crypto/asn1/p5_pbe.c:149: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] (⇐ [2, +oo] + [0, +oo]) Size: [0, +oo] by call to `i2d_PBEPARAM`.
Showing all 22 steps of the trace


crypto/asn1/p5_pbe.c:140:15: Call
138.   	if (salt) memcpy (pbe->salt->data, salt, saltlen);
139.   	else RAND_bytes (pbe->salt->data, saltlen);
140.   	if (!(plen = i2d_PBEPARAM (pbe, NULL))) {
                     ^
141.   		ASN1err(ASN1_F_ASN1_PBE_SET,ASN1_R_ENCODE_ERROR);
142.   		return NULL;

crypto/asn1/p5_pbe.c:75:2: Assignment
  73.   int i2d_PBEPARAM(PBEPARAM *a, unsigned char **pp)
  74.   {
  75.   	M_ASN1_I2D_vars(a);
         ^
  76.   	M_ASN1_I2D_len (a->salt, i2d_ASN1_OCTET_STRING);
  77.   	M_ASN1_I2D_len (a->iter, i2d_ASN1_INTEGER);

crypto/asn1/p5_pbe.c:140:8: Assignment
138.   	if (salt) memcpy (pbe->salt->data, salt, saltlen);
139.   	else RAND_bytes (pbe->salt->data, saltlen);
140.   	if (!(plen = i2d_PBEPARAM (pbe, NULL))) {
              ^
141.   		ASN1err(ASN1_F_ASN1_PBE_SET,ASN1_R_ENCODE_ERROR);
142.   		return NULL;

crypto/asn1/p5_pbe.c:144:16: Array declaration
142.   		return NULL;
143.   	}
144.   	if (!(pdata = Malloc (plen))) {
                      ^
145.   		ASN1err(ASN1_F_ASN1_PBE_SET,ERR_R_MALLOC_FAILURE);
146.   		return NULL;

crypto/asn1/p5_pbe.c:144:8: Assignment
142.   		return NULL;
143.   	}
144.   	if (!(pdata = Malloc (plen))) {
              ^
145.   		ASN1err(ASN1_F_ASN1_PBE_SET,ERR_R_MALLOC_FAILURE);
146.   		return NULL;

crypto/asn1/p5_pbe.c:148:2: Assignment
146.   		return NULL;
147.   	}
148.   	ptmp = pdata;
        ^
149.   	i2d_PBEPARAM (pbe, &ptmp);
150.   	PBEPARAM_free (pbe);

crypto/asn1/p5_pbe.c:149:2: Call
147.   	}
148.   	ptmp = pdata;
149.   	i2d_PBEPARAM (pbe, &ptmp);
        ^
150.   	PBEPARAM_free (pbe);
151.   

crypto/asn1/p5_pbe.c:73:1: Parameter `**pp`
  71.    */
  72.   
  73. > int i2d_PBEPARAM(PBEPARAM *a, unsigned char **pp)
  74.   {
  75.   	M_ASN1_I2D_vars(a);

crypto/asn1/p5_pbe.c:79:2: Assignment
  77.   	M_ASN1_I2D_len (a->iter, i2d_ASN1_INTEGER);
  78.   
  79.   	M_ASN1_I2D_seq_total ();
         ^
  80.   
  81.   	M_ASN1_I2D_put (a->salt, i2d_ASN1_OCTET_STRING);

crypto/asn1/p5_pbe.c:79:2: Call
  77.   	M_ASN1_I2D_len (a->iter, i2d_ASN1_INTEGER);
  78.   
  79.   	M_ASN1_I2D_seq_total ();
         ^
  80.   
  81.   	M_ASN1_I2D_put (a->salt, i2d_ASN1_OCTET_STRING);

crypto/asn1/asn1_lib.c:186:1: Parameter `**pp`
    184.   /* class 0 is constructed
    185.    * constructed == 2 for indefinitle length constructed */
    186. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
    187.   	     int xclass)
    188.   	{

crypto/asn1/asn1_lib.c:189:2: Assignment
    187.   	     int xclass)
    188.   	{
    189.   	unsigned char *p= *pp;
            ^
    190.   	int i;
    191.   

crypto/asn1/asn1_lib.c:195:5: Assignment
    193.   	i|=(xclass&V_ASN1_PRIVATE);
    194.   	if (tag < 31)
    195.   		*(p++)=i|(tag&V_ASN1_PRIMATIVE_TAG);
               ^
    196.   	else
    197.   		{

crypto/asn1/asn1_lib.c:209:3: Call
    207.   		*(p++)=0x80; /* der_put_length would output 0 instead */
    208.   	else
    209.   		asn1_put_length(&p,length);
             ^
    210.   	*pp=p;
    211.   	}

crypto/asn1/asn1_lib.c:222:8: <Offset trace>
220.   		{
221.   		l=length;
222.   		for (i=0; l > 0; i++)
              ^
223.   			l>>=8;
224.   		*(p++)=i|0x80;

crypto/asn1/asn1_lib.c:222:8: Assignment
      220.   		{
      221.   		l=length;
      222.   		for (i=0; l > 0; i++)
                    ^
      223.   			l>>=8;
      224.   		*(p++)=i|0x80;

crypto/asn1/asn1_lib.c:226:10: Assignment
      224.   		*(p++)=i|0x80;
      225.   		l=i;
      226.   		while (i-- > 0)
                      ^
      227.   			{
      228.   			p[i]=length&0xff;

crypto/asn1/asn1_lib.c:213:1: <Length trace>
211.   	}
212.   
213. > static void asn1_put_length(unsigned char **pp, int length)
214.   	{
215.   	unsigned char *p= *pp;

crypto/asn1/asn1_lib.c:213:1: Parameter `**pp`
      211.   	}
      212.   
      213. > static void asn1_put_length(unsigned char **pp, int length)
      214.   	{
      215.   	unsigned char *p= *pp;

crypto/asn1/asn1_lib.c:215:2: Assignment
      213.   static void asn1_put_length(unsigned char **pp, int length)
      214.   	{
      215.   	unsigned char *p= *pp;
              ^
      216.   	int i,l;
      217.   	if (length <= 127)

crypto/asn1/asn1_lib.c:224:5: Assignment
      222.   		for (i=0; l > 0; i++)
      223.   			l>>=8;
      224.   		*(p++)=i|0x80;
                 ^
      225.   		l=i;
      226.   		while (i-- > 0)

crypto/asn1/asn1_lib.c:228:4: Array access: Offset: [2, +oo] (⇐ [2, +oo] + [0, +oo]) Size: [0, +oo] by call to `i2d_PBEPARAM` 
      226.   		while (i-- > 0)
      227.   			{
      228.   			p[i]=length&0xff;
                ^
      229.   			length>>=8;
      230.   			}

static void asn1_put_length(unsigned char **pp, int length)
	{
	unsigned char *p= *pp;
	int i,l;
	if (length <= 127)
		*(p++)=(unsigned char)length;
	else
		{
		l=length;
		for (i=0; l > 0; i++)
			l>>=8;
		*(p++)=i|0x80;
		l=i;
		while (i-- > 0)
			{
			p[i]=length&0xff;
			length>>=8;
			}
		p+=l;
		}
	*pp=p;
	}
['X509_ALGOR *PKCS5_pbe_set(int alg, int iter, unsigned char *salt,\n\t     int saltlen)\n{\n\tunsigned char *pdata, *ptmp;\n\tint plen;\n\tPBEPARAM *pbe;\n\tASN1_OBJECT *al;\n\tX509_ALGOR *algor;\n\tASN1_TYPE *astype;\n\tif (!(pbe = PBEPARAM_new ())) {\n\t\tASN1err(ASN1_F_ASN1_PBE_SET,ERR_R_MALLOC_FAILURE);\n\t\treturn NULL;\n\t}\n\tASN1_INTEGER_set (pbe->iter, iter);\n\tif (!saltlen) saltlen = PKCS5_SALT_LEN;\n\tif (!(pbe->salt->data = Malloc (saltlen))) {\n\t\tASN1err(ASN1_F_ASN1_PBE_SET,ERR_R_MALLOC_FAILURE);\n\t\treturn NULL;\n\t}\n\tpbe->salt->length = saltlen;\n\tif (salt) memcpy (pbe->salt->data, salt, saltlen);\n\telse RAND_bytes (pbe->salt->data, saltlen);\n\tif (!(plen = i2d_PBEPARAM (pbe, NULL))) {\n\t\tASN1err(ASN1_F_ASN1_PBE_SET,ASN1_R_ENCODE_ERROR);\n\t\treturn NULL;\n\t}\n\tif (!(pdata = Malloc (plen))) {\n\t\tASN1err(ASN1_F_ASN1_PBE_SET,ERR_R_MALLOC_FAILURE);\n\t\treturn NULL;\n\t}\n\tptmp = pdata;\n\ti2d_PBEPARAM (pbe, &ptmp);\n\tPBEPARAM_free (pbe);\n\tif (!(astype = ASN1_TYPE_new())) {\n\t\tASN1err(ASN1_F_ASN1_PBE_SET,ERR_R_MALLOC_FAILURE);\n\t\treturn NULL;\n\t}\n\tastype->type = V_ASN1_SEQUENCE;\n\tif (!(astype->value.sequence=ASN1_STRING_new())) {\n\t\tASN1err(ASN1_F_ASN1_PBE_SET,ERR_R_MALLOC_FAILURE);\n\t\treturn NULL;\n\t}\n\tASN1_STRING_set (astype->value.sequence, pdata, plen);\n\tFree (pdata);\n\tal = OBJ_nid2obj(alg);\n\tif (!(algor = X509_ALGOR_new())) {\n\t\tASN1err(ASN1_F_ASN1_PBE_SET,ERR_R_MALLOC_FAILURE);\n\t\treturn NULL;\n\t}\n\tASN1_OBJECT_free(algor->algorithm);\n\talgor->algorithm = al;\n\talgor->parameter = astype;\n\treturn (algor);\n}', 'int i2d_PBEPARAM(PBEPARAM *a, unsigned char **pp)\n{\n\tM_ASN1_I2D_vars(a);\n\tM_ASN1_I2D_len (a->salt, i2d_ASN1_OCTET_STRING);\n\tM_ASN1_I2D_len (a->iter, i2d_ASN1_INTEGER);\n\tM_ASN1_I2D_seq_total ();\n\tM_ASN1_I2D_put (a->salt, i2d_ASN1_OCTET_STRING);\n\tM_ASN1_I2D_put (a->iter, i2d_ASN1_INTEGER);\n\tM_ASN1_I2D_finish();\n}', 'void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,\n\t     int xclass)\n\t{\n\tunsigned char *p= *pp;\n\tint i;\n\ti=(constructed)?V_ASN1_CONSTRUCTED:0;\n\ti|=(xclass&V_ASN1_PRIVATE);\n\tif (tag < 31)\n\t\t*(p++)=i|(tag&V_ASN1_PRIMATIVE_TAG);\n\telse\n\t\t{\n\t\t*(p++)=i|V_ASN1_PRIMATIVE_TAG;\n\t\twhile (tag > 0x7f)\n\t\t\t{\n\t\t\t*(p++)=(tag&0x7f)|0x80;\n\t\t\ttag>>=7;\n\t\t\t}\n\t\t*(p++)=(tag&0x7f);\n\t\t}\n\tif ((constructed == 2) && (length == 0))\n\t\t*(p++)=0x80;\n\telse\n\t\tasn1_put_length(&p,length);\n\t*pp=p;\n\t}', 'static void asn1_put_length(unsigned char **pp, int length)\n\t{\n\tunsigned char *p= *pp;\n\tint i,l;\n\tif (length <= 127)\n\t\t*(p++)=(unsigned char)length;\n\telse\n\t\t{\n\t\tl=length;\n\t\tfor (i=0; l > 0; i++)\n\t\t\tl>>=8;\n\t\t*(p++)=i|0x80;\n\t\tl=i;\n\t\twhile (i-- > 0)\n\t\t\t{\n\t\t\tp[i]=length&0xff;\n\t\t\tlength>>=8;\n\t\t\t}\n\t\tp+=l;\n\t\t}\n\t*pp=p;\n\t}']