apps/pkcs12.c:493: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, +oo] by call to `dump_certs_pkeys_bag`.
Showing all 16 steps of the trace


apps/pkcs12.c:493:8: Call
491.   	int i;
492.   	for (i = 0; i < sk_num (bags); i++) {
493.   		if (!dump_certs_pkeys_bag (out,
              ^
494.   			 (PKCS12_SAFEBAG *)sk_value (bags, i), pass, passlen,
495.   					 		options)) return 0;

apps/pkcs12.c:500:1: Parameter `bag->value.shkeybag->digest->length`
  498.   }
  499.   
  500. > int dump_certs_pkeys_bag (BIO *out, PKCS12_SAFEBAG *bag, char *pass,
  501.   	     int passlen, int options)
  502.   {

apps/pkcs12.c:527:14: Call
  525.   		if (options & NOKEYS) return 1;
  526.   		print_attribs (out, bag->attrib, "Bag Attributes");
  527.   		if (!(p8 = M_PKCS12_decrypt_skey (bag, pass, passlen)))
                      ^
  528.   				return 0;
  529.   		if (!(pkey = EVP_PKCS82PKEY (p8))) return 0;

crypto/pkcs12/p12_decr.c:109:1: Parameter `oct->length`
    107.    */
    108.   
    109. > char * PKCS12_decrypt_d2i (X509_ALGOR *algor, char * (*d2i)(),
    110.   	     void (*free_func)(), const char *pass, int passlen,
    111.   	     ASN1_OCTET_STRING *oct, int seq)

crypto/pkcs12/p12_decr.c:117:7: Call
    115.   	int outlen;
    116.   
    117.   	if (!PKCS12_pbe_crypt (algor, pass, passlen, oct->data, oct->length,
                 ^
    118.   			       &out, &outlen, 0)) {
    119.   		PKCS12err(PKCS12_F_PKCS12_DECRYPT_D2I,PKCS12_R_PKCS12_PBE_CRYPT_ERROR);

crypto/pkcs12/p12_decr.c:71:1: Parameter `**data`
      69.    */
      70.   
      71. > unsigned char * PKCS12_pbe_crypt (X509_ALGOR *algor, const char *pass,
      72.   	     int passlen, unsigned char *in, int inlen, unsigned char **data,
      73.   	     int *datalen, int en_de)

crypto/pkcs12/p12_decr.c:122:2: Assignment
    120.   		return NULL;
    121.   	}
    122.   	p = out;
            ^
    123.   #ifdef DEBUG_DECRYPT
    124.   	{

crypto/pkcs12/p12_decr.c:135:30: Call
    133.   	}
    134.   #endif
    135.   	if (seq & 1) ret = (char *) d2i_ASN1_SET(NULL, &p, outlen, d2i,
                                        ^
    136.   				free_func, V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL);
    137.   	else ret = d2i(NULL, &p, outlen);

crypto/asn1/a_set.c:156:1: Parameter `**pp`
      154.           }
      155.   
      156. > STACK *d2i_ASN1_SET(STACK **a, unsigned char **pp, long length,
      157.   	     char *(*func)(), void (*free_func)(), int ex_tag, int ex_class)
      158.   	{

crypto/asn1/a_set.c:167:2: Assignment
      165.   		ret=(*a);
      166.   
      167.   	c.p= *pp;
              ^
      168.   	c.max=(length == 0)?0:(c.p+length);
      169.   

crypto/asn1/a_set.c:170:8: Call
      168.   	c.max=(length == 0)?0:(c.p+length);
      169.   
      170.   	c.inf=ASN1_get_object(&c.p,&c.slen,&c.tag,&c.xclass,c.max-c.p);
                    ^
      171.   	if (c.inf & 0x80) goto err;
      172.   	if (ex_class != c.xclass)

crypto/asn1/asn1_lib.c:89:1: <Length trace>
87.   
88.   
89. > int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
90.   	     long omax)
91.   	{

crypto/asn1/asn1_lib.c:89:1: Parameter `**pp`
        87.   
        88.   
        89. > int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
        90.   	     long omax)
        91.   	{

crypto/asn1/asn1_lib.c:94:2: Assignment
        92.   	int i,ret;
        93.   	long l;
        94.   	unsigned char *p= *pp;
               ^
        95.   	int tag,xclass,inf;
        96.   	long max=omax;

crypto/asn1/asn1_lib.c:104:3: Assignment
        102.   	if (i == V_ASN1_PRIMATIVE_TAG)
        103.   		{		/* high-tag */
        104.   		p++;
                 ^
        105.   		if (--max == 0) goto err;
        106.   		l=0;

crypto/asn1/asn1_lib.c:107:10: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `dump_certs_pkeys_bag` 
        105.   		if (--max == 0) goto err;
        106.   		l=0;
        107.   		while (*p&0x80)
                        ^
        108.   			{
        109.   			l<<=7L;

int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
	     long omax)
	{
	int i,ret;
	long l;
	unsigned char *p= *pp;
	int tag,xclass,inf;
	long max=omax;
	if (!max) goto err;
	ret=(*p&V_ASN1_CONSTRUCTED);
	xclass=(*p&V_ASN1_PRIVATE);
	i= *p&V_ASN1_PRIMATIVE_TAG;
	if (i == V_ASN1_PRIMATIVE_TAG)
		{
		p++;
		if (--max == 0) goto err;
		l=0;
		while (*p&0x80)
			{
			l<<=7L;
			l|= *(p++)&0x7f;
			if (--max == 0) goto err;
			}
		l<<=7L;
		l|= *(p++)&0x7f;
		tag=(int)l;
		}
	else
		{
		tag=i;
		p++;
		if (--max == 0) goto err;
		}
	*ptag=tag;
	*pclass=xclass;
	if (!asn1_get_length(&p,&inf,plength,(int)max)) goto err;
#if 0
	fprintf(stderr,"p=%d + *plength=%ld > omax=%ld + *pp=%d  (%d > %d)\n",
		(int)p,*plength,omax,(int)*pp,(int)(p+ *plength),
		(int)(omax+ *pp));
#endif
#if 0
	if ((p+ *plength) > (omax+ *pp))
		{
		ASN1err(ASN1_F_ASN1_GET_OBJECT,ASN1_R_TOO_LONG);
		ret|=0x80;
		}
#endif
	*pp=p;
	return(ret|inf);
err:
	ASN1err(ASN1_F_ASN1_GET_OBJECT,ASN1_R_HEADER_TOO_LONG);
	return(0x80);
	}
['int dump_certs_pkeys_bags (BIO *out, STACK *bags, char *pass,\n\t     int passlen, int options)\n{\n\tint i;\n\tfor (i = 0; i < sk_num (bags); i++) {\n\t\tif (!dump_certs_pkeys_bag (out,\n\t\t\t (PKCS12_SAFEBAG *)sk_value (bags, i), pass, passlen,\n\t\t\t\t\t \t\toptions)) return 0;\n\t}\n\treturn 1;\n}', 'int dump_certs_pkeys_bag (BIO *out, PKCS12_SAFEBAG *bag, char *pass,\n\t     int passlen, int options)\n{\n\tEVP_PKEY *pkey;\n\tPKCS8_PRIV_KEY_INFO *p8;\n\tX509 *x509;\n\tswitch (M_PKCS12_bag_type(bag))\n\t{\n\tcase NID_keyBag:\n\t\tif (options & INFO) BIO_printf (bio_err, "Key bag\\n");\n\t\tif (options & NOKEYS) return 1;\n\t\tprint_attribs (out, bag->attrib, "Bag Attributes");\n\t\tp8 = bag->value.keybag;\n\t\tif (!(pkey = EVP_PKCS82PKEY (p8))) return 0;\n\t\tprint_attribs (out, p8->attributes, "Key Attributes");\n\t\tPEM_write_bio_PrivateKey (out, pkey, enc, NULL, 0, NULL);\n\t\tEVP_PKEY_free(pkey);\n\tbreak;\n\tcase NID_pkcs8ShroudedKeyBag:\n\t\tif (options & INFO) {\n\t\t\tBIO_printf (bio_err, "Shrouded Keybag: ");\n\t\t\talg_print (bio_err, bag->value.shkeybag->algor);\n\t\t}\n\t\tif (options & NOKEYS) return 1;\n\t\tprint_attribs (out, bag->attrib, "Bag Attributes");\n\t\tif (!(p8 = M_PKCS12_decrypt_skey (bag, pass, passlen)))\n\t\t\t\treturn 0;\n\t\tif (!(pkey = EVP_PKCS82PKEY (p8))) return 0;\n\t\tprint_attribs (out, p8->attributes, "Key Attributes");\n\t\tPKCS8_PRIV_KEY_INFO_free(p8);\n\t\tPEM_write_bio_PrivateKey (out, pkey, enc, NULL, 0, NULL);\n\t\tEVP_PKEY_free(pkey);\n\tbreak;\n\tcase NID_certBag:\n\t\tif (options & INFO) BIO_printf (bio_err, "Certificate bag\\n");\n\t\tif (options & NOCERTS) return 1;\n                if (PKCS12_get_attr(bag, NID_localKeyID)) {\n\t\t\tif (options & CACERTS) return 1;\n\t\t} else if (options & CLCERTS) return 1;\n\t\tprint_attribs (out, bag->attrib, "Bag Attributes");\n\t\tif (M_PKCS12_cert_bag_type(bag) != NID_x509Certificate )\n\t\t\t\t\t\t\t\t return 1;\n\t\tif (!(x509 = M_PKCS12_certbag2x509(bag))) return 0;\n\t\tdump_cert_text (out, x509);\n\t\tPEM_write_bio_X509 (out, x509);\n\t\tX509_free(x509);\n\tbreak;\n\tcase NID_safeContentsBag:\n\t\tif (options & INFO) BIO_printf (bio_err, "Safe Contents bag\\n");\n\t\tprint_attribs (out, bag->attrib, "Bag Attributes");\n\t\treturn dump_certs_pkeys_bags (out, bag->value.safes, pass,\n\t\t\t\t\t\t\t    passlen, options);\n\tdefault:\n\t\tBIO_printf (bio_err, "Warning unsupported bag type: ");\n\t\ti2a_ASN1_OBJECT (bio_err, bag->type);\n\t\tBIO_printf (bio_err, "\\n");\n\t\treturn 1;\n\tbreak;\n\t}\n\treturn 1;\n}', 'char * PKCS12_decrypt_d2i (X509_ALGOR *algor, char * (*d2i)(),\n\t     void (*free_func)(), const char *pass, int passlen,\n\t     ASN1_OCTET_STRING *oct, int seq)\n{\n\tunsigned char *out, *p;\n\tchar *ret;\n\tint outlen;\n\tif (!PKCS12_pbe_crypt (algor, pass, passlen, oct->data, oct->length,\n\t\t\t       &out, &outlen, 0)) {\n\t\tPKCS12err(PKCS12_F_PKCS12_DECRYPT_D2I,PKCS12_R_PKCS12_PBE_CRYPT_ERROR);\n\t\treturn NULL;\n\t}\n\tp = out;\n#ifdef DEBUG_DECRYPT\n\t{\n\t\tFILE *op;\n\t\tchar fname[30];\n\t\tstatic int fnm = 1;\n\t\tsprintf(fname, "DER%d", fnm++);\n\t\top = fopen(fname, "wb");\n\t\tfwrite (p, 1, outlen, op);\n\t\tfclose(op);\n\t}\n#endif\n\tif (seq & 1) ret = (char *) d2i_ASN1_SET(NULL, &p, outlen, d2i,\n\t\t\t\tfree_func, V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL);\n\telse ret = d2i(NULL, &p, outlen);\n\tif (seq & 2) memset(out, 0, outlen);\n\tif(!ret) PKCS12err(PKCS12_F_PKCS12_DECRYPT_D2I,PKCS12_R_DECODE_ERROR);\n\tFree (out);\n\treturn ret;\n}', 'unsigned char * PKCS12_pbe_crypt (X509_ALGOR *algor, const char *pass,\n\t     int passlen, unsigned char *in, int inlen, unsigned char **data,\n\t     int *datalen, int en_de)\n{\n\tunsigned char *out;\n\tint outlen, i;\n\tEVP_CIPHER_CTX ctx;\n\tif(!(out = Malloc (inlen + 8))) {\n\t\tPKCS12err(PKCS12_F_PKCS12_PBE_CRYPT,ERR_R_MALLOC_FAILURE);\n\t\treturn NULL;\n\t}\n        if (!EVP_PBE_ALGOR_CipherInit (algor, pass, passlen, &ctx, en_de)) {\n\t\tPKCS12err(PKCS12_F_PKCS12_PBE_CRYPT,PKCS12_R_PKCS12_ALGOR_CIPHERINIT_ERROR);\n\t\treturn NULL;\n\t}\n\tEVP_CipherUpdate (&ctx, out, &i, in, inlen);\n\toutlen = i;\n\tif(!EVP_CipherFinal (&ctx, out + i, &i)) {\n\t\tFree (out);\n\t\tPKCS12err(PKCS12_F_PKCS12_PBE_CRYPT,PKCS12_R_PKCS12_CIPHERFINAL_ERROR);\n\t\treturn NULL;\n\t}\n\toutlen += i;\n\tif (datalen) *datalen = outlen;\n\tif (data) *data = out;\n\treturn out;\n}', 'STACK *d2i_ASN1_SET(STACK **a, unsigned char **pp, long length,\n\t     char *(*func)(), void (*free_func)(), int ex_tag, int ex_class)\n\t{\n\tASN1_CTX c;\n\tSTACK *ret=NULL;\n\tif ((a == NULL) || ((*a) == NULL))\n\t\t{ if ((ret=sk_new(NULL)) == NULL) goto err; }\n\telse\n\t\tret=(*a);\n\tc.p= *pp;\n\tc.max=(length == 0)?0:(c.p+length);\n\tc.inf=ASN1_get_object(&c.p,&c.slen,&c.tag,&c.xclass,c.max-c.p);\n\tif (c.inf & 0x80) goto err;\n\tif (ex_class != c.xclass)\n\t\t{\n\t\tASN1err(ASN1_F_D2I_ASN1_SET,ASN1_R_BAD_CLASS);\n\t\tgoto err;\n\t\t}\n\tif (ex_tag != c.tag)\n\t\t{\n\t\tASN1err(ASN1_F_D2I_ASN1_SET,ASN1_R_BAD_TAG);\n\t\tgoto err;\n\t\t}\n\tif ((c.slen+c.p) > c.max)\n\t\t{\n\t\tASN1err(ASN1_F_D2I_ASN1_SET,ASN1_R_LENGTH_ERROR);\n\t\tgoto err;\n\t\t}\n\tif (c.inf == (V_ASN1_CONSTRUCTED+1))\n\t\tc.slen=length+ *pp-c.p;\n\tc.max=c.p+c.slen;\n\twhile (c.p < c.max)\n\t\t{\n\t\tchar *s;\n\t\tif (M_ASN1_D2I_end_sequence()) break;\n\t\tif ((s=func(NULL,&c.p,c.slen,c.max-c.p)) == NULL)\n\t\t\t{\n\t\t\tASN1err(ASN1_F_D2I_ASN1_SET,ASN1_R_ERROR_PARSING_SET_ELEMENT);\n\t\t\tasn1_add_error(*pp,(int)(c.q- *pp));\n\t\t\tgoto err;\n\t\t\t}\n\t\tif (!sk_push(ret,s)) goto err;\n\t\t}\n\tif (a != NULL) (*a)=ret;\n\t*pp=c.p;\n\treturn(ret);\nerr:\n\tif ((ret != NULL) && ((a == NULL) || (*a != ret)))\n\t\t{\n\t\tif (free_func != NULL)\n\t\t\tsk_pop_free(ret,free_func);\n\t\telse\n\t\t\tsk_free(ret);\n\t\t}\n\treturn(NULL);\n\t}', 'int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,\n\t     long omax)\n\t{\n\tint i,ret;\n\tlong l;\n\tunsigned char *p= *pp;\n\tint tag,xclass,inf;\n\tlong max=omax;\n\tif (!max) goto err;\n\tret=(*p&V_ASN1_CONSTRUCTED);\n\txclass=(*p&V_ASN1_PRIVATE);\n\ti= *p&V_ASN1_PRIMATIVE_TAG;\n\tif (i == V_ASN1_PRIMATIVE_TAG)\n\t\t{\n\t\tp++;\n\t\tif (--max == 0) goto err;\n\t\tl=0;\n\t\twhile (*p&0x80)\n\t\t\t{\n\t\t\tl<<=7L;\n\t\t\tl|= *(p++)&0x7f;\n\t\t\tif (--max == 0) goto err;\n\t\t\t}\n\t\tl<<=7L;\n\t\tl|= *(p++)&0x7f;\n\t\ttag=(int)l;\n\t\t}\n\telse\n\t\t{\n\t\ttag=i;\n\t\tp++;\n\t\tif (--max == 0) goto err;\n\t\t}\n\t*ptag=tag;\n\t*pclass=xclass;\n\tif (!asn1_get_length(&p,&inf,plength,(int)max)) goto err;\n#if 0\n\tfprintf(stderr,"p=%d + *plength=%ld > omax=%ld + *pp=%d  (%d > %d)\\n",\n\t\t(int)p,*plength,omax,(int)*pp,(int)(p+ *plength),\n\t\t(int)(omax+ *pp));\n#endif\n#if 0\n\tif ((p+ *plength) > (omax+ *pp))\n\t\t{\n\t\tASN1err(ASN1_F_ASN1_GET_OBJECT,ASN1_R_TOO_LONG);\n\t\tret|=0x80;\n\t\t}\n#endif\n\t*pp=p;\n\treturn(ret|inf);\nerr:\n\tASN1err(ASN1_F_ASN1_GET_OBJECT,ASN1_R_HEADER_TOO_LONG);\n\treturn(0x80);\n\t}']