crypto/pem/pem_lib.c:230: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] (⇐ [0, +oo] + 1) Size: [0, +oo] by call to `PKCS12_decrypt_d2i`.
Showing all 15 steps of the trace


crypto/pem/pem_lib.c:221:9: Call
219.   			int klen;
220.   			char psbuf[PEM_BUFSIZE];
221.   			p8 = d2i_X509_SIG((X509_SIG **)x, &p, len);
               ^
222.   			if(!p8) goto p8err;
223.   			if (cb) klen=cb(psbuf,PEM_BUFSIZE,0);

crypto/asn1/x_sig.c:78:1: Parameter `(*a)->digest->length`
  76.   	}
  77.   
  78. > X509_SIG *d2i_X509_SIG(X509_SIG **a, unsigned char **pp, long length)
  79.   	{
  80.   	M_ASN1_D2I_vars(a,X509_SIG *,X509_SIG_new);

crypto/pem/pem_lib.c:230:12: Call
228.   				goto err;
229.   			}
230.   			p8inf = M_PKCS8_decrypt(p8, psbuf, klen);
                  ^
231.   			X509_SIG_free(p8);
232.   			if(!p8inf) goto p8err;

crypto/pkcs12/p12_decr.c:110:1: Parameter `oct->length`
  108.    */
  109.   
  110. > char * PKCS12_decrypt_d2i (X509_ALGOR *algor, char * (*d2i)(),
  111.   	     void (*free_func)(), const char *pass, int passlen,
  112.   	     ASN1_OCTET_STRING *oct, int seq)

crypto/pkcs12/p12_decr.c:118:7: Call
  116.   	int outlen;
  117.   
  118.   	if (!PKCS12_pbe_crypt (algor, pass, passlen, oct->data, oct->length,
               ^
  119.   			       &out, &outlen, 0)) {
  120.   		PKCS12err(PKCS12_F_PKCS12_DECRYPT_D2I,PKCS12_R_PKCS12_PBE_CRYPT_ERROR);

crypto/pkcs12/p12_decr.c:71:1: Parameter `**data`
    69.    */
    70.   
    71. > unsigned char * PKCS12_pbe_crypt (X509_ALGOR *algor, const char *pass,
    72.   	     int passlen, unsigned char *in, int inlen, unsigned char **data,
    73.   	     int *datalen, int en_de)

crypto/pkcs12/p12_decr.c:123:2: Assignment
  121.   		return NULL;
  122.   	}
  123.   	p = out;
          ^
  124.   #ifdef DEBUG_DECRYPT
  125.   	{

crypto/pkcs12/p12_decr.c:136:30: Call
  134.   	}
  135.   #endif
  136.   	if (seq & 1) ret = (char *) d2i_ASN1_SET(NULL, &p, outlen, d2i,
                                      ^
  137.   				free_func, V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL);
  138.   	else ret = d2i(NULL, &p, outlen);

crypto/asn1/a_set.c:154:1: Parameter `length`
    152.           }
    153.   
    154. > STACK *d2i_ASN1_SET(STACK **a, unsigned char **pp, long length,
    155.   	     char *(*func)(), void (*free_func)(), int ex_tag, int ex_class)
    156.   	{

crypto/asn1/a_set.c:188:3: Assignment
    186.   	 * as the amount of data passed to us */
    187.   	if (c.inf == (V_ASN1_CONSTRUCTED+1))
    188.   		c.slen=length+ *pp-c.p;
             ^
    189.   	c.max=c.p+c.slen;
    190.   

crypto/asn1/a_set.c:189:2: Assignment
    187.   	if (c.inf == (V_ASN1_CONSTRUCTED+1))
    188.   		c.slen=length+ *pp-c.p;
    189.   	c.max=c.p+c.slen;
            ^
    190.   
    191.   	while (c.p < c.max)

crypto/asn1/a_set.c:195:7: Call
    193.   		char *s;
    194.   
    195.   		if (M_ASN1_D2I_end_sequence()) break;
                 ^
    196.   		if ((s=func(NULL,&c.p,c.slen,c.max-c.p)) == NULL)
    197.   			{

crypto/asn1/asn1_lib.c:68:1: <Length trace>
66.   const char *ASN1_version="ASN.1" OPENSSL_VERSION_PTEXT;
67.   
68. > int ASN1_check_infinite_end(unsigned char **p, long len)
69.   	{
70.   	/* If there is 0 or 1 byte left, the length check should pick

crypto/asn1/asn1_lib.c:68:1: Parameter `**p`
      66.   const char *ASN1_version="ASN.1" OPENSSL_VERSION_PTEXT;
      67.   
      68. > int ASN1_check_infinite_end(unsigned char **p, long len)
      69.   	{
      70.   	/* If there is 0 or 1 byte left, the length check should pick

crypto/asn1/asn1_lib.c:74:44: Array access: Offset: [1, +oo] (⇐ [0, +oo] + 1) Size: [0, +oo] by call to `PKCS12_decrypt_d2i` 
      72.   	if (len <= 0)
      73.   		return(1);
      74.   	else if ((len >= 2) && ((*p)[0] == 0) && ((*p)[1] == 0))
                                                       ^
      75.   		{
      76.   		(*p)+=2;

int ASN1_check_infinite_end(unsigned char **p, long len)
	{
	if (len <= 0)
		return(1);
	else if ((len >= 2) && ((*p)[0] == 0) && ((*p)[1] == 0))
		{
		(*p)+=2;
		return(1);
		}
	return(0);
	}
['char *PEM_ASN1_read_bio(char *(*d2i)(), const char *name, BIO *bp, char **x,\n\t     pem_password_cb *cb)\n\t{\n\tEVP_CIPHER_INFO cipher;\n\tchar *nm=NULL,*header=NULL;\n\tunsigned char *p=NULL,*data=NULL;\n\tlong len;\n\tchar *ret=NULL;\n\tfor (;;)\n\t\t{\n\t\tif (!PEM_read_bio(bp,&nm,&header,&data,&len)) return(NULL);\n\t\tif (\t(strcmp(nm,name) == 0) ||\n\t\t\t((strcmp(nm,PEM_STRING_RSA) == 0) &&\n\t\t\t (strcmp(name,PEM_STRING_EVP_PKEY) == 0)) ||\n\t\t\t((strcmp(nm,PEM_STRING_DSA) == 0) &&\n\t\t\t (strcmp(name,PEM_STRING_EVP_PKEY) == 0)) ||\n\t\t\t((strcmp(nm,PEM_STRING_PKCS8) == 0) &&\n\t\t\t (strcmp(name,PEM_STRING_EVP_PKEY) == 0)) ||\n\t\t\t((strcmp(nm,PEM_STRING_PKCS8INF) == 0) &&\n\t\t\t (strcmp(name,PEM_STRING_EVP_PKEY) == 0)) ||\n\t\t\t((strcmp(nm,PEM_STRING_X509_OLD) == 0) &&\n\t\t\t (strcmp(name,PEM_STRING_X509) == 0)) ||\n\t\t\t((strcmp(nm,PEM_STRING_X509_REQ_OLD) == 0) &&\n\t\t\t (strcmp(name,PEM_STRING_X509_REQ) == 0))\n\t\t\t)\n\t\t\tbreak;\n\t\tFree(nm);\n\t\tFree(header);\n\t\tFree(data);\n\t\t}\n\tif (!PEM_get_EVP_CIPHER_INFO(header,&cipher)) goto err;\n\tif (!PEM_do_header(&cipher,data,&len,cb)) goto err;\n\tp=data;\n\tif (strcmp(name,PEM_STRING_EVP_PKEY) == 0) {\n\t\tif (strcmp(nm,PEM_STRING_RSA) == 0)\n\t\t\tret=d2i(EVP_PKEY_RSA,x,&p,len);\n\t\telse if (strcmp(nm,PEM_STRING_DSA) == 0)\n\t\t\tret=d2i(EVP_PKEY_DSA,x,&p,len);\n\t\telse if (strcmp(nm,PEM_STRING_PKCS8INF) == 0) {\n\t\t\tPKCS8_PRIV_KEY_INFO *p8inf;\n\t\t\tp8inf=d2i_PKCS8_PRIV_KEY_INFO(\n\t\t\t\t\t(PKCS8_PRIV_KEY_INFO **) x, &p, len);\n\t\t\tret = (char *)EVP_PKCS82PKEY(p8inf);\n\t\t\tPKCS8_PRIV_KEY_INFO_free(p8inf);\n\t\t} else if (strcmp(nm,PEM_STRING_PKCS8) == 0) {\n\t\t\tPKCS8_PRIV_KEY_INFO *p8inf;\n\t\t\tX509_SIG *p8;\n\t\t\tint klen;\n\t\t\tchar psbuf[PEM_BUFSIZE];\n\t\t\tp8 = d2i_X509_SIG((X509_SIG **)x, &p, len);\n\t\t\tif(!p8) goto p8err;\n\t\t\tif (cb) klen=cb(psbuf,PEM_BUFSIZE,0);\n\t\t\telse klen=def_callback(psbuf,PEM_BUFSIZE,0);\n\t\t\tif (klen <= 0) {\n\t\t\t\tPEMerr(PEM_F_PEM_ASN1_READ_BIO,\n\t\t\t\t\t\tPEM_R_BAD_PASSWORD_READ);\n\t\t\t\tgoto err;\n\t\t\t}\n\t\t\tp8inf = M_PKCS8_decrypt(p8, psbuf, klen);\n\t\t\tX509_SIG_free(p8);\n\t\t\tif(!p8inf) goto p8err;\n\t\t\tret = (char *)EVP_PKCS82PKEY(p8inf);\n\t\t\tPKCS8_PRIV_KEY_INFO_free(p8inf);\n\t\t}\n\t} else\tret=d2i(x,&p,len);\np8err:\n\tif (ret == NULL)\n\t\tPEMerr(PEM_F_PEM_ASN1_READ_BIO,ERR_R_ASN1_LIB);\nerr:\n\tFree(nm);\n\tFree(header);\n\tFree(data);\n\treturn(ret);\n\t}', 'X509_SIG *d2i_X509_SIG(X509_SIG **a, unsigned char **pp, long length)\n\t{\n\tM_ASN1_D2I_vars(a,X509_SIG *,X509_SIG_new);\n\tM_ASN1_D2I_Init();\n\tM_ASN1_D2I_start_sequence();\n\tM_ASN1_D2I_get(ret->algor,d2i_X509_ALGOR);\n\tM_ASN1_D2I_get(ret->digest,d2i_ASN1_OCTET_STRING);\n\tM_ASN1_D2I_Finish(a,X509_SIG_free,ASN1_F_D2I_X509_SIG);\n\t}', 'char * PKCS12_decrypt_d2i (X509_ALGOR *algor, char * (*d2i)(),\n\t     void (*free_func)(), const char *pass, int passlen,\n\t     ASN1_OCTET_STRING *oct, int seq)\n{\n\tunsigned char *out, *p;\n\tchar *ret;\n\tint outlen;\n\tif (!PKCS12_pbe_crypt (algor, pass, passlen, oct->data, oct->length,\n\t\t\t       &out, &outlen, 0)) {\n\t\tPKCS12err(PKCS12_F_PKCS12_DECRYPT_D2I,PKCS12_R_PKCS12_PBE_CRYPT_ERROR);\n\t\treturn NULL;\n\t}\n\tp = out;\n#ifdef DEBUG_DECRYPT\n\t{\n\t\tFILE *op;\n\t\tchar fname[30];\n\t\tstatic int fnm = 1;\n\t\tsprintf(fname, "DER%d", fnm++);\n\t\top = fopen(fname, "wb");\n\t\tfwrite (p, 1, outlen, op);\n\t\tfclose(op);\n\t}\n#endif\n\tif (seq & 1) ret = (char *) d2i_ASN1_SET(NULL, &p, outlen, d2i,\n\t\t\t\tfree_func, V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL);\n\telse ret = d2i(NULL, &p, outlen);\n\tif (seq & 2) memset(out, 0, outlen);\n\tif(!ret) PKCS12err(PKCS12_F_PKCS12_DECRYPT_D2I,PKCS12_R_DECODE_ERROR);\n\tFree (out);\n\treturn ret;\n}', 'unsigned char * PKCS12_pbe_crypt (X509_ALGOR *algor, const char *pass,\n\t     int passlen, unsigned char *in, int inlen, unsigned char **data,\n\t     int *datalen, int en_de)\n{\n\tunsigned char *out;\n\tint outlen, i;\n\tEVP_CIPHER_CTX ctx;\n\tif(!(out = Malloc (inlen + 8))) {\n\t\tPKCS12err(PKCS12_F_PKCS12_PBE_CRYPT,ERR_R_MALLOC_FAILURE);\n\t\treturn NULL;\n\t}\n        if (!EVP_PBE_CipherInit (algor->algorithm, pass, passlen,\n\t\t\t\t\t algor->parameter, &ctx, en_de)) {\n\t\tPKCS12err(PKCS12_F_PKCS12_PBE_CRYPT,PKCS12_R_PKCS12_ALGOR_CIPHERINIT_ERROR);\n\t\treturn NULL;\n\t}\n\tEVP_CipherUpdate (&ctx, out, &i, in, inlen);\n\toutlen = i;\n\tif(!EVP_CipherFinal (&ctx, out + i, &i)) {\n\t\tFree (out);\n\t\tPKCS12err(PKCS12_F_PKCS12_PBE_CRYPT,PKCS12_R_PKCS12_CIPHERFINAL_ERROR);\n\t\treturn NULL;\n\t}\n\toutlen += i;\n\tif (datalen) *datalen = outlen;\n\tif (data) *data = out;\n\treturn out;\n}', 'STACK *d2i_ASN1_SET(STACK **a, unsigned char **pp, long length,\n\t     char *(*func)(), void (*free_func)(), int ex_tag, int ex_class)\n\t{\n\tASN1_CTX c;\n\tSTACK *ret=NULL;\n\tif ((a == NULL) || ((*a) == NULL))\n\t\t{ if ((ret=sk_new(NULL)) == NULL) goto err; }\n\telse\n\t\tret=(*a);\n\tc.p= *pp;\n\tc.max=(length == 0)?0:(c.p+length);\n\tc.inf=ASN1_get_object(&c.p,&c.slen,&c.tag,&c.xclass,c.max-c.p);\n\tif (c.inf & 0x80) goto err;\n\tif (ex_class != c.xclass)\n\t\t{\n\t\tASN1err(ASN1_F_D2I_ASN1_SET,ASN1_R_BAD_CLASS);\n\t\tgoto err;\n\t\t}\n\tif (ex_tag != c.tag)\n\t\t{\n\t\tASN1err(ASN1_F_D2I_ASN1_SET,ASN1_R_BAD_TAG);\n\t\tgoto err;\n\t\t}\n\tif ((c.slen+c.p) > c.max)\n\t\t{\n\t\tASN1err(ASN1_F_D2I_ASN1_SET,ASN1_R_LENGTH_ERROR);\n\t\tgoto err;\n\t\t}\n\tif (c.inf == (V_ASN1_CONSTRUCTED+1))\n\t\tc.slen=length+ *pp-c.p;\n\tc.max=c.p+c.slen;\n\twhile (c.p < c.max)\n\t\t{\n\t\tchar *s;\n\t\tif (M_ASN1_D2I_end_sequence()) break;\n\t\tif ((s=func(NULL,&c.p,c.slen,c.max-c.p)) == NULL)\n\t\t\t{\n\t\t\tASN1err(ASN1_F_D2I_ASN1_SET,ASN1_R_ERROR_PARSING_SET_ELEMENT);\n\t\t\tasn1_add_error(*pp,(int)(c.q- *pp));\n\t\t\tgoto err;\n\t\t\t}\n\t\tif (!sk_push(ret,s)) goto err;\n\t\t}\n\tif (a != NULL) (*a)=ret;\n\t*pp=c.p;\n\treturn(ret);\nerr:\n\tif ((ret != NULL) && ((a == NULL) || (*a != ret)))\n\t\t{\n\t\tif (free_func != NULL)\n\t\t\tsk_pop_free(ret,free_func);\n\t\telse\n\t\t\tsk_free(ret);\n\t\t}\n\treturn(NULL);\n\t}', 'int ASN1_check_infinite_end(unsigned char **p, long len)\n\t{\n\tif (len <= 0)\n\t\treturn(1);\n\telse if ((len >= 2) && ((*p)[0] == 0) && ((*p)[1] == 0))\n\t\t{\n\t\t(*p)+=2;\n\t\treturn(1);\n\t\t}\n\treturn(0);\n\t}']