crypto/pkcs12/p12_utl.c:73: error: BUFFER_OVERRUN_L2
  Offset: [1, 2⋅`asc->strlen` + 2] Size: [2⋅`asc->strlen` + 2, 2⋅`asc->strlen` + 2].
Showing all 8 steps of the trace


crypto/pkcs12/p12_utl.c:71:7: <Offset trace>
69.   	ulen = strlen(asc)*2  + 2;
70.   	if (!(unitmp = Malloc (ulen))) return NULL;
71.   	for (i = 0; i < ulen; i+=2) {
            ^
72.   		unitmp[i] = 0;
73.   		unitmp[i + 1] = asc[i>>1];

crypto/pkcs12/p12_utl.c:71:7: Assignment
69.   	ulen = strlen(asc)*2  + 2;
70.   	if (!(unitmp = Malloc (ulen))) return NULL;
71.   	for (i = 0; i < ulen; i+=2) {
            ^
72.   		unitmp[i] = 0;
73.   		unitmp[i + 1] = asc[i>>1];

crypto/pkcs12/p12_utl.c:65:1: <Length trace>
63.   /* Cheap and nasty Unicode stuff */
64.   
65. > unsigned char *asc2uni (unsigned char *asc, unsigned char **uni, int *unilen)
66.   {
67.   	int ulen, i;

crypto/pkcs12/p12_utl.c:65:1: Parameter `asc->strlen`
63.   /* Cheap and nasty Unicode stuff */
64.   
65. > unsigned char *asc2uni (unsigned char *asc, unsigned char **uni, int *unilen)
66.   {
67.   	int ulen, i;

crypto/pkcs12/p12_utl.c:69:2: Assignment
67.   	int ulen, i;
68.   	unsigned char *unitmp;
69.   	ulen = strlen(asc)*2  + 2;
       ^
70.   	if (!(unitmp = Malloc (ulen))) return NULL;
71.   	for (i = 0; i < ulen; i+=2) {

crypto/pkcs12/p12_utl.c:70:17: Array declaration
68.   	unsigned char *unitmp;
69.   	ulen = strlen(asc)*2  + 2;
70.   	if (!(unitmp = Malloc (ulen))) return NULL;
                      ^
71.   	for (i = 0; i < ulen; i+=2) {
72.   		unitmp[i] = 0;

crypto/pkcs12/p12_utl.c:70:8: Assignment
68.   	unsigned char *unitmp;
69.   	ulen = strlen(asc)*2  + 2;
70.   	if (!(unitmp = Malloc (ulen))) return NULL;
             ^
71.   	for (i = 0; i < ulen; i+=2) {
72.   		unitmp[i] = 0;

crypto/pkcs12/p12_utl.c:73:3: Array access: Offset: [1, 2⋅asc->strlen + 2] Size: [2⋅asc->strlen + 2, 2⋅asc->strlen + 2]
71.   	for (i = 0; i < ulen; i+=2) {
72.   		unitmp[i] = 0;
73.   		unitmp[i + 1] = asc[i>>1];
        ^
74.   	}
75.   	if (unilen) *unilen = ulen;

unsigned char *asc2uni (unsigned char *asc, unsigned char **uni, int *unilen)
{
	int ulen, i;
	unsigned char *unitmp;
	ulen = strlen(asc)*2  + 2;
	if (!(unitmp = Malloc (ulen))) return NULL;
	for (i = 0; i < ulen; i+=2) {
		unitmp[i] = 0;
		unitmp[i + 1] = asc[i>>1];
	}
	if (unilen) *unilen = ulen;
	if (uni) *uni = unitmp;
	return unitmp;
}
['unsigned char *asc2uni (unsigned char *asc, unsigned char **uni, int *unilen)\n{\n\tint ulen, i;\n\tunsigned char *unitmp;\n\tulen = strlen(asc)*2  + 2;\n\tif (!(unitmp = Malloc (ulen))) return NULL;\n\tfor (i = 0; i < ulen; i+=2) {\n\t\tunitmp[i] = 0;\n\t\tunitmp[i + 1] = asc[i>>1];\n\t}\n\tif (unilen) *unilen = ulen;\n\tif (uni) *uni = unitmp;\n\treturn unitmp;\n}']