apps/ts.c:636: error: BUFFER_OVERRUN_L2
  Offset added: [-oo, 40] (⇐ [0, 20] + [-oo, 20]) Size: 20.
Showing all 6 steps of the trace


apps/ts.c:628:10: <Offset trace>
626.   
627.       /* Find the first non-zero byte and creating ASN1_INTEGER object. */
628.       for (i = 0; i < len && !buf[i]; ++i) ;
                ^
629.       if (!(nonce = ASN1_INTEGER_new()))
630.           goto err;

apps/ts.c:628:10: Assignment
626.   
627.       /* Find the first non-zero byte and creating ASN1_INTEGER object. */
628.       for (i = 0; i < len && !buf[i]; ++i) ;
                ^
629.       if (!(nonce = ASN1_INTEGER_new()))
630.           goto err;

apps/ts.c:633:5: Assignment
631.       OPENSSL_free(nonce->data);
632.       /* Allocate at least one byte. */
633.       nonce->length = len - i;
           ^
634.       if (!(nonce->data = OPENSSL_malloc(nonce->length + 1)))
635.           goto err;

apps/ts.c:614:1: <Length trace>
612.   }
613.   
614. > static ASN1_INTEGER *create_nonce(int bits)
615.   {
616.       unsigned char buf[20];

apps/ts.c:614:1: Array declaration
612.   }
613.   
614. > static ASN1_INTEGER *create_nonce(int bits)
615.   {
616.       unsigned char buf[20];

apps/ts.c:636:5: Array access: Offset added: [-oo, 40] (⇐ [0, 20] + [-oo, 20]) Size: 20
634.       if (!(nonce->data = OPENSSL_malloc(nonce->length + 1)))
635.           goto err;
636.       memcpy(nonce->data, buf + i, nonce->length);
           ^
637.   
638.       return nonce;

static ASN1_INTEGER *create_nonce(int bits)
{
    unsigned char buf[20];
    ASN1_INTEGER *nonce = NULL;
    int len = (bits - 1) / 8 + 1;
    int i;
    if (len > (int)sizeof(buf))
        goto err;
    if (RAND_bytes(buf, len) <= 0)
        goto err;
    for (i = 0; i < len && !buf[i]; ++i) ;
    if (!(nonce = ASN1_INTEGER_new()))
        goto err;
    OPENSSL_free(nonce->data);
    nonce->length = len - i;
    if (!(nonce->data = OPENSSL_malloc(nonce->length + 1)))
        goto err;
    memcpy(nonce->data, buf + i, nonce->length);
    return nonce;
 err:
    BIO_printf(bio_err, "could not create nonce\n");
    ASN1_INTEGER_free(nonce);
    return NULL;
}
['static ASN1_INTEGER *create_nonce(int bits)\n{\n    unsigned char buf[20];\n    ASN1_INTEGER *nonce = NULL;\n    int len = (bits - 1) / 8 + 1;\n    int i;\n    if (len > (int)sizeof(buf))\n        goto err;\n    if (RAND_bytes(buf, len) <= 0)\n        goto err;\n    for (i = 0; i < len && !buf[i]; ++i) ;\n    if (!(nonce = ASN1_INTEGER_new()))\n        goto err;\n    OPENSSL_free(nonce->data);\n    nonce->length = len - i;\n    if (!(nonce->data = OPENSSL_malloc(nonce->length + 1)))\n        goto err;\n    memcpy(nonce->data, buf + i, nonce->length);\n    return nonce;\n err:\n    BIO_printf(bio_err, "could not create nonce\\n");\n    ASN1_INTEGER_free(nonce);\n    return NULL;\n}']