/i2d_dsap.c:66:1: Parameter `**pp`
  64.   #include <openssl/dsa.h>
  65.   
  66. > int i2d_DSAparams(DSA *a, unsigned char **pp)
  67.   	{
  68.   	BIGNUM *num[3];

crypto/asn1/i2d_dsap.c:93:2: Assignment
  91.   	if (pp == NULL) return(t);
  92.   
  93.   	p= *pp;
         ^
  94.   	ASN1_put_object(&p,1,tot,V_ASN1_SEQUENCE,V_ASN1_UNIVERSAL);
  95.   

crypto/asn1/i2d_dsap.c:94:2: Call
  92.   
  93.   	p= *pp;
  94.   	ASN1_put_object(&p,1,tot,V_ASN1_SEQUENCE,V_ASN1_UNIVERSAL);
         ^
  95.   
  96.   	bs.type=V_ASN1_INTEGER;

crypto/asn1/asn1_lib.c:180:1: <Length trace>
178.   /* class 0 is constructed
179.    * constructed == 2 for indefinitle length constructed */
180. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
181.   	     int xclass)
182.   	{

crypto/asn1/asn1_lib.c:180:1: Parameter `**pp`
    178.   /* class 0 is constructed
    179.    * constructed == 2 for indefinitle length constructed */
    180. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
    181.   	     int xclass)
    182.   	{

crypto/asn1/asn1_lib.c:183:2: Assignment
    181.   	     int xclass)
    182.   	{
    183.   	unsigned char *p= *pp;
            ^
    184.   	int i;
    185.   

crypto/asn1/asn1_lib.c:192:5: Assignment
    190.   	else
    191.   		{
    192.   		*(p++)=i|V_ASN1_PRIMITIVE_TAG;
               ^
    193.   		while (tag > 0x7f)
    194.   			{

crypto/asn1/asn1_lib.c:198:3: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `i2d_DSAparams` 
    196.   			tag>>=7;
    197.   			}
    198.   		*(p++)=(tag&0x7f);
             ^
    199.   		}
    200.   	if ((constructed == 2) && (length == 0))

void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
	     int xclass)
	{
	unsigned char *p= *pp;
	int i;
	i=(constructed)?V_ASN1_CONSTRUCTED:0;
	i|=(xclass&V_ASN1_PRIVATE);
	if (tag < 31)
		*(p++)=i|(tag&V_ASN1_PRIMITIVE_TAG);
	else
		{
		*(p++)=i|V_ASN1_PRIMITIVE_TAG;
		while (tag > 0x7f)
			{
			*(p++)=(tag&0x7f)|0x80;
			tag>>=7;
			}
		*(p++)=(tag&0x7f);
		}
	if ((constructed == 2) && (length == 0))
		*(p++)=0x80;
	else
		asn1_put_length(&p,length);
	*pp=p;
	}
['int X509_PUBKEY_set(X509_PUBKEY **x, EVP_PKEY *pkey)\n\t{\n\tint ok=0;\n\tX509_PUBKEY *pk;\n\tX509_ALGOR *a;\n\tASN1_OBJECT *o;\n\tunsigned char *s,*p;\n\tint i;\n\tif (x == NULL) return(0);\n\tif ((pk=X509_PUBKEY_new()) == NULL) goto err;\n\ta=pk->algor;\n\tif ((o=OBJ_nid2obj(pkey->type)) == NULL) goto err;\n\tASN1_OBJECT_free(a->algorithm);\n\ta->algorithm=o;\n\tif (!pkey->save_parameters || (pkey->type == EVP_PKEY_RSA))\n\t\t{\n\t\tif ((a->parameter == NULL) ||\n\t\t\t(a->parameter->type != V_ASN1_NULL))\n\t\t\t{\n\t\t\tASN1_TYPE_free(a->parameter);\n\t\t\ta->parameter=ASN1_TYPE_new();\n\t\t\ta->parameter->type=V_ASN1_NULL;\n\t\t\t}\n\t\t}\n\telse\n#ifndef NO_DSA\n\t\tif (pkey->type == EVP_PKEY_DSA)\n\t\t{\n\t\tunsigned char *pp;\n\t\tDSA *dsa;\n\t\tdsa=pkey->pkey.dsa;\n\t\tdsa->write_params=0;\n\t\tASN1_TYPE_free(a->parameter);\n\t\ti=i2d_DSAparams(dsa,NULL);\n\t\tp=(unsigned char *)Malloc(i);\n\t\tpp=p;\n\t\ti2d_DSAparams(dsa,&pp);\n\t\ta->parameter=ASN1_TYPE_new();\n\t\ta->parameter->type=V_ASN1_SEQUENCE;\n\t\ta->parameter->value.sequence=ASN1_STRING_new();\n\t\tASN1_STRING_set(a->parameter->value.sequence,p,i);\n\t\tFree(p);\n\t\t}\n\telse\n#endif\n\t\t{\n\t\tX509err(X509_F_X509_PUBKEY_SET,X509_R_UNSUPPORTED_ALGORITHM);\n\t\tgoto err;\n\t\t}\n\tif ((i=i2d_PublicKey(pkey,NULL)) <= 0) goto err;\n\tif ((s=(unsigned char *)Malloc(i+1)) == NULL) goto err;\n\tp=s;\n\ti2d_PublicKey(pkey,&p);\n\tif (!ASN1_BIT_STRING_set(pk->public_key,s,i)) goto err;\n\tpk->public_key->flags&= ~(ASN1_STRING_FLAG_BITS_LEFT|0x07);\n\tpk->public_key->flags|=ASN1_STRING_FLAG_BITS_LEFT;\n\tFree(s);\n\tCRYPTO_add(&pkey->references,1,CRYPTO_LOCK_EVP_PKEY);\n\tpk->pkey=pkey;\n\tif (*x != NULL)\n\t\tX509_PUBKEY_free(*x);\n\t*x=pk;\n\tpk=NULL;\n\tok=1;\nerr:\n\tif (pk != NULL) X509_PUBKEY_free(pk);\n\treturn(ok);\n\t}', 'int i2d_DSAparams(DSA *a, unsigned char **pp)\n\t{\n\tBIGNUM *num[3];\n\tASN1_INTEGER bs;\n\tunsigned int j,i,tot=0,len,max=0;\n\tint t,ret= -1;\n\tunsigned char *p;\n\tif (a == NULL) return(0);\n\tnum[0]=a->p;\n\tnum[1]=a->q;\n\tnum[2]=a->g;\n\tfor (i=0; i<3; i++)\n\t\t{\n\t\tif (num[i] == NULL) continue;\n\t\tj=BN_num_bits(num[i]);\n\t\tlen=((j == 0)?0:((j/8)+1));\n\t\tif (len > max) max=len;\n\t\tlen=ASN1_object_size(0,len,\n\t\t\t(num[i]->neg)?V_ASN1_NEG_INTEGER:V_ASN1_INTEGER);\n\t\ttot+=len;\n\t\t}\n\tt=ASN1_object_size(1,tot,V_ASN1_SEQUENCE);\n\tif (pp == NULL) return(t);\n\tp= *pp;\n\tASN1_put_object(&p,1,tot,V_ASN1_SEQUENCE,V_ASN1_UNIVERSAL);\n\tbs.type=V_ASN1_INTEGER;\n\tbs.data=(unsigned char *)Malloc(max+4);\n\tif (bs.data == NULL)\n\t\t{\n\t\tASN1err(ASN1_F_I2D_DSAPARAMS,ERR_R_MALLOC_FAILURE);\n\t\tgoto err;\n\t\t}\n\tfor (i=0; i<3; i++)\n\t\t{\n\t\tif (num[i] == NULL) continue;\n\t\tbs.length=BN_bn2bin(num[i],bs.data);\n\t\ti2d_ASN1_INTEGER(&bs,&p);\n\t\t}\n\tFree((char *)bs.data);\n\tret=t;\nerr:\n\t*pp=p;\n\treturn(ret);\n\t}', 'void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,\n\t     int xclass)\n\t{\n\tunsigned char *p= *pp;\n\tint i;\n\ti=(constructed)?V_ASN1_CONSTRUCTED:0;\n\ti|=(xclass&V_ASN1_PRIVATE);\n\tif (tag < 31)\n\t\t*(p++)=i|(tag&V_ASN1_PRIMITIVE_TAG);\n\telse\n\t\t{\n\t\t*(p++)=i|V_ASN1_PRIMITIVE_TAG;\n\t\twhile (tag > 0x7f)\n\t\t\t{\n\t\t\t*(p++)=(tag&0x7f)|0x80;\n\t\t\ttag>>=7;\n\t\t\t}\n\t\t*(p++)=(tag&0x7f);\n\t\t}\n\tif ((constructed == 2) && (length == 0))\n\t\t*(p++)=0x80;\n\telse\n\t\tasn1_put_length(&p,length);\n\t*pp=p;\n\t}']