apps/ca.c:1456: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, +oo] by call to `X509_to_X509_REQ`.
Showing all 23 steps of the trace


apps/ca.c:1434:13: Call
1432.   	BIO_printf(bio_err,"Check that the request matches the signature\n");
1433.   
1434.   	if ((pktmp=X509_get_pubkey(req)) == NULL)
                    ^
1435.   		{
1436.   		BIO_printf(bio_err,"error unpacking public key\n");

crypto/x509/x509_cmp.c:254:9: Call
  252.   	if ((x == NULL) || (x->cert_info == NULL))
  253.   		return(NULL);
  254.   	return(X509_PUBKEY_get(x->cert_info->key));
                 ^
  255.   	}
  256.   

crypto/asn1/x_pubkey.c:240:9: Call
    238.   			p=a->parameter->value.sequence->data;
    239.   			j=a->parameter->value.sequence->length;
    240.   			if (!d2i_DSAparams(&ret->pkey.dsa,&p,(long)j))
                   ^
    241.   				goto err;
    242.   			}

crypto/asn1/d2i_dsap.c:79:2: Call
      77.   	M_ASN1_D2I_Init();
      78.   	M_ASN1_D2I_start_sequence();
      79.   	M_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);
             ^
      80.   	if ((ret->p=BN_bin2bn(bs->data,bs->length,ret->p)) == NULL) goto err_bn;
      81.   	M_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);

crypto/asn1/a_int.c:164:1: Parameter `*(*a)->data`
        162.   	}
        163.   
        164. > ASN1_INTEGER *d2i_ASN1_INTEGER(ASN1_INTEGER **a, unsigned char **pp,
        165.   	     long length)
        166.   	{

apps/ca.c:1456:12: Call
1454.   		BIO_printf(bio_err,"Signature ok\n");
1455.   
1456.   	if ((rreq=X509_to_X509_REQ(req,NULL,EVP_md5())) == NULL)
                   ^
1457.   		goto err;
1458.   

crypto/x509/x509_req.c:69:1: Parameter `*x->cert_info->key->algor->parameter->value.sequence->data`
  67.   #include <openssl/pem.h>
  68.   
  69. > X509_REQ *X509_to_X509_REQ(X509 *x, EVP_PKEY *pkey, const EVP_MD *md)
  70.   	{
  71.   	X509_REQ *ret;

crypto/x509/x509_req.c:93:10: Call
  91.   		goto err;
  92.   
  93.   	pktmp = X509_get_pubkey(x);
                 ^
  94.   	i=X509_REQ_set_pubkey(ret,pktmp);
  95.   	EVP_PKEY_free(pktmp);

crypto/x509/x509_cmp.c:250:1: Parameter `*x->cert_info->key->algor->parameter->value.sequence->data`
    248.   	}
    249.   
    250. > EVP_PKEY *X509_get_pubkey(X509 *x)
    251.   	{
    252.   	if ((x == NULL) || (x->cert_info == NULL))

crypto/x509/x509_cmp.c:254:9: Call
    252.   	if ((x == NULL) || (x->cert_info == NULL))
    253.   		return(NULL);
    254.   	return(X509_PUBKEY_get(x->cert_info->key));
                   ^
    255.   	}
    256.   

crypto/asn1/x_pubkey.c:201:1: Parameter `*key->algor->parameter->value.sequence->data`
      199.   	}
      200.   
      201. > EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)
      202.   	{
      203.   	EVP_PKEY *ret=NULL;

crypto/asn1/x_pubkey.c:238:4: Assignment
      236.   			{
      237.   			ret->pkey.dsa->write_params=0;
      238.   			p=a->parameter->value.sequence->data;
                ^
      239.   			j=a->parameter->value.sequence->length;
      240.   			if (!d2i_DSAparams(&ret->pkey.dsa,&p,(long)j))

crypto/asn1/x_pubkey.c:240:9: Call
      238.   			p=a->parameter->value.sequence->data;
      239.   			j=a->parameter->value.sequence->length;
      240.   			if (!d2i_DSAparams(&ret->pkey.dsa,&p,(long)j))
                     ^
      241.   				goto err;
      242.   			}

crypto/asn1/d2i_dsap.c:71:1: Parameter `**pp`
        69.   #endif
        70.   
        71. > DSA *d2i_DSAparams(DSA **a, unsigned char **pp, long length)
        72.   	{
        73.   	int i=ERR_R_NESTED_ASN1_ERROR;

crypto/asn1/d2i_dsap.c:77:2: Assignment
        75.   	M_ASN1_D2I_vars(a,DSA *,DSA_new);
        76.   
        77.   	M_ASN1_D2I_Init();
               ^
        78.   	M_ASN1_D2I_start_sequence();
        79.   	M_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);

crypto/asn1/d2i_dsap.c:78:2: Call
        76.   
        77.   	M_ASN1_D2I_Init();
        78.   	M_ASN1_D2I_start_sequence();
               ^
        79.   	M_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);
        80.   	if ((ret->p=BN_bin2bn(bs->data,bs->length,ret->p)) == NULL) goto err_bn;

crypto/asn1/asn1_lib.c:277:1: Parameter `*c->p`
          275.   	}
          276.   
          277. > int asn1_GetSequence(ASN1_CTX *c, long *length)
          278.   	{
          279.   	unsigned char *q;

crypto/asn1/asn1_lib.c:282:9: Call
          280.   
          281.   	q=c->p;
          282.   	c->inf=ASN1_get_object(&(c->p),&(c->slen),&(c->tag),&(c->xclass),
                         ^
          283.   		*length);
          284.   	if (c->inf & 0x80)

crypto/asn1/asn1_lib.c:83:1: <Length trace>
81.   
82.   
83. > int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
84.   	     long omax)
85.   	{

crypto/asn1/asn1_lib.c:83:1: Parameter `**pp`
            81.   
            82.   
            83. > int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
            84.   	     long omax)
            85.   	{

crypto/asn1/asn1_lib.c:88:2: Assignment
            86.   	int i,ret;
            87.   	long l;
            88.   	unsigned char *p= *pp;
                   ^
            89.   	int tag,xclass,inf;
            90.   	long max=omax;

crypto/asn1/asn1_lib.c:98:3: Assignment
            96.   	if (i == V_ASN1_PRIMITIVE_TAG)
            97.   		{		/* high-tag */
            98.   		p++;
                     ^
            99.   		if (--max == 0) goto err;
            100.   		l=0;

crypto/asn1/asn1_lib.c:101:10: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `X509_to_X509_REQ` 
            99.   		if (--max == 0) goto err;
            100.   		l=0;
            101.   		while (*p&0x80)
                            ^
            102.   			{
            103.   			l<<=7L;

int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
	     long omax)
	{
	int i,ret;
	long l;
	unsigned char *p= *pp;
	int tag,xclass,inf;
	long max=omax;
	if (!max) goto err;
	ret=(*p&V_ASN1_CONSTRUCTED);
	xclass=(*p&V_ASN1_PRIVATE);
	i= *p&V_ASN1_PRIMITIVE_TAG;
	if (i == V_ASN1_PRIMITIVE_TAG)
		{
		p++;
		if (--max == 0) goto err;
		l=0;
		while (*p&0x80)
			{
			l<<=7L;
			l|= *(p++)&0x7f;
			if (--max == 0) goto err;
			}
		l<<=7L;
		l|= *(p++)&0x7f;
		tag=(int)l;
		}
	else
		{
		tag=i;
		p++;
		if (--max == 0) goto err;
		}
	*ptag=tag;
	*pclass=xclass;
	if (!asn1_get_length(&p,&inf,plength,(int)max)) goto err;
#if 0
	fprintf(stderr,"p=%d + *plength=%ld > omax=%ld + *pp=%d  (%d > %d)\n",
		(int)p,*plength,omax,(int)*pp,(int)(p+ *plength),
		(int)(omax+ *pp));
#endif
#if 0
	if ((p+ *plength) > (omax+ *pp))
		{
		ASN1err(ASN1_F_ASN1_GET_OBJECT,ASN1_R_TOO_LONG);
		ret|=0x80;
		}
#endif
	*pp=p;
	return(ret|inf);
err:
	ASN1err(ASN1_F_ASN1_GET_OBJECT,ASN1_R_HEADER_TOO_LONG);
	return(0x80);
	}
['static int certify_cert(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,\n\t     const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, TXT_DB *db,\n\t     BIGNUM *serial, char *startdate, char *enddate, int days,\n\t     int batch, char *ext_sect, LHASH *lconf, int verbose)\n\t{\n\tX509 *req=NULL;\n\tX509_REQ *rreq=NULL;\n\tBIO *in=NULL;\n\tEVP_PKEY *pktmp=NULL;\n\tint ok= -1,i;\n\tin=BIO_new(BIO_s_file());\n\tif (BIO_read_filename(in,infile) <= 0)\n\t\t{\n\t\tperror(infile);\n\t\tgoto err;\n\t\t}\n\tif ((req=PEM_read_bio_X509(in,NULL,NULL,NULL)) == NULL)\n\t\t{\n\t\tBIO_printf(bio_err,"Error reading self signed certificate in %s\\n",infile);\n\t\tgoto err;\n\t\t}\n\tif (verbose)\n\t\tX509_print(bio_err,req);\n\tBIO_printf(bio_err,"Check that the request matches the signature\\n");\n\tif ((pktmp=X509_get_pubkey(req)) == NULL)\n\t\t{\n\t\tBIO_printf(bio_err,"error unpacking public key\\n");\n\t\tgoto err;\n\t\t}\n\ti=X509_verify(req,pktmp);\n\tEVP_PKEY_free(pktmp);\n\tif (i < 0)\n\t\t{\n\t\tok=0;\n\t\tBIO_printf(bio_err,"Signature verification problems....\\n");\n\t\tgoto err;\n\t\t}\n\tif (i == 0)\n\t\t{\n\t\tok=0;\n\t\tBIO_printf(bio_err,"Signature did not match the certificate\\n");\n\t\tgoto err;\n\t\t}\n\telse\n\t\tBIO_printf(bio_err,"Signature ok\\n");\n\tif ((rreq=X509_to_X509_REQ(req,NULL,EVP_md5())) == NULL)\n\t\tgoto err;\n\tok=do_body(xret,pkey,x509,dgst,policy,db,serial,startdate,enddate,days,\n\t\tbatch,verbose,rreq,ext_sect,lconf);\nerr:\n\tif (rreq != NULL) X509_REQ_free(rreq);\n\tif (req != NULL) X509_free(req);\n\tif (in != NULL) BIO_free(in);\n\treturn(ok);\n\t}', 'EVP_PKEY *X509_get_pubkey(X509 *x)\n\t{\n\tif ((x == NULL) || (x->cert_info == NULL))\n\t\treturn(NULL);\n\treturn(X509_PUBKEY_get(x->cert_info->key));\n\t}', 'EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)\n\t{\n\tEVP_PKEY *ret=NULL;\n\tlong j;\n\tint type;\n\tunsigned char *p;\n#ifndef NO_DSA\n\tX509_ALGOR *a;\n#endif\n\tif (key == NULL) goto err;\n\tif (key->pkey != NULL)\n\t    {\n\t    CRYPTO_add(&key->pkey->references,1,CRYPTO_LOCK_EVP_PKEY);\n\t    return(key->pkey);\n\t    }\n\tif (key->public_key == NULL) goto err;\n\ttype=OBJ_obj2nid(key->algor->algorithm);\n\tp=key->public_key->data;\n        j=key->public_key->length;\n        if ((ret=d2i_PublicKey(type,NULL,&p,(long)j)) == NULL)\n\t\t{\n\t\tX509err(X509_F_X509_PUBKEY_GET,X509_R_ERR_ASN1_LIB);\n\t\tgoto err;\n\t\t}\n\tret->save_parameters=0;\n#ifndef NO_DSA\n\ta=key->algor;\n\tif (ret->type == EVP_PKEY_DSA)\n\t\t{\n\t\tif (a->parameter->type == V_ASN1_SEQUENCE)\n\t\t\t{\n\t\t\tret->pkey.dsa->write_params=0;\n\t\t\tp=a->parameter->value.sequence->data;\n\t\t\tj=a->parameter->value.sequence->length;\n\t\t\tif (!d2i_DSAparams(&ret->pkey.dsa,&p,(long)j))\n\t\t\t\tgoto err;\n\t\t\t}\n\t\tret->save_parameters=1;\n\t\t}\n#endif\n\tkey->pkey=ret;\n\tCRYPTO_add(&ret->references,1,CRYPTO_LOCK_EVP_PKEY);\n\treturn(ret);\nerr:\n\tif (ret != NULL)\n\t\tEVP_PKEY_free(ret);\n\treturn(NULL);\n\t}', 'DSA *d2i_DSAparams(DSA **a, unsigned char **pp, long length)\n\t{\n\tint i=ERR_R_NESTED_ASN1_ERROR;\n\tASN1_INTEGER *bs=NULL;\n\tM_ASN1_D2I_vars(a,DSA *,DSA_new);\n\tM_ASN1_D2I_Init();\n\tM_ASN1_D2I_start_sequence();\n\tM_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);\n\tif ((ret->p=BN_bin2bn(bs->data,bs->length,ret->p)) == NULL) goto err_bn;\n\tM_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);\n\tif ((ret->q=BN_bin2bn(bs->data,bs->length,ret->q)) == NULL) goto err_bn;\n\tM_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);\n\tif ((ret->g=BN_bin2bn(bs->data,bs->length,ret->g)) == NULL) goto err_bn;\n\tM_ASN1_BIT_STRING_free(bs);\n\tM_ASN1_D2I_Finish_2(a);\nerr_bn:\n\ti=ERR_R_BN_LIB;\nerr:\n\tASN1err(ASN1_F_D2I_DSAPARAMS,i);\n\tif ((ret != NULL) && ((a == NULL) || (*a != ret))) DSA_free(ret);\n\tif (bs != NULL) M_ASN1_BIT_STRING_free(bs);\n\treturn(NULL);\n\t}', 'ASN1_INTEGER *d2i_ASN1_INTEGER(ASN1_INTEGER **a, unsigned char **pp,\n\t     long length)\n\t{\n\tASN1_INTEGER *ret=NULL;\n\tunsigned char *p,*to,*s, *pend;\n\tlong len;\n\tint inf,tag,xclass;\n\tint i;\n\tif ((a == NULL) || ((*a) == NULL))\n\t\t{\n\t\tif ((ret=M_ASN1_INTEGER_new()) == NULL) return(NULL);\n\t\tret->type=V_ASN1_INTEGER;\n\t\t}\n\telse\n\t\tret=(*a);\n\tp= *pp;\n\tinf=ASN1_get_object(&p,&len,&tag,&xclass,length);\n\tpend = p + len;\n\tif (inf & 0x80)\n\t\t{\n\t\ti=ASN1_R_BAD_OBJECT_HEADER;\n\t\tgoto err;\n\t\t}\n\tif (tag != V_ASN1_INTEGER)\n\t\t{\n\t\ti=ASN1_R_EXPECTING_AN_INTEGER;\n\t\tgoto err;\n\t\t}\n\ts=(unsigned char *)Malloc((int)len+1);\n\tif (s == NULL)\n\t\t{\n\t\ti=ERR_R_MALLOC_FAILURE;\n\t\tgoto err;\n\t\t}\n\tto=s;\n\tif (*p & 0x80)\n\t\t{\n\t\tret->type=V_ASN1_NEG_INTEGER;\n\t\tif ((*p == 0xff) && (len != 1)) {\n\t\t\tp++;\n\t\t\tlen--;\n\t\t}\n\t\ti = len;\n\t\tp += i - 1;\n\t\tto += i - 1;\n\t\twhile((!*p) && i) {\n\t\t\t*(to--) = 0;\n\t\t\ti--;\n\t\t\tp--;\n\t\t}\n\t\tif(!i) {\n\t\t\t*s = 1;\n\t\t\ts[len] = 0;\n\t\t\tlen++;\n\t\t} else {\n\t\t\t*(to--) = (*(p--) ^ 0xff) + 1;\n\t\t\ti--;\n\t\t\tfor(;i > 0; i--) *(to--) = *(p--) ^ 0xff;\n\t\t}\n\t} else {\n\t\tret->type=V_ASN1_INTEGER;\n\t\tif ((*p == 0) && (len != 1))\n\t\t\t{\n\t\t\tp++;\n\t\t\tlen--;\n\t\t\t}\n\t\tmemcpy(s,p,(int)len);\n\t}\n\tif (ret->data != NULL) Free((char *)ret->data);\n\tret->data=s;\n\tret->length=(int)len;\n\tif (a != NULL) (*a)=ret;\n\t*pp=pend;\n\treturn(ret);\nerr:\n\tASN1err(ASN1_F_D2I_ASN1_INTEGER,i);\n\tif ((ret != NULL) && ((a == NULL) || (*a != ret)))\n\t\tM_ASN1_INTEGER_free(ret);\n\treturn(NULL);\n\t}', 'X509_REQ *X509_to_X509_REQ(X509 *x, EVP_PKEY *pkey, const EVP_MD *md)\n\t{\n\tX509_REQ *ret;\n\tX509_REQ_INFO *ri;\n\tint i;\n\tEVP_PKEY *pktmp;\n\tret=X509_REQ_new();\n\tif (ret == NULL)\n\t\t{\n\t\tX509err(X509_F_X509_TO_X509_REQ,ERR_R_MALLOC_FAILURE);\n\t\tgoto err;\n\t\t}\n\tri=ret->req_info;\n\tri->version->length=1;\n\tri->version->data=(unsigned char *)Malloc(1);\n\tif (ri->version->data == NULL) goto err;\n\tri->version->data[0]=0;\n\tif (!X509_REQ_set_subject_name(ret,X509_get_subject_name(x)))\n\t\tgoto err;\n\tpktmp = X509_get_pubkey(x);\n\ti=X509_REQ_set_pubkey(ret,pktmp);\n\tEVP_PKEY_free(pktmp);\n\tif (!i) goto err;\n\tif (pkey != NULL)\n\t\t{\n\t\tif (!X509_REQ_sign(ret,pkey,md))\n\t\t\tgoto err;\n\t\t}\n\treturn(ret);\nerr:\n\tX509_REQ_free(ret);\n\treturn(NULL);\n\t}', 'int asn1_GetSequence(ASN1_CTX *c, long *length)\n\t{\n\tunsigned char *q;\n\tq=c->p;\n\tc->inf=ASN1_get_object(&(c->p),&(c->slen),&(c->tag),&(c->xclass),\n\t\t*length);\n\tif (c->inf & 0x80)\n\t\t{\n\t\tc->error=ERR_R_BAD_GET_ASN1_OBJECT_CALL;\n\t\treturn(0);\n\t\t}\n\tif (c->tag != V_ASN1_SEQUENCE)\n\t\t{\n\t\tc->error=ERR_R_EXPECTING_AN_ASN1_SEQUENCE;\n\t\treturn(0);\n\t\t}\n\t(*length)-=(c->p-q);\n\tif (c->max && (*length < 0))\n\t\t{\n\t\tc->error=ERR_R_ASN1_LENGTH_MISMATCH;\n\t\treturn(0);\n\t\t}\n\tif (c->inf == (1|V_ASN1_CONSTRUCTED))\n\t\tc->slen= *length+ *(c->pp)-c->p;\n\tc->eos=0;\n\treturn(1);\n\t}', 'int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,\n\t     long omax)\n\t{\n\tint i,ret;\n\tlong l;\n\tunsigned char *p= *pp;\n\tint tag,xclass,inf;\n\tlong max=omax;\n\tif (!max) goto err;\n\tret=(*p&V_ASN1_CONSTRUCTED);\n\txclass=(*p&V_ASN1_PRIVATE);\n\ti= *p&V_ASN1_PRIMITIVE_TAG;\n\tif (i == V_ASN1_PRIMITIVE_TAG)\n\t\t{\n\t\tp++;\n\t\tif (--max == 0) goto err;\n\t\tl=0;\n\t\twhile (*p&0x80)\n\t\t\t{\n\t\t\tl<<=7L;\n\t\t\tl|= *(p++)&0x7f;\n\t\t\tif (--max == 0) goto err;\n\t\t\t}\n\t\tl<<=7L;\n\t\tl|= *(p++)&0x7f;\n\t\ttag=(int)l;\n\t\t}\n\telse\n\t\t{\n\t\ttag=i;\n\t\tp++;\n\t\tif (--max == 0) goto err;\n\t\t}\n\t*ptag=tag;\n\t*pclass=xclass;\n\tif (!asn1_get_length(&p,&inf,plength,(int)max)) goto err;\n#if 0\n\tfprintf(stderr,"p=%d + *plength=%ld > omax=%ld + *pp=%d  (%d > %d)\\n",\n\t\t(int)p,*plength,omax,(int)*pp,(int)(p+ *plength),\n\t\t(int)(omax+ *pp));\n#endif\n#if 0\n\tif ((p+ *plength) > (omax+ *pp))\n\t\t{\n\t\tASN1err(ASN1_F_ASN1_GET_OBJECT,ASN1_R_TOO_LONG);\n\t\tret|=0x80;\n\t\t}\n#endif\n\t*pp=p;\n\treturn(ret|inf);\nerr:\n\tASN1err(ASN1_F_ASN1_GET_OBJECT,ASN1_R_HEADER_TOO_LONG);\n\treturn(0x80);\n\t}']