crypto/x509v3/v3_utl.c:423: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] Size: [1, +oo].
Showing all 9 steps of the trace


crypto/x509v3/v3_utl.c:407:1: <Length trace>
405.    */
406.   
407. > char *hex_to_string(const unsigned char *buffer, long len)
408.   {
409.       char *tmp, *q;

crypto/x509v3/v3_utl.c:407:1: Parameter `len`
405.    */
406.   
407. > char *hex_to_string(const unsigned char *buffer, long len)
408.   {
409.       char *tmp, *q;

crypto/x509v3/v3_utl.c:415:16: Call
413.       if (!buffer || !len)
414.           return NULL;
415.       if ((tmp = OPENSSL_malloc(len * 3 + 1)) == NULL) {
                      ^
416.           X509V3err(X509V3_F_HEX_TO_STRING, ERR_R_MALLOC_FAILURE);
417.           return NULL;

crypto/mem.c:125:9: Assignment
  123.   
  124.       if (num <= 0)
  125.           return NULL;
                 ^
  126.   
  127.       allow_customize = 0;

crypto/x509v3/v3_utl.c:415:10: Assignment
413.       if (!buffer || !len)
414.           return NULL;
415.       if ((tmp = OPENSSL_malloc(len * 3 + 1)) == NULL) {
                ^
416.           X509V3err(X509V3_F_HEX_TO_STRING, ERR_R_MALLOC_FAILURE);
417.           return NULL;

crypto/x509v3/v3_utl.c:419:5: Assignment
417.           return NULL;
418.       }
419.       q = tmp;
           ^
420.       for (i = 0, p = buffer; i < len; i++, p++) {
421.           *q++ = hexdig[(*p >> 4) & 0xf];

crypto/x509v3/v3_utl.c:421:10: Assignment
419.       q = tmp;
420.       for (i = 0, p = buffer; i < len; i++, p++) {
421.           *q++ = hexdig[(*p >> 4) & 0xf];
                ^
422.           *q++ = hexdig[*p & 0xf];
423.           *q++ = ':';

crypto/x509v3/v3_utl.c:422:10: Assignment
420.       for (i = 0, p = buffer; i < len; i++, p++) {
421.           *q++ = hexdig[(*p >> 4) & 0xf];
422.           *q++ = hexdig[*p & 0xf];
                ^
423.           *q++ = ':';
424.       }

crypto/x509v3/v3_utl.c:423:9: Array access: Offset: [2, +oo] Size: [1, +oo]
421.           *q++ = hexdig[(*p >> 4) & 0xf];
422.           *q++ = hexdig[*p & 0xf];
423.           *q++ = ':';
               ^
424.       }
425.       q[-1] = 0;

char *hex_to_string(const unsigned char *buffer, long len)
{
    char *tmp, *q;
    const unsigned char *p;
    int i;
    const static char hexdig[] = "0123456789ABCDEF";
    if (!buffer || !len)
        return NULL;
    if ((tmp = OPENSSL_malloc(len * 3 + 1)) == NULL) {
        X509V3err(X509V3_F_HEX_TO_STRING, ERR_R_MALLOC_FAILURE);
        return NULL;
    }
    q = tmp;
    for (i = 0, p = buffer; i < len; i++, p++) {
        *q++ = hexdig[(*p >> 4) & 0xf];
        *q++ = hexdig[*p & 0xf];
        *q++ = ':';
    }
    q[-1] = 0;
#ifdef CHARSET_EBCDIC
    ebcdic2ascii(tmp, tmp, q - tmp - 1);
#endif
    return tmp;
}
['char *hex_to_string(const unsigned char *buffer, long len)\n{\n    char *tmp, *q;\n    const unsigned char *p;\n    int i;\n    const static char hexdig[] = "0123456789ABCDEF";\n    if (!buffer || !len)\n        return NULL;\n    if ((tmp = OPENSSL_malloc(len * 3 + 1)) == NULL) {\n        X509V3err(X509V3_F_HEX_TO_STRING, ERR_R_MALLOC_FAILURE);\n        return NULL;\n    }\n    q = tmp;\n    for (i = 0, p = buffer; i < len; i++, p++) {\n        *q++ = hexdig[(*p >> 4) & 0xf];\n        *q++ = hexdig[*p & 0xf];\n        *q++ = \':\';\n    }\n    q[-1] = 0;\n#ifdef CHARSET_EBCDIC\n    ebcdic2ascii(tmp, tmp, q - tmp - 1);\n#endif\n    return tmp;\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (num <= 0)\n        return NULL;\n    allow_customize = 0;\n#ifdef CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    (void)file;\n    (void)line;\n    ret = malloc(num);\n#endif\n#ifndef OPENSSL_CPUID_OBJ\n    if (ret && (num > 2048)) {\n        extern unsigned char cleanse_ctr;\n        ((unsigned char *)ret)[0] = cleanse_ctr;\n    }\n#endif\n    return ret;\n}']