crypto/evp/evp_pbe.c:91: error: BUFFER_OVERRUN_L1
  Offset added: 80 Size: 32 by call to `i2t_ASN1_OBJECT`.
Showing all 6 steps of the trace


crypto/evp/evp_pbe.c:91:8: Call
89.   		EVPerr(EVP_F_EVP_PBE_CIPHERINIT,EVP_R_UNKNOWN_PBE_ALGORITHM);
90.   		if (!pbe_obj) strcpy (obj_tmp, "NULL");
91.   		else i2t_ASN1_OBJECT(obj_tmp, 80, pbe_obj);
             ^
92.   		ERR_add_error_data(2, "TYPE=", obj_tmp);
93.   		return 0;

crypto/asn1/a_object.c:173:1: <Offset trace>
171.   	}
172.   
173. > int i2t_ASN1_OBJECT(char *buf, int buf_len, ASN1_OBJECT *a)
174.   	{
175.   	int i,idx=0,n=0,len,nid;

crypto/asn1/a_object.c:173:1: Parameter `buf_len`
  171.   	}
  172.   
  173. > int i2t_ASN1_OBJECT(char *buf, int buf_len, ASN1_OBJECT *a)
  174.   	{
  175.   	int i,idx=0,n=0,len,nid;

crypto/asn1/a_object.c:173:1: <Length trace>
171.   	}
172.   
173. > int i2t_ASN1_OBJECT(char *buf, int buf_len, ASN1_OBJECT *a)
174.   	{
175.   	int i,idx=0,n=0,len,nid;

crypto/asn1/a_object.c:173:1: Array declaration
  171.   	}
  172.   
  173. > int i2t_ASN1_OBJECT(char *buf, int buf_len, ASN1_OBJECT *a)
  174.   	{
  175.   	int i,idx=0,n=0,len,nid;

crypto/asn1/a_object.c:211:3: Array access: Offset added: 80 Size: 32 by call to `i2t_ASN1_OBJECT` 
  209.   		sprintf(tbuf,"%d.%lu",i,l);
  210.   		i=strlen(tbuf);
  211.   		strncpy(buf,tbuf,buf_len);
           ^
  212.   		buf_len-=i;
  213.   		buf+=i;

int i2t_ASN1_OBJECT(char *buf, int buf_len, ASN1_OBJECT *a)
	{
	int i,idx=0,n=0,len,nid;
	unsigned long l;
	unsigned char *p;
	const char *s;
	char tbuf[32];
	if (buf_len <= 0) return(0);
	if ((a == NULL) || (a->data == NULL))
		{
		buf[0]='\0';
		return(0);
		}
	nid=OBJ_obj2nid(a);
	if (nid == NID_undef)
		{
		len=a->length;
		p=a->data;
		idx=0;
		l=0;
		while (idx < a->length)
			{
			l|=(p[idx]&0x7f);
			if (!(p[idx] & 0x80)) break;
			l<<=7L;
			idx++;
			}
		idx++;
		i=(int)(l/40);
		if (i > 2) i=2;
		l-=(long)(i*40);
		sprintf(tbuf,"%d.%lu",i,l);
		i=strlen(tbuf);
		strncpy(buf,tbuf,buf_len);
		buf_len-=i;
		buf+=i;
		n+=i;
		l=0;
		for (; idx<len; idx++)
			{
			l|=p[idx]&0x7f;
			if (!(p[idx] & 0x80))
				{
				sprintf(tbuf,".%lu",l);
				i=strlen(tbuf);
				if (buf_len > 0)
					strncpy(buf,tbuf,buf_len);
				buf_len-=i;
				buf+=i;
				n+=i;
				l=0;
				}
			l<<=7L;
			}
		}
	else
		{
		s=OBJ_nid2ln(nid);
		if (s == NULL)
			s=OBJ_nid2sn(nid);
		strncpy(buf,s,buf_len);
		n=strlen(s);
		}
	buf[buf_len-1]='\0';
	return(n);
	}
['int EVP_PBE_CipherInit (ASN1_OBJECT *pbe_obj, const char *pass, int passlen,\n\t     ASN1_TYPE *param, EVP_CIPHER_CTX *ctx, int en_de)\n{\n\tEVP_PBE_CTL *pbetmp, pbelu;\n\tint i;\n\tpbelu.pbe_nid = OBJ_obj2nid(pbe_obj);\n\tif (pbelu.pbe_nid != NID_undef) i = sk_find(pbe_algs, (char *)&pbelu);\n\telse i = -1;\n\tif (i == -1) {\n\t\tchar obj_tmp[80];\n\t\tEVPerr(EVP_F_EVP_PBE_CIPHERINIT,EVP_R_UNKNOWN_PBE_ALGORITHM);\n\t\tif (!pbe_obj) strcpy (obj_tmp, "NULL");\n\t\telse i2t_ASN1_OBJECT(obj_tmp, 80, pbe_obj);\n\t\tERR_add_error_data(2, "TYPE=", obj_tmp);\n\t\treturn 0;\n\t}\n\tif (passlen == -1) passlen = strlen(pass);\n\tpbetmp = (EVP_PBE_CTL *)sk_value (pbe_algs, i);\n\ti = (*pbetmp->keygen)(ctx, pass, passlen, param, pbetmp->cipher,\n\t\t\t\t\t\t pbetmp->md, en_de);\n\tif (!i) {\n\t\tEVPerr(EVP_F_EVP_PBE_CIPHERINIT,EVP_R_KEYGEN_FAILURE);\n\t\treturn 0;\n\t}\n\treturn 1;\n}', 'int i2t_ASN1_OBJECT(char *buf, int buf_len, ASN1_OBJECT *a)\n\t{\n\tint i,idx=0,n=0,len,nid;\n\tunsigned long l;\n\tunsigned char *p;\n\tconst char *s;\n\tchar tbuf[32];\n\tif (buf_len <= 0) return(0);\n\tif ((a == NULL) || (a->data == NULL))\n\t\t{\n\t\tbuf[0]=\'\\0\';\n\t\treturn(0);\n\t\t}\n\tnid=OBJ_obj2nid(a);\n\tif (nid == NID_undef)\n\t\t{\n\t\tlen=a->length;\n\t\tp=a->data;\n\t\tidx=0;\n\t\tl=0;\n\t\twhile (idx < a->length)\n\t\t\t{\n\t\t\tl|=(p[idx]&0x7f);\n\t\t\tif (!(p[idx] & 0x80)) break;\n\t\t\tl<<=7L;\n\t\t\tidx++;\n\t\t\t}\n\t\tidx++;\n\t\ti=(int)(l/40);\n\t\tif (i > 2) i=2;\n\t\tl-=(long)(i*40);\n\t\tsprintf(tbuf,"%d.%lu",i,l);\n\t\ti=strlen(tbuf);\n\t\tstrncpy(buf,tbuf,buf_len);\n\t\tbuf_len-=i;\n\t\tbuf+=i;\n\t\tn+=i;\n\t\tl=0;\n\t\tfor (; idx<len; idx++)\n\t\t\t{\n\t\t\tl|=p[idx]&0x7f;\n\t\t\tif (!(p[idx] & 0x80))\n\t\t\t\t{\n\t\t\t\tsprintf(tbuf,".%lu",l);\n\t\t\t\ti=strlen(tbuf);\n\t\t\t\tif (buf_len > 0)\n\t\t\t\t\tstrncpy(buf,tbuf,buf_len);\n\t\t\t\tbuf_len-=i;\n\t\t\t\tbuf+=i;\n\t\t\t\tn+=i;\n\t\t\t\tl=0;\n\t\t\t\t}\n\t\t\tl<<=7L;\n\t\t\t}\n\t\t}\n\telse\n\t\t{\n\t\ts=OBJ_nid2ln(nid);\n\t\tif (s == NULL)\n\t\t\ts=OBJ_nid2sn(nid);\n\t\tstrncpy(buf,s,buf_len);\n\t\tn=strlen(s);\n\t\t}\n\tbuf[buf_len-1]=\'\\0\';\n\treturn(n);\n\t}']