crypto/rsa/rsa_sign.c:125: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, +oo] by call to `i2d_X509_SIG`.
Showing all 13 steps of the trace


crypto/rsa/rsa_sign.c:86:3: Assignment
84.   			return(0);
85.   		}
86.   		i = SSL_SIG_LENGTH;
        ^
87.   		s = m;
88.   	} else {

crypto/rsa/rsa_sign.c:118:22: Array declaration
116.   		}
117.   	if(type != NID_md5_sha1) {
118.   		s=(unsigned char *)Malloc((unsigned int)j+1);
                            ^
119.   		if (s == NULL)
120.   			{

crypto/rsa/rsa_sign.c:118:3: Assignment
116.   		}
117.   	if(type != NID_md5_sha1) {
118.   		s=(unsigned char *)Malloc((unsigned int)j+1);
         ^
119.   		if (s == NULL)
120.   			{

crypto/rsa/rsa_sign.c:124:3: Assignment
122.   			return(0);
123.   			}
124.   		p=s;
         ^
125.   		i2d_X509_SIG(&sig,&p);
126.   	}

crypto/rsa/rsa_sign.c:125:3: Call
123.   			}
124.   		p=s;
125.   		i2d_X509_SIG(&sig,&p);
         ^
126.   	}
127.   	i=RSA_private_encrypt(i,s,sigret,rsa,RSA_PKCS1_PADDING);

crypto/asn1/x_sig.c:64:1: Parameter `**pp`
  62.   #include <openssl/x509.h>
  63.   
  64. > int i2d_X509_SIG(X509_SIG *a, unsigned char **pp)
  65.   	{
  66.   	M_ASN1_I2D_vars(a);

crypto/asn1/x_sig.c:71:2: Assignment
  69.   	M_ASN1_I2D_len(a->digest,	i2d_ASN1_OCTET_STRING);
  70.   
  71.   	M_ASN1_I2D_seq_total();
         ^
  72.   
  73.   	M_ASN1_I2D_put(a->algor,	i2d_X509_ALGOR);

crypto/asn1/x_sig.c:71:2: Call
  69.   	M_ASN1_I2D_len(a->digest,	i2d_ASN1_OCTET_STRING);
  70.   
  71.   	M_ASN1_I2D_seq_total();
         ^
  72.   
  73.   	M_ASN1_I2D_put(a->algor,	i2d_X509_ALGOR);

crypto/asn1/asn1_lib.c:180:1: <Length trace>
178.   /* class 0 is constructed
179.    * constructed == 2 for indefinitle length constructed */
180. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
181.   	     int xclass)
182.   	{

crypto/asn1/asn1_lib.c:180:1: Parameter `**pp`
    178.   /* class 0 is constructed
    179.    * constructed == 2 for indefinitle length constructed */
    180. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
    181.   	     int xclass)
    182.   	{

crypto/asn1/asn1_lib.c:183:2: Assignment
    181.   	     int xclass)
    182.   	{
    183.   	unsigned char *p= *pp;
            ^
    184.   	int i;
    185.   

crypto/asn1/asn1_lib.c:192:5: Assignment
    190.   	else
    191.   		{
    192.   		*(p++)=i|V_ASN1_PRIMITIVE_TAG;
               ^
    193.   		while (tag > 0x7f)
    194.   			{

crypto/asn1/asn1_lib.c:198:3: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `i2d_X509_SIG` 
    196.   			tag>>=7;
    197.   			}
    198.   		*(p++)=(tag&0x7f);
             ^
    199.   		}
    200.   	if ((constructed == 2) && (length == 0))

void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
	     int xclass)
	{
	unsigned char *p= *pp;
	int i;
	i=(constructed)?V_ASN1_CONSTRUCTED:0;
	i|=(xclass&V_ASN1_PRIVATE);
	if (tag < 31)
		*(p++)=i|(tag&V_ASN1_PRIMITIVE_TAG);
	else
		{
		*(p++)=i|V_ASN1_PRIMITIVE_TAG;
		while (tag > 0x7f)
			{
			*(p++)=(tag&0x7f)|0x80;
			tag>>=7;
			}
		*(p++)=(tag&0x7f);
		}
	if ((constructed == 2) && (length == 0))
		*(p++)=0x80;
	else
		asn1_put_length(&p,length);
	*pp=p;
	}
['int RSA_sign(int type, unsigned char *m, unsigned int m_len,\n\t     unsigned char *sigret, unsigned int *siglen, RSA *rsa)\n\t{\n\tX509_SIG sig;\n\tASN1_TYPE parameter;\n\tint i,j,ret=1;\n\tunsigned char *p,*s = NULL;\n\tX509_ALGOR algor;\n\tASN1_OCTET_STRING digest;\n\tif(rsa->flags & RSA_FLAG_SIGN_VER)\n\t      return rsa->meth->rsa_sign(type, m, m_len, sigret, siglen, rsa);\n\tif(type == NID_md5_sha1) {\n\t\tif(m_len != SSL_SIG_LENGTH) {\n\t\t\tRSAerr(RSA_F_RSA_SIGN,RSA_R_INVALID_MESSAGE_LENGTH);\n\t\t\treturn(0);\n\t\t}\n\t\ti = SSL_SIG_LENGTH;\n\t\ts = m;\n\t} else {\n\t\tsig.algor= &algor;\n\t\tsig.algor->algorithm=OBJ_nid2obj(type);\n\t\tif (sig.algor->algorithm == NULL)\n\t\t\t{\n\t\t\tRSAerr(RSA_F_RSA_SIGN,RSA_R_UNKNOWN_ALGORITHM_TYPE);\n\t\t\treturn(0);\n\t\t\t}\n\t\tif (sig.algor->algorithm->length == 0)\n\t\t\t{\n\t\t\tRSAerr(RSA_F_RSA_SIGN,RSA_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD);\n\t\t\treturn(0);\n\t\t\t}\n\t\tparameter.type=V_ASN1_NULL;\n\t\tparameter.value.ptr=NULL;\n\t\tsig.algor->parameter= &parameter;\n\t\tsig.digest= &digest;\n\t\tsig.digest->data=m;\n\t\tsig.digest->length=m_len;\n\t\ti=i2d_X509_SIG(&sig,NULL);\n\t}\n\tj=RSA_size(rsa);\n\tif ((i-RSA_PKCS1_PADDING) > j)\n\t\t{\n\t\tRSAerr(RSA_F_RSA_SIGN,RSA_R_DIGEST_TOO_BIG_FOR_RSA_KEY);\n\t\treturn(0);\n\t\t}\n\tif(type != NID_md5_sha1) {\n\t\ts=(unsigned char *)Malloc((unsigned int)j+1);\n\t\tif (s == NULL)\n\t\t\t{\n\t\t\tRSAerr(RSA_F_RSA_SIGN,ERR_R_MALLOC_FAILURE);\n\t\t\treturn(0);\n\t\t\t}\n\t\tp=s;\n\t\ti2d_X509_SIG(&sig,&p);\n\t}\n\ti=RSA_private_encrypt(i,s,sigret,rsa,RSA_PKCS1_PADDING);\n\tif (i <= 0)\n\t\tret=0;\n\telse\n\t\t*siglen=i;\n\tif(type != NID_md5_sha1) {\n\t\tmemset(s,0,(unsigned int)j+1);\n\t\tFree(s);\n\t}\n\treturn(ret);\n\t}', 'int i2d_X509_SIG(X509_SIG *a, unsigned char **pp)\n\t{\n\tM_ASN1_I2D_vars(a);\n\tM_ASN1_I2D_len(a->algor,\ti2d_X509_ALGOR);\n\tM_ASN1_I2D_len(a->digest,\ti2d_ASN1_OCTET_STRING);\n\tM_ASN1_I2D_seq_total();\n\tM_ASN1_I2D_put(a->algor,\ti2d_X509_ALGOR);\n\tM_ASN1_I2D_put(a->digest,\ti2d_ASN1_OCTET_STRING);\n\tM_ASN1_I2D_finish();\n\t}', 'void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,\n\t     int xclass)\n\t{\n\tunsigned char *p= *pp;\n\tint i;\n\ti=(constructed)?V_ASN1_CONSTRUCTED:0;\n\ti|=(xclass&V_ASN1_PRIVATE);\n\tif (tag < 31)\n\t\t*(p++)=i|(tag&V_ASN1_PRIMITIVE_TAG);\n\telse\n\t\t{\n\t\t*(p++)=i|V_ASN1_PRIMITIVE_TAG;\n\t\twhile (tag > 0x7f)\n\t\t\t{\n\t\t\t*(p++)=(tag&0x7f)|0x80;\n\t\t\ttag>>=7;\n\t\t\t}\n\t\t*(p++)=(tag&0x7f);\n\t\t}\n\tif ((constructed == 2) && (length == 0))\n\t\t*(p++)=0x80;\n\telse\n\t\tasn1_put_length(&p,length);\n\t*pp=p;\n\t}']