crypto/x509v3/v3_alt.c:135: error: BUFFER_OVERRUN_L2
  Offset added: [0, 2147483646] Size: 48 by call to `X509V3_add_value_uchar`.
Showing all 15 steps of the trace


crypto/x509v3/v3_alt.c:135:9: Call
133.   
134.       case GEN_EMAIL:
135.           X509V3_add_value_uchar("email", gen->d.ia5->data, &ret);
               ^
136.           break;
137.   

crypto/x509v3/v3_utl.c:111:1: Parameter `*name`
  109.   }
  110.   
  111. > int X509V3_add_value_uchar(const char *name, const unsigned char *value,
  112.                              STACK_OF(CONF_VALUE) **extlist)
  113.   {

crypto/x509v3/v3_utl.c:114:12: Call
  112.                              STACK_OF(CONF_VALUE) **extlist)
  113.   {
  114.       return X509V3_add_value(name, (const char *)value, extlist);
                    ^
  115.   }
  116.   

crypto/x509v3/v3_utl.c:83:1: Parameter `*name`
    81.   /* Add a CONF_VALUE name value pair to stack */
    82.   
    83. > int X509V3_add_value(const char *name, const char *value,
    84.                        STACK_OF(CONF_VALUE) **extlist)
    85.   {

crypto/x509v3/v3_utl.c:89:26: Call
    87.       char *tname = NULL, *tvalue = NULL;
    88.   
    89.       if (name && (tname = BUF_strdup(name)) == NULL)
                                   ^
    90.           goto err;
    91.       if (value && (tvalue = BUF_strdup(value)) == NULL)

crypto/buffer/buf_str.c:73:1: Parameter `*str`
      71.   }
      72.   
      73. > char *BUF_strdup(const char *str)
      74.   {
      75.       if (str == NULL)

crypto/buffer/buf_str.c:77:12: Call
      75.       if (str == NULL)
      76.           return NULL;
      77.       return BUF_strndup(str, strlen(str));
                       ^
      78.   }
      79.   

crypto/buffer/buf_str.c:87:11: <Offset trace>
85.           return NULL;
86.   
87.       siz = BUF_strnlen(str, siz);
                ^
88.   
89.       if (siz >= INT_MAX)

crypto/buffer/buf_str.c:87:11: Call
        85.           return NULL;
        86.   
        87.       siz = BUF_strnlen(str, siz);
                        ^
        88.   
        89.       if (siz >= INT_MAX)

crypto/buffer/buf_str.c:64:1: Parameter `*str`
          62.   #include <openssl/buffer.h>
          63.   
          64. > size_t BUF_strnlen(const char *str, size_t maxlen)
          65.   {
          66.       const char *p;

crypto/buffer/buf_str.c:70:5: Assignment
          68.       for (p = str; maxlen-- != 0 && *p != '\0'; ++p) ;
          69.   
          70.       return p - str;
                    ^
          71.   }
          72.   

crypto/buffer/buf_str.c:87:5: Assignment
        85.           return NULL;
        86.   
        87.       siz = BUF_strnlen(str, siz);
                  ^
        88.   
        89.       if (siz >= INT_MAX)

crypto/buffer/buf_str.c:80:1: <Length trace>
78.   }
79.   
80. > char *BUF_strndup(const char *str, size_t siz)
81.   {
82.       char *ret;

crypto/buffer/buf_str.c:80:1: Parameter `*str`
        78.   }
        79.   
        80. > char *BUF_strndup(const char *str, size_t siz)
        81.   {
        82.       char *ret;

crypto/buffer/buf_str.c:98:5: Array access: Offset added: [0, 2147483646] Size: 48 by call to `X509V3_add_value_uchar` 
        96.       }
        97.   
        98.       memcpy(ret, str, siz);
                   ^
        99.       ret[siz] = '\0';
        100.   

char *BUF_strndup(const char *str, size_t siz)
{
    char *ret;
    if (str == NULL)
        return NULL;
    siz = BUF_strnlen(str, siz);
    if (siz >= INT_MAX)
        return NULL;
    ret = OPENSSL_malloc(siz + 1);
    if (ret == NULL) {
        BUFerr(BUF_F_BUF_STRNDUP, ERR_R_MALLOC_FAILURE);
        return NULL;
    }
    memcpy(ret, str, siz);
    ret[siz] = '\0';
    return (ret);
}
['STACK_OF(CONF_VALUE) *i2v_GENERAL_NAME(X509V3_EXT_METHOD *method,\n                                       GENERAL_NAME *gen,\n                                       STACK_OF(CONF_VALUE) *ret)\n{\n    unsigned char *p;\n    char oline[256], htmp[5];\n    int i;\n    switch (gen->type) {\n    case GEN_OTHERNAME:\n        X509V3_add_value("othername", "<unsupported>", &ret);\n        break;\n    case GEN_X400:\n        X509V3_add_value("X400Name", "<unsupported>", &ret);\n        break;\n    case GEN_EDIPARTY:\n        X509V3_add_value("EdiPartyName", "<unsupported>", &ret);\n        break;\n    case GEN_EMAIL:\n        X509V3_add_value_uchar("email", gen->d.ia5->data, &ret);\n        break;\n    case GEN_DNS:\n        X509V3_add_value_uchar("DNS", gen->d.ia5->data, &ret);\n        break;\n    case GEN_URI:\n        X509V3_add_value_uchar("URI", gen->d.ia5->data, &ret);\n        break;\n    case GEN_DIRNAME:\n        X509_NAME_oneline(gen->d.dirn, oline, 256);\n        X509V3_add_value("DirName", oline, &ret);\n        break;\n    case GEN_IPADD:\n        p = gen->d.ip->data;\n        if (gen->d.ip->length == 4)\n            BIO_snprintf(oline, sizeof oline,\n                         "%d.%d.%d.%d", p[0], p[1], p[2], p[3]);\n        else if (gen->d.ip->length == 16) {\n            oline[0] = 0;\n            for (i = 0; i < 8; i++) {\n                BIO_snprintf(htmp, sizeof htmp, "%X", p[0] << 8 | p[1]);\n                p += 2;\n                strcat(oline, htmp);\n                if (i != 7)\n                    strcat(oline, ":");\n            }\n        } else {\n            X509V3_add_value("IP Address", "<invalid>", &ret);\n            break;\n        }\n        X509V3_add_value("IP Address", oline, &ret);\n        break;\n    case GEN_RID:\n        i2t_ASN1_OBJECT(oline, 256, gen->d.rid);\n        X509V3_add_value("Registered ID", oline, &ret);\n        break;\n    }\n    return ret;\n}', 'int X509V3_add_value_uchar(const char *name, const unsigned char *value,\n                           STACK_OF(CONF_VALUE) **extlist)\n{\n    return X509V3_add_value(name, (const char *)value, extlist);\n}', 'int X509V3_add_value(const char *name, const char *value,\n                     STACK_OF(CONF_VALUE) **extlist)\n{\n    CONF_VALUE *vtmp = NULL;\n    char *tname = NULL, *tvalue = NULL;\n    if (name && (tname = BUF_strdup(name)) == NULL)\n        goto err;\n    if (value && (tvalue = BUF_strdup(value)) == NULL)\n        goto err;\n    if ((vtmp = OPENSSL_malloc(sizeof(*vtmp))) == NULL)\n        goto err;\n    if (*extlist == NULL && (*extlist = sk_CONF_VALUE_new_null()) == NULL)\n        goto err;\n    vtmp->section = NULL;\n    vtmp->name = tname;\n    vtmp->value = tvalue;\n    if (!sk_CONF_VALUE_push(*extlist, vtmp))\n        goto err;\n    return 1;\n err:\n    X509V3err(X509V3_F_X509V3_ADD_VALUE, ERR_R_MALLOC_FAILURE);\n    OPENSSL_free(vtmp);\n    OPENSSL_free(tname);\n    OPENSSL_free(tvalue);\n    return 0;\n}', 'char *BUF_strdup(const char *str)\n{\n    if (str == NULL)\n        return NULL;\n    return BUF_strndup(str, strlen(str));\n}', "char *BUF_strndup(const char *str, size_t siz)\n{\n    char *ret;\n    if (str == NULL)\n        return NULL;\n    siz = BUF_strnlen(str, siz);\n    if (siz >= INT_MAX)\n        return NULL;\n    ret = OPENSSL_malloc(siz + 1);\n    if (ret == NULL) {\n        BUFerr(BUF_F_BUF_STRNDUP, ERR_R_MALLOC_FAILURE);\n        return NULL;\n    }\n    memcpy(ret, str, siz);\n    ret[siz] = '\\0';\n    return (ret);\n}", "size_t BUF_strnlen(const char *str, size_t maxlen)\n{\n    const char *p;\n    for (p = str; maxlen-- != 0 && *p != '\\0'; ++p) ;\n    return p - str;\n}"]