crypto/x509/x509_vfy.c:353: error: BUFFER_OVERRUN_L3
  Offset: 11 Size: [0, +oo] by call to `X509_cmp_current_time`.
Showing all 12 steps of the trace


crypto/x509/x509_vfy.c:335:14: Call
333.   		if (!xs->valid)
334.   			{
335.   			if ((pkey=X509_get_pubkey(xi)) == NULL)
                    ^
336.   				{
337.   				ctx->error=X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY;

crypto/x509/x509_cmp.c:241:9: Call
  239.   	if ((x == NULL) || (x->cert_info == NULL))
  240.   		return(NULL);
  241.   	return(X509_PUBKEY_get(x->cert_info->key));
                 ^
  242.   	}
  243.   

crypto/asn1/x_pubkey.c:244:9: Call
    242.   			p=a->parameter->value.sequence->data;
    243.   			j=a->parameter->value.sequence->length;
    244.   			if (!d2i_DSAparams(&ret->pkey.dsa,&p,(long)j))
                   ^
    245.   				goto err;
    246.   			}

crypto/asn1/d2i_dsap.c:79:2: Call
      77.   	M_ASN1_D2I_Init();
      78.   	M_ASN1_D2I_start_sequence();
      79.   	M_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);
             ^
      80.   	if ((ret->p=BN_bin2bn(bs->data,bs->length,ret->p)) == NULL) goto err_bn;
      81.   	M_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);

crypto/asn1/a_int.c:117:1: Parameter `*(*a)->data`
        115.   	}
        116.   
        117. > ASN1_INTEGER *d2i_ASN1_INTEGER(ASN1_INTEGER **a, unsigned char **pp,
        118.   	     long length)
        119.   	{

crypto/x509/x509_vfy.c:353:6: Call
351.   			pkey=NULL;
352.   
353.   			i=X509_cmp_current_time(X509_get_notBefore(xs));
            ^
354.   			if (i == 0)
355.   				{

crypto/x509/x509_vfy.c:407:1: <Length trace>
405.   	}
406.   
407. > int X509_cmp_current_time(ASN1_UTCTIME *ctm)
408.   	{
409.   	char *str;

crypto/x509/x509_vfy.c:407:1: Parameter `*ctm->data`
  405.   	}
  406.   
  407. > int X509_cmp_current_time(ASN1_UTCTIME *ctm)
  408.   	{
  409.   	char *str;

crypto/x509/x509_vfy.c:417:2: Assignment
  415.   	p=buff1;
  416.   	i=ctm->length;
  417.   	str=(char *)ctm->data;
          ^
  418.   	if ((i < 11) || (i > 17)) return(0);
  419.   	memcpy(p,str,10);

crypto/x509/x509_vfy.c:421:2: Assignment
  419.   	memcpy(p,str,10);
  420.   	p+=10;
  421.   	str+=10;
          ^
  422.   
  423.   	if ((*str == 'Z') || (*str == '-') || (*str == '+'))

crypto/x509/x509_vfy.c:425:19: Assignment
  423.   	if ((*str == 'Z') || (*str == '-') || (*str == '+'))
  424.   		{ *(p++)='0'; *(p++)='0'; }
  425.   	else	{ *(p++)= *(str++); *(p++)= *(str++); }
                           ^
  426.   	*(p++)='Z';
  427.   	*(p++)='\0';

crypto/x509/x509_vfy.c:425:35: Array access: Offset: 11 Size: [0, +oo] by call to `X509_cmp_current_time` 
  423.   	if ((*str == 'Z') || (*str == '-') || (*str == '+'))
  424.   		{ *(p++)='0'; *(p++)='0'; }
  425.   	else	{ *(p++)= *(str++); *(p++)= *(str++); }
                                           ^
  426.   	*(p++)='Z';
  427.   	*(p++)='\0';

int X509_cmp_current_time(ASN1_UTCTIME *ctm)
	{
	char *str;
	ASN1_UTCTIME atm;
	time_t offset;
	char buff1[24],buff2[24],*p;
	int i,j;
	p=buff1;
	i=ctm->length;
	str=(char *)ctm->data;
	if ((i < 11) || (i > 17)) return(0);
	memcpy(p,str,10);
	p+=10;
	str+=10;
	if ((*str == 'Z') || (*str == '-') || (*str == '+'))
		{ *(p++)='0'; *(p++)='0'; }
	else	{ *(p++)= *(str++); *(p++)= *(str++); }
	*(p++)='Z';
	*(p++)='\0';
	if (*str == 'Z')
		offset=0;
	else
		{
		if ((*str != '+') && (str[5] != '-'))
			return(0);
		offset=((str[1]-'0')*10+(str[2]-'0'))*60;
		offset+=(str[3]-'0')*10+(str[4]-'0');
		if (*str == '-')
			offset= -offset;
		}
	atm.type=V_ASN1_UTCTIME;
	atm.length=sizeof(buff2);
	atm.data=(unsigned char *)buff2;
	X509_gmtime_adj(&atm,-offset);
	i=(buff1[0]-'0')*10+(buff1[1]-'0');
	if (i < 50) i+=100;
	j=(buff2[0]-'0')*10+(buff2[1]-'0');
	if (j < 50) j+=100;
	if (i < j) return (-1);
	if (i > j) return (1);
	i=strcmp(buff1,buff2);
	if (i == 0)
		return(-1);
	else
		return(i);
	}
['static int internal_verify(X509_STORE_CTX *ctx)\n\t{\n\tint i,ok=0,n;\n\tX509 *xs,*xi;\n\tEVP_PKEY *pkey=NULL;\n\tint (*cb)();\n\tcb=ctx->ctx->verify_cb;\n\tif (cb == NULL) cb=null_callback;\n\tn=sk_num(ctx->chain);\n\tctx->error_depth=n-1;\n\tn--;\n\txi=(X509 *)sk_value(ctx->chain,n);\n\tif (X509_NAME_cmp(X509_get_subject_name(xi),\n\t\tX509_get_issuer_name(xi)) == 0)\n\t\txs=xi;\n\telse\n\t\t{\n\t\tif (n <= 0)\n\t\t\t{\n\t\t\tctx->error=X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE;\n\t\t\tctx->current_cert=xi;\n\t\t\tok=cb(0,ctx);\n\t\t\tgoto end;\n\t\t\t}\n\t\telse\n\t\t\t{\n\t\t\tn--;\n\t\t\tctx->error_depth=n;\n\t\t\txs=(X509 *)sk_value(ctx->chain,n);\n\t\t\t}\n\t\t}\n\twhile (n >= 0)\n\t\t{\n\t\tctx->error_depth=n;\n\t\tif (!xs->valid)\n\t\t\t{\n\t\t\tif ((pkey=X509_get_pubkey(xi)) == NULL)\n\t\t\t\t{\n\t\t\t\tctx->error=X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY;\n\t\t\t\tctx->current_cert=xi;\n\t\t\t\tok=(*cb)(0,ctx);\n\t\t\t\tif (!ok) goto end;\n\t\t\t\t}\n\t\t\tif (X509_verify(xs,pkey) <= 0)\n\t\t\t\t{\n\t\t\t\tEVP_PKEY_free(pkey);\n\t\t\t\tctx->error=X509_V_ERR_CERT_SIGNATURE_FAILURE;\n\t\t\t\tctx->current_cert=xs;\n\t\t\t\tok=(*cb)(0,ctx);\n\t\t\t\tif (!ok) goto end;\n\t\t\t\t}\n\t\t\tEVP_PKEY_free(pkey);\n\t\t\tpkey=NULL;\n\t\t\ti=X509_cmp_current_time(X509_get_notBefore(xs));\n\t\t\tif (i == 0)\n\t\t\t\t{\n\t\t\t\tctx->error=X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD;\n\t\t\t\tctx->current_cert=xs;\n\t\t\t\tok=(*cb)(0,ctx);\n\t\t\t\tif (!ok) goto end;\n\t\t\t\t}\n\t\t\tif (i > 0)\n\t\t\t\t{\n\t\t\t\tctx->error=X509_V_ERR_CERT_NOT_YET_VALID;\n\t\t\t\tctx->current_cert=xs;\n\t\t\t\tok=(*cb)(0,ctx);\n\t\t\t\tif (!ok) goto end;\n\t\t\t\t}\n\t\t\txs->valid=1;\n\t\t\t}\n\t\ti=X509_cmp_current_time(X509_get_notAfter(xs));\n\t\tif (i == 0)\n\t\t\t{\n\t\t\tctx->error=X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD;\n\t\t\tctx->current_cert=xs;\n\t\t\tok=(*cb)(0,ctx);\n\t\t\tif (!ok) goto end;\n\t\t\t}\n\t\tif (i < 0)\n\t\t\t{\n\t\t\tctx->error=X509_V_ERR_CERT_HAS_EXPIRED;\n\t\t\tctx->current_cert=xs;\n\t\t\tok=(*cb)(0,ctx);\n\t\t\tif (!ok) goto end;\n\t\t\t}\n\t\tctx->current_cert=xs;\n\t\tok=(*cb)(1,ctx);\n\t\tif (!ok) goto end;\n\t\tn--;\n\t\tif (n >= 0)\n\t\t\t{\n\t\t\txi=xs;\n\t\t\txs=(X509 *)sk_value(ctx->chain,n);\n\t\t\t}\n\t\t}\n\tok=1;\nend:\n\treturn(ok);\n\t}', 'EVP_PKEY *X509_get_pubkey(X509 *x)\n\t{\n\tif ((x == NULL) || (x->cert_info == NULL))\n\t\treturn(NULL);\n\treturn(X509_PUBKEY_get(x->cert_info->key));\n\t}', 'EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)\n\t{\n\tEVP_PKEY *ret=NULL;\n\tlong j;\n\tint type;\n\tunsigned char *p;\n#ifndef NO_DSA\n\tX509_ALGOR *a;\n#endif\n\tif (key == NULL) goto err;\n\tif (key->pkey != NULL)\n\t    {\n\t    CRYPTO_add(&key->pkey->references,1,CRYPTO_LOCK_EVP_PKEY);\n\t    return(key->pkey);\n\t    }\n\tif (key->public_key == NULL) goto err;\n\ttype=OBJ_obj2nid(key->algor->algorithm);\n\tp=key->public_key->data;\n        j=key->public_key->length;\n        if ((ret=d2i_PublicKey(type,NULL,&p,(long)j)) == NULL)\n\t\t{\n\t\tX509err(X509_F_X509_PUBKEY_GET,X509_R_ERR_ASN1_LIB);\n\t\tgoto err;\n\t\t}\n\tret->save_parameters=0;\n#ifndef NO_DSA\n\ta=key->algor;\n\tif (ret->type == EVP_PKEY_DSA)\n\t\t{\n\t\tif (a->parameter->type == V_ASN1_SEQUENCE)\n\t\t\t{\n\t\t\tret->pkey.dsa->write_params=0;\n\t\t\tp=a->parameter->value.sequence->data;\n\t\t\tj=a->parameter->value.sequence->length;\n\t\t\tif (!d2i_DSAparams(&ret->pkey.dsa,&p,(long)j))\n\t\t\t\tgoto err;\n\t\t\t}\n\t\tret->save_parameters=1;\n\t\t}\n#endif\n\tkey->pkey=ret;\n\tCRYPTO_add(&ret->references,1,CRYPTO_LOCK_EVP_PKEY);\n\treturn(ret);\nerr:\n\tif (ret != NULL)\n\t\tEVP_PKEY_free(ret);\n\treturn(NULL);\n\t}', 'DSA *d2i_DSAparams(DSA **a, unsigned char **pp, long length)\n\t{\n\tint i=ERR_R_NESTED_ASN1_ERROR;\n\tASN1_INTEGER *bs=NULL;\n\tM_ASN1_D2I_vars(a,DSA *,DSA_new);\n\tM_ASN1_D2I_Init();\n\tM_ASN1_D2I_start_sequence();\n\tM_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);\n\tif ((ret->p=BN_bin2bn(bs->data,bs->length,ret->p)) == NULL) goto err_bn;\n\tM_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);\n\tif ((ret->q=BN_bin2bn(bs->data,bs->length,ret->q)) == NULL) goto err_bn;\n\tM_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);\n\tif ((ret->g=BN_bin2bn(bs->data,bs->length,ret->g)) == NULL) goto err_bn;\n\tASN1_BIT_STRING_free(bs);\n\tM_ASN1_D2I_Finish_2(a);\nerr_bn:\n\ti=ERR_R_BN_LIB;\nerr:\n\tASN1err(ASN1_F_D2I_DSAPARAMS,i);\n\tif ((ret != NULL) && ((a == NULL) || (*a != ret))) DSA_free(ret);\n\tif (bs != NULL) ASN1_BIT_STRING_free(bs);\n\treturn(NULL);\n\t}', 'ASN1_INTEGER *d2i_ASN1_INTEGER(ASN1_INTEGER **a, unsigned char **pp,\n\t     long length)\n\t{\n\tASN1_INTEGER *ret=NULL;\n\tunsigned char *p,*to,*s;\n\tlong len;\n\tint inf,tag,xclass;\n\tint i;\n\tif ((a == NULL) || ((*a) == NULL))\n\t\t{\n\t\tif ((ret=ASN1_INTEGER_new()) == NULL) return(NULL);\n\t\tret->type=V_ASN1_INTEGER;\n\t\t}\n\telse\n\t\tret=(*a);\n\tp= *pp;\n\tinf=ASN1_get_object(&p,&len,&tag,&xclass,length);\n\tif (inf & 0x80)\n\t\t{\n\t\ti=ASN1_R_BAD_OBJECT_HEADER;\n\t\tgoto err;\n\t\t}\n\tif (tag != V_ASN1_INTEGER)\n\t\t{\n\t\ti=ASN1_R_EXPECTING_AN_INTEGER;\n\t\tgoto err;\n\t\t}\n\ts=(unsigned char *)Malloc((int)len+1);\n\tif (s == NULL)\n\t\t{\n\t\ti=ERR_R_MALLOC_FAILURE;\n\t\tgoto err;\n\t\t}\n\tto=s;\n\tif (*p & 0x80)\n\t\t{\n\t\tret->type=V_ASN1_NEG_INTEGER;\n\t\tif (*p == 0xff)\n\t\t\t{\n\t\t\tp++;\n\t\t\tlen--;\n\t\t\t}\n\t\tfor (i=(int)len; i>0; i--)\n\t\t\t*(to++)= (*(p++)^0xFF)+1;\n\t\t}\n\telse\n\t\t{\n\t\tret->type=V_ASN1_INTEGER;\n\t\tif ((*p == 0) && (len != 1))\n\t\t\t{\n\t\t\tp++;\n\t\t\tlen--;\n\t\t\t}\n\t\tmemcpy(s,p,(int)len);\n\t\tp+=len;\n\t\t}\n\tif (ret->data != NULL) Free((char *)ret->data);\n\tret->data=s;\n\tret->length=(int)len;\n\tif (a != NULL) (*a)=ret;\n\t*pp=p;\n\treturn(ret);\nerr:\n\tASN1err(ASN1_F_D2I_ASN1_INTEGER,i);\n\tif ((ret != NULL) && ((a == NULL) || (*a != ret)))\n\t\tASN1_INTEGER_free(ret);\n\treturn(NULL);\n\t}', "int X509_cmp_current_time(ASN1_UTCTIME *ctm)\n\t{\n\tchar *str;\n\tASN1_UTCTIME atm;\n\ttime_t offset;\n\tchar buff1[24],buff2[24],*p;\n\tint i,j;\n\tp=buff1;\n\ti=ctm->length;\n\tstr=(char *)ctm->data;\n\tif ((i < 11) || (i > 17)) return(0);\n\tmemcpy(p,str,10);\n\tp+=10;\n\tstr+=10;\n\tif ((*str == 'Z') || (*str == '-') || (*str == '+'))\n\t\t{ *(p++)='0'; *(p++)='0'; }\n\telse\t{ *(p++)= *(str++); *(p++)= *(str++); }\n\t*(p++)='Z';\n\t*(p++)='\\0';\n\tif (*str == 'Z')\n\t\toffset=0;\n\telse\n\t\t{\n\t\tif ((*str != '+') && (str[5] != '-'))\n\t\t\treturn(0);\n\t\toffset=((str[1]-'0')*10+(str[2]-'0'))*60;\n\t\toffset+=(str[3]-'0')*10+(str[4]-'0');\n\t\tif (*str == '-')\n\t\t\toffset= -offset;\n\t\t}\n\tatm.type=V_ASN1_UTCTIME;\n\tatm.length=sizeof(buff2);\n\tatm.data=(unsigned char *)buff2;\n\tX509_gmtime_adj(&atm,-offset);\n\ti=(buff1[0]-'0')*10+(buff1[1]-'0');\n\tif (i < 50) i+=100;\n\tj=(buff2[0]-'0')*10+(buff2[1]-'0');\n\tif (j < 50) j+=100;\n\tif (i < j) return (-1);\n\tif (i > j) return (1);\n\ti=strcmp(buff1,buff2);\n\tif (i == 0)\n\t\treturn(-1);\n\telse\n\t\treturn(i);\n\t}"]