crypto/pkcs12/p12_crt.c:117: error: BUFFER_OVERRUN_L3
  Offset added: [4, +oo] (⇐ [4, +oo] + [0, 8]) Size: [0, +oo] by call to `PKCS12_pack_p7encdata`.
Showing all 24 steps of the trace


crypto/pkcs12/p12_crt.c:117:13: Call
115.   
116.   	/* Turn certbags into encrypted authsafe */
117.   	authsafe = PKCS12_pack_p7encdata (nid_cert, pass, -1, NULL, 0,
                   ^
118.   					  iter, bags);
119.   	sk_pop_free(bags, PKCS12_SAFEBAG_free);

crypto/pkcs12/p12_add.c:155:1: Parameter `saltlen`
  153.   /* Turn a stack of SAFEBAGS into a PKCS#7 encrypted data ContentInfo */
  154.   
  155. > PKCS7 *PKCS12_pack_p7encdata (int pbe_nid, const char *pass, int passlen,
  156.   	     unsigned char *salt, int saltlen, int iter, STACK *bags)
  157.   {

crypto/pkcs12/p12_add.c:171:14: Call
  169.   	ASN1_INTEGER_set (p7->d.encrypted->version, 0);
  170.   	p7->d.encrypted->enc_data->content_type = OBJ_nid2obj(NID_pkcs7_data);
  171.   	if (!(pbe = PKCS5_pbe_set (pbe_nid, iter, salt, saltlen))) {
                      ^
  172.   		PKCS12err(PKCS12_F_PKCS12_PACK_P7ENCDATA, ERR_R_MALLOC_FAILURE);
  173.   		return NULL;

crypto/asn1/p5_pbe.c:117:1: Parameter `saltlen`
    115.   /* Return an algorithm identifier for a PKCS#5 PBE algorithm */
    116.   
    117. > X509_ALGOR *PKCS5_pbe_set(int alg, int iter, unsigned char *salt,
    118.   	     int saltlen)
    119.   {

crypto/asn1/p5_pbe.c:137:2: Assignment
    135.   		return NULL;
    136.   	}
    137.   	pbe->salt->length = saltlen;
            ^
    138.   	if (salt) memcpy (pbe->salt->data, salt, saltlen);
    139.   	else RAND_bytes (pbe->salt->data, saltlen);

crypto/asn1/p5_pbe.c:140:15: Call
    138.   	if (salt) memcpy (pbe->salt->data, salt, saltlen);
    139.   	else RAND_bytes (pbe->salt->data, saltlen);
    140.   	if (!(plen = i2d_PBEPARAM (pbe, NULL))) {
                         ^
    141.   		ASN1err(ASN1_F_ASN1_PBE_SET,ASN1_R_ENCODE_ERROR);
    142.   		return NULL;

crypto/asn1/p5_pbe.c:73:1: Parameter `a->iter->length`
      71.    */
      72.   
      73. > int i2d_PBEPARAM(PBEPARAM *a, unsigned char **pp)
      74.   {
      75.   	M_ASN1_I2D_vars(a);

crypto/asn1/p5_pbe.c:149:2: Call
    147.   	}
    148.   	ptmp = pdata;
    149.   	i2d_PBEPARAM (pbe, &ptmp);
            ^
    150.   	PBEPARAM_free (pbe);
    151.   

crypto/asn1/p5_pbe.c:73:1: Parameter `a->salt->length`
      71.    */
      72.   
      73. > int i2d_PBEPARAM(PBEPARAM *a, unsigned char **pp)
      74.   {
      75.   	M_ASN1_I2D_vars(a);

crypto/asn1/p5_pbe.c:81:2: Call
      79.   	M_ASN1_I2D_seq_total ();
      80.   
      81.   	M_ASN1_I2D_put (a->salt, i2d_ASN1_OCTET_STRING);
             ^
      82.   	M_ASN1_I2D_put (a->iter, i2d_ASN1_INTEGER);
      83.   	M_ASN1_I2D_finish();

crypto/asn1/a_octet.c:66:1: Parameter `**pp`
        64.    */
        65.   
        66. > int i2d_ASN1_OCTET_STRING(ASN1_OCTET_STRING *a, unsigned char **pp)
        67.   	{
        68.   	return(i2d_ASN1_bytes((ASN1_STRING *)a,pp,

crypto/asn1/a_octet.c:68:9: Call
        66.   int i2d_ASN1_OCTET_STRING(ASN1_OCTET_STRING *a, unsigned char **pp)
        67.   	{
        68.   	return(i2d_ASN1_bytes((ASN1_STRING *)a,pp,
                      ^
        69.   		V_ASN1_OCTET_STRING,V_ASN1_UNIVERSAL));
        70.   	}

crypto/asn1/a_bytes.c:150:1: <Offset trace>
148.   	}
149.   
150. > int i2d_ASN1_bytes(ASN1_STRING *a, unsigned char **pp, int tag, int xclass)
151.   	{
152.   	int ret,r,constructed;

crypto/asn1/a_bytes.c:150:1: Parameter `a->length`
          148.   	}
          149.   
          150. > int i2d_ASN1_bytes(ASN1_STRING *a, unsigned char **pp, int tag, int xclass)
          151.   	{
          152.   	int ret,r,constructed;

crypto/asn1/a_bytes.c:150:1: <Length trace>
148.   	}
149.   
150. > int i2d_ASN1_bytes(ASN1_STRING *a, unsigned char **pp, int tag, int xclass)
151.   	{
152.   	int ret,r,constructed;

crypto/asn1/a_bytes.c:150:1: Parameter `**pp`
          148.   	}
          149.   
          150. > int i2d_ASN1_bytes(ASN1_STRING *a, unsigned char **pp, int tag, int xclass)
          151.   	{
          152.   	int ret,r,constructed;

crypto/asn1/a_bytes.c:163:2: Assignment
          161.   	r=ASN1_object_size(0,ret,tag);
          162.   	if (pp == NULL) return(r);
          163.   	p= *pp;
                  ^
          164.   
          165.   	if ((tag == V_ASN1_SEQUENCE) || (tag == V_ASN1_SET))

crypto/asn1/a_bytes.c:169:2: Call
          167.   	else
          168.   		constructed=0;
          169.   	ASN1_put_object(&p,constructed,ret,tag,xclass);
                  ^
          170.   	memcpy(p,a->data,a->length);
          171.   	p+=a->length;

crypto/asn1/asn1_lib.c:186:1: Parameter `**pp`
            184.   /* class 0 is constructed
            185.    * constructed == 2 for indefinitle length constructed */
            186. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
            187.   	     int xclass)
            188.   	{

crypto/asn1/asn1_lib.c:189:2: Assignment
            187.   	     int xclass)
            188.   	{
            189.   	unsigned char *p= *pp;
                    ^
            190.   	int i;
            191.   

crypto/asn1/asn1_lib.c:195:5: Assignment
            193.   	i|=(xclass&V_ASN1_PRIVATE);
            194.   	if (tag < 31)
            195.   		*(p++)=i|(tag&V_ASN1_PRIMATIVE_TAG);
                       ^
            196.   	else
            197.   		{

crypto/asn1/asn1_lib.c:207:5: Assignment
            205.   		}
            206.   	if ((constructed == 2) && (length == 0))
            207.   		*(p++)=0x80; /* der_put_length would output 0 instead */
                       ^
            208.   	else
            209.   		asn1_put_length(&p,length);

crypto/asn1/asn1_lib.c:210:2: Assignment
            208.   	else
            209.   		asn1_put_length(&p,length);
            210.   	*pp=p;
                    ^
            211.   	}
            212.   

crypto/asn1/a_bytes.c:170:2: Array access: Offset added: [4, +oo] (⇐ [4, +oo] + [0, 8]) Size: [0, +oo] by call to `PKCS12_pack_p7encdata` 
          168.   		constructed=0;
          169.   	ASN1_put_object(&p,constructed,ret,tag,xclass);
          170.   	memcpy(p,a->data,a->length);
                  ^
          171.   	p+=a->length;
          172.   	*pp= p;

int i2d_ASN1_bytes(ASN1_STRING *a, unsigned char **pp, int tag, int xclass)
	{
	int ret,r,constructed;
	unsigned char *p;
	if (a == NULL)  return(0);
	if (tag == V_ASN1_BIT_STRING)
		return(i2d_ASN1_BIT_STRING(a,pp));
	ret=a->length;
	r=ASN1_object_size(0,ret,tag);
	if (pp == NULL) return(r);
	p= *pp;
	if ((tag == V_ASN1_SEQUENCE) || (tag == V_ASN1_SET))
		constructed=1;
	else
		constructed=0;
	ASN1_put_object(&p,constructed,ret,tag,xclass);
	memcpy(p,a->data,a->length);
	p+=a->length;
	*pp= p;
	return(r);
	}
['PKCS12 *PKCS12_create(char *pass, char *name, EVP_PKEY *pkey, X509 *cert,\n\t     STACK *ca, int nid_key, int nid_cert, int iter, int mac_iter,\n\t     int keytype)\n{\n\tPKCS12 *p12;\n\tSTACK *bags, *safes;\n\tPKCS12_SAFEBAG *bag;\n\tPKCS8_PRIV_KEY_INFO *p8;\n\tPKCS7 *authsafe;\n\tX509 *tcert;\n\tint i;\n\tunsigned char keyid[EVP_MAX_MD_SIZE];\n\tunsigned int keyidlen;\n\tif(!nid_cert) nid_cert = NID_pbe_WithSHA1And40BitRC2_CBC;\n\tif(!nid_key) nid_key = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;\n\tif(!iter) iter = 1000;\n\tif(!mac_iter) mac_iter = 1;\n\tif(!pkey || !cert) {\n\t\tPKCS12err(PKCS12_F_PKCS12_CREATE,PKCS12_R_INVALID_NULL_ARGUMENT);\n\t\treturn NULL;\n\t}\n\tif(!(bags = sk_new (NULL))) {\n\t\tPKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE);\n\t\treturn NULL;\n\t}\n\tif(!(bag = M_PKCS12_x5092certbag(cert))) return NULL;\n\tif(name && !PKCS12_add_friendlyname(bag, name, -1)) return NULL;\n\tX509_digest(cert, EVP_sha1(), keyid, &keyidlen);\n\tif(!PKCS12_add_localkeyid(bag, keyid, keyidlen)) return NULL;\n\tif(!sk_push(bags, (char *)bag)) {\n\t\tPKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE);\n\t\treturn NULL;\n\t}\n\tif(ca) {\n\t\tfor(i = 0; i < sk_num(ca); i++) {\n\t\t\ttcert = (X509 *)sk_value(ca, i);\n\t\t\tif(!(bag = M_PKCS12_x5092certbag(tcert))) return NULL;\n\t\t\tif(!sk_push(bags, (char *)bag)) {\n\t\t\t\tPKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE);\n\t\t\t\treturn NULL;\n\t\t\t}\n\t\t}\n\t}\n\tauthsafe = PKCS12_pack_p7encdata (nid_cert, pass, -1, NULL, 0,\n\t\t\t\t\t  iter, bags);\n\tsk_pop_free(bags, PKCS12_SAFEBAG_free);\n\tif (!authsafe) return NULL;\n\tif(!(safes = sk_new (NULL)) || !sk_push(safes, (char *)authsafe)) {\n\t\tPKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE);\n\t\treturn NULL;\n\t}\n\tif(!(p8 = EVP_PKEY2PKCS8 (pkey))) return NULL;\n\tif(keytype && !PKCS8_add_keyusage(p8, keytype)) return NULL;\n\tbag = PKCS12_MAKE_SHKEYBAG (nid_key, pass, -1, NULL, 0, iter, p8);\n\tif(!bag) return NULL;\n\tPKCS8_PRIV_KEY_INFO_free(p8);\n        if (name && !PKCS12_add_friendlyname (bag, name, -1)) return NULL;\n\tif(!PKCS12_add_localkeyid (bag, keyid, keyidlen)) return NULL;\n\tif(!(bags = sk_new(NULL)) || !sk_push (bags, (char *)bag)) {\n\t\tPKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE);\n\t\treturn NULL;\n\t}\n\tif(!(authsafe = PKCS12_pack_p7data (bags))) return NULL;\n\tsk_pop_free(bags, PKCS12_SAFEBAG_free);\n\tif(!sk_push(safes, (char *)authsafe)) {\n\t\tPKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE);\n\t\treturn NULL;\n\t}\n\tif(!(p12 = PKCS12_init (NID_pkcs7_data))) return NULL;\n\tif(!M_PKCS12_pack_authsafes (p12, safes)) return NULL;\n\tsk_pop_free(safes, PKCS7_free);\n\tif(!PKCS12_set_mac (p12, pass, -1, NULL, 0, mac_iter, NULL))\n\t    return NULL;\n\treturn p12;\n}', 'PKCS7 *PKCS12_pack_p7encdata (int pbe_nid, const char *pass, int passlen,\n\t     unsigned char *salt, int saltlen, int iter, STACK *bags)\n{\n\tPKCS7 *p7;\n\tX509_ALGOR *pbe;\n\tif (!(p7 = PKCS7_new())) {\n\t\tPKCS12err(PKCS12_F_PKCS12_PACK_P7ENCDATA, ERR_R_MALLOC_FAILURE);\n\t\treturn NULL;\n\t}\n\tp7->type = OBJ_nid2obj(NID_pkcs7_encrypted);\n\tif (!(p7->d.encrypted = PKCS7_ENCRYPT_new ())) {\n\t\tPKCS12err(PKCS12_F_PKCS12_PACK_P7ENCDATA, ERR_R_MALLOC_FAILURE);\n\t\treturn NULL;\n\t}\n\tASN1_INTEGER_set (p7->d.encrypted->version, 0);\n\tp7->d.encrypted->enc_data->content_type = OBJ_nid2obj(NID_pkcs7_data);\n\tif (!(pbe = PKCS5_pbe_set (pbe_nid, iter, salt, saltlen))) {\n\t\tPKCS12err(PKCS12_F_PKCS12_PACK_P7ENCDATA, ERR_R_MALLOC_FAILURE);\n\t\treturn NULL;\n\t}\n\tX509_ALGOR_free(p7->d.encrypted->enc_data->algorithm);\n\tp7->d.encrypted->enc_data->algorithm = pbe;\n\tASN1_OCTET_STRING_free(p7->d.encrypted->enc_data->enc_data);\n\tif (!(p7->d.encrypted->enc_data->enc_data =\n\tPKCS12_i2d_encrypt (pbe, i2d_PKCS12_SAFEBAG, pass, passlen,\n\t\t\t\t (char *)bags, 1))) {\n\t\tPKCS12err(PKCS12_F_PKCS12_PACK_P7ENCDATA, PKCS12_R_ENCRYPT_ERROR);\n\t\treturn NULL;\n\t}\n\treturn p7;\n}', 'X509_ALGOR *PKCS5_pbe_set(int alg, int iter, unsigned char *salt,\n\t     int saltlen)\n{\n\tunsigned char *pdata, *ptmp;\n\tint plen;\n\tPBEPARAM *pbe;\n\tASN1_OBJECT *al;\n\tX509_ALGOR *algor;\n\tASN1_TYPE *astype;\n\tif (!(pbe = PBEPARAM_new ())) {\n\t\tASN1err(ASN1_F_ASN1_PBE_SET,ERR_R_MALLOC_FAILURE);\n\t\treturn NULL;\n\t}\n\tASN1_INTEGER_set (pbe->iter, iter);\n\tif (!saltlen) saltlen = PKCS5_SALT_LEN;\n\tif (!(pbe->salt->data = Malloc (saltlen))) {\n\t\tASN1err(ASN1_F_ASN1_PBE_SET,ERR_R_MALLOC_FAILURE);\n\t\treturn NULL;\n\t}\n\tpbe->salt->length = saltlen;\n\tif (salt) memcpy (pbe->salt->data, salt, saltlen);\n\telse RAND_bytes (pbe->salt->data, saltlen);\n\tif (!(plen = i2d_PBEPARAM (pbe, NULL))) {\n\t\tASN1err(ASN1_F_ASN1_PBE_SET,ASN1_R_ENCODE_ERROR);\n\t\treturn NULL;\n\t}\n\tif (!(pdata = Malloc (plen))) {\n\t\tASN1err(ASN1_F_ASN1_PBE_SET,ERR_R_MALLOC_FAILURE);\n\t\treturn NULL;\n\t}\n\tptmp = pdata;\n\ti2d_PBEPARAM (pbe, &ptmp);\n\tPBEPARAM_free (pbe);\n\tif (!(astype = ASN1_TYPE_new())) {\n\t\tASN1err(ASN1_F_ASN1_PBE_SET,ERR_R_MALLOC_FAILURE);\n\t\treturn NULL;\n\t}\n\tastype->type = V_ASN1_SEQUENCE;\n\tif (!(astype->value.sequence=ASN1_STRING_new())) {\n\t\tASN1err(ASN1_F_ASN1_PBE_SET,ERR_R_MALLOC_FAILURE);\n\t\treturn NULL;\n\t}\n\tASN1_STRING_set (astype->value.sequence, pdata, plen);\n\tFree (pdata);\n\tal = OBJ_nid2obj(alg);\n\tif (!(algor = X509_ALGOR_new())) {\n\t\tASN1err(ASN1_F_ASN1_PBE_SET,ERR_R_MALLOC_FAILURE);\n\t\treturn NULL;\n\t}\n\tASN1_OBJECT_free(algor->algorithm);\n\talgor->algorithm = al;\n\talgor->parameter = astype;\n\treturn (algor);\n}', 'int i2d_PBEPARAM(PBEPARAM *a, unsigned char **pp)\n{\n\tM_ASN1_I2D_vars(a);\n\tM_ASN1_I2D_len (a->salt, i2d_ASN1_OCTET_STRING);\n\tM_ASN1_I2D_len (a->iter, i2d_ASN1_INTEGER);\n\tM_ASN1_I2D_seq_total ();\n\tM_ASN1_I2D_put (a->salt, i2d_ASN1_OCTET_STRING);\n\tM_ASN1_I2D_put (a->iter, i2d_ASN1_INTEGER);\n\tM_ASN1_I2D_finish();\n}', 'int i2d_ASN1_OCTET_STRING(ASN1_OCTET_STRING *a, unsigned char **pp)\n\t{\n\treturn(i2d_ASN1_bytes((ASN1_STRING *)a,pp,\n\t\tV_ASN1_OCTET_STRING,V_ASN1_UNIVERSAL));\n\t}', 'int i2d_ASN1_bytes(ASN1_STRING *a, unsigned char **pp, int tag, int xclass)\n\t{\n\tint ret,r,constructed;\n\tunsigned char *p;\n\tif (a == NULL)  return(0);\n\tif (tag == V_ASN1_BIT_STRING)\n\t\treturn(i2d_ASN1_BIT_STRING(a,pp));\n\tret=a->length;\n\tr=ASN1_object_size(0,ret,tag);\n\tif (pp == NULL) return(r);\n\tp= *pp;\n\tif ((tag == V_ASN1_SEQUENCE) || (tag == V_ASN1_SET))\n\t\tconstructed=1;\n\telse\n\t\tconstructed=0;\n\tASN1_put_object(&p,constructed,ret,tag,xclass);\n\tmemcpy(p,a->data,a->length);\n\tp+=a->length;\n\t*pp= p;\n\treturn(r);\n\t}', 'void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,\n\t     int xclass)\n\t{\n\tunsigned char *p= *pp;\n\tint i;\n\ti=(constructed)?V_ASN1_CONSTRUCTED:0;\n\ti|=(xclass&V_ASN1_PRIVATE);\n\tif (tag < 31)\n\t\t*(p++)=i|(tag&V_ASN1_PRIMATIVE_TAG);\n\telse\n\t\t{\n\t\t*(p++)=i|V_ASN1_PRIMATIVE_TAG;\n\t\twhile (tag > 0x7f)\n\t\t\t{\n\t\t\t*(p++)=(tag&0x7f)|0x80;\n\t\t\ttag>>=7;\n\t\t\t}\n\t\t*(p++)=(tag&0x7f);\n\t\t}\n\tif ((constructed == 2) && (length == 0))\n\t\t*(p++)=0x80;\n\telse\n\t\tasn1_put_length(&p,length);\n\t*pp=p;\n\t}']