crypto/asn1/a_object.c:258: error: BUFFER_OVERRUN_L2
  Offset added: [1, 80] Size: 32 by call to `i2t_ASN1_OBJECT`.
Showing all 7 steps of the trace


crypto/asn1/a_object.c:258:4: Call
256.   	if ((a == NULL) || (a->data == NULL))
257.   		return(BIO_write(bp,"NULL",4));
258.   	i=i2t_ASN1_OBJECT(buf,80,a);
          ^
259.   	if (i > 80) i=80;
260.   	BIO_write(bp,buf,i);

crypto/asn1/a_object.c:178:1: <Offset trace>
176.   	}
177.   
178. > int i2t_ASN1_OBJECT(char *buf, int buf_len, ASN1_OBJECT *a)
179.   	{
180.   	int i,idx=0,n=0,len,nid;

crypto/asn1/a_object.c:178:1: Parameter `buf_len`
  176.   	}
  177.   
  178. > int i2t_ASN1_OBJECT(char *buf, int buf_len, ASN1_OBJECT *a)
  179.   	{
  180.   	int i,idx=0,n=0,len,nid;

crypto/asn1/a_object.c:217:3: Assignment
  215.   		i=strlen(tbuf);
  216.   		strncpy(buf,tbuf,buf_len);
  217.   		buf_len-=i;
           ^
  218.   		buf+=i;
  219.   		n+=i;

crypto/asn1/a_object.c:178:1: <Length trace>
176.   	}
177.   
178. > int i2t_ASN1_OBJECT(char *buf, int buf_len, ASN1_OBJECT *a)
179.   	{
180.   	int i,idx=0,n=0,len,nid;

crypto/asn1/a_object.c:178:1: Array declaration
  176.   	}
  177.   
  178. > int i2t_ASN1_OBJECT(char *buf, int buf_len, ASN1_OBJECT *a)
  179.   	{
  180.   	int i,idx=0,n=0,len,nid;

crypto/asn1/a_object.c:230:6: Array access: Offset added: [1, 80] Size: 32 by call to `i2t_ASN1_OBJECT` 
  228.   				i=strlen(tbuf);
  229.   				if (buf_len > 0)
  230.   					strncpy(buf,tbuf,buf_len);
              ^
  231.   				buf_len-=i;
  232.   				buf+=i;

int i2t_ASN1_OBJECT(char *buf, int buf_len, ASN1_OBJECT *a)
	{
	int i,idx=0,n=0,len,nid;
	unsigned long l;
	unsigned char *p;
	const char *s;
	char tbuf[32];
	if (buf_len <= 0) return(0);
	if ((a == NULL) || (a->data == NULL))
		{
		buf[0]='\0';
		return(0);
		}
	nid=OBJ_obj2nid(a);
	if (nid == NID_undef)
		{
		len=a->length;
		p=a->data;
		idx=0;
		l=0;
		while (idx < a->length)
			{
			l|=(p[idx]&0x7f);
			if (!(p[idx] & 0x80)) break;
			l<<=7L;
			idx++;
			}
		idx++;
		i=(int)(l/40);
		if (i > 2) i=2;
		l-=(long)(i*40);
		sprintf(tbuf,"%d.%ld",i,l);
		i=strlen(tbuf);
		strncpy(buf,tbuf,buf_len);
		buf_len-=i;
		buf+=i;
		n+=i;
		l=0;
		for (; idx<len; idx++)
			{
			l|=p[idx]&0x7f;
			if (!(p[idx] & 0x80))
				{
				sprintf(tbuf,".%ld",l);
				i=strlen(tbuf);
				if (buf_len > 0)
					strncpy(buf,tbuf,buf_len);
				buf_len-=i;
				buf+=i;
				n+=i;
				l=0;
				}
			l<<=7L;
			}
		}
	else
		{
		s=OBJ_nid2ln(nid);
		if (s == NULL)
			s=OBJ_nid2sn(nid);
		strncpy(buf,s,buf_len);
		n=strlen(s);
		}
	buf[buf_len-1]='\0';
	return(n);
	}
['int i2a_ASN1_OBJECT(BIO *bp, ASN1_OBJECT *a)\n\t{\n\tchar buf[80];\n\tint i;\n\tif ((a == NULL) || (a->data == NULL))\n\t\treturn(BIO_write(bp,"NULL",4));\n\ti=i2t_ASN1_OBJECT(buf,80,a);\n\tif (i > 80) i=80;\n\tBIO_write(bp,buf,i);\n\treturn(i);\n\t}', 'int i2t_ASN1_OBJECT(char *buf, int buf_len, ASN1_OBJECT *a)\n\t{\n\tint i,idx=0,n=0,len,nid;\n\tunsigned long l;\n\tunsigned char *p;\n\tconst char *s;\n\tchar tbuf[32];\n\tif (buf_len <= 0) return(0);\n\tif ((a == NULL) || (a->data == NULL))\n\t\t{\n\t\tbuf[0]=\'\\0\';\n\t\treturn(0);\n\t\t}\n\tnid=OBJ_obj2nid(a);\n\tif (nid == NID_undef)\n\t\t{\n\t\tlen=a->length;\n\t\tp=a->data;\n\t\tidx=0;\n\t\tl=0;\n\t\twhile (idx < a->length)\n\t\t\t{\n\t\t\tl|=(p[idx]&0x7f);\n\t\t\tif (!(p[idx] & 0x80)) break;\n\t\t\tl<<=7L;\n\t\t\tidx++;\n\t\t\t}\n\t\tidx++;\n\t\ti=(int)(l/40);\n\t\tif (i > 2) i=2;\n\t\tl-=(long)(i*40);\n\t\tsprintf(tbuf,"%d.%ld",i,l);\n\t\ti=strlen(tbuf);\n\t\tstrncpy(buf,tbuf,buf_len);\n\t\tbuf_len-=i;\n\t\tbuf+=i;\n\t\tn+=i;\n\t\tl=0;\n\t\tfor (; idx<len; idx++)\n\t\t\t{\n\t\t\tl|=p[idx]&0x7f;\n\t\t\tif (!(p[idx] & 0x80))\n\t\t\t\t{\n\t\t\t\tsprintf(tbuf,".%ld",l);\n\t\t\t\ti=strlen(tbuf);\n\t\t\t\tif (buf_len > 0)\n\t\t\t\t\tstrncpy(buf,tbuf,buf_len);\n\t\t\t\tbuf_len-=i;\n\t\t\t\tbuf+=i;\n\t\t\t\tn+=i;\n\t\t\t\tl=0;\n\t\t\t\t}\n\t\t\tl<<=7L;\n\t\t\t}\n\t\t}\n\telse\n\t\t{\n\t\ts=OBJ_nid2ln(nid);\n\t\tif (s == NULL)\n\t\t\ts=OBJ_nid2sn(nid);\n\t\tstrncpy(buf,s,buf_len);\n\t\tn=strlen(s);\n\t\t}\n\tbuf[buf_len-1]=\'\\0\';\n\treturn(n);\n\t}']