crypto/objects/obj_dat.c:375: error: INTEGER_OVERFLOW_L2
  ([2, 2147483645] + [1, 2147483644]):signed32 by call to `ASN1_object_size`.
Showing all 9 steps of the trace


crypto/objects/obj_dat.c:366:9: Call
364.   
365.       /* Work out size of content octets */
366.       i = a2d_ASN1_OBJECT(NULL, 0, s, -1);
               ^
367.       if (i <= 0) {
368.           /* Don't clear the error */

crypto/asn1/a_object.c:52:9: Assignment
  50.   
  51.       if (num == 0)
  52.           return 0;
                ^
  53.       else if (num == -1)
  54.           num = strlen(buf);

crypto/objects/obj_dat.c:366:5: Assignment
364.   
365.       /* Work out size of content octets */
366.       i = a2d_ASN1_OBJECT(NULL, 0, s, -1);
           ^
367.       if (i <= 0) {
368.           /* Don't clear the error */

crypto/objects/obj_dat.c:375:9: Call
373.       }
374.       /* Work out total size */
375.       j = ASN1_object_size(0, i, V_ASN1_OBJECT);
               ^
376.       if (j < 0)
377.           return NULL;

crypto/asn1/asn1_lib.c:215:1: <LHS trace>
213.   }
214.   
215. > int ASN1_object_size(int constructed, int length, int tag)
216.   {
217.       int ret = 1;

crypto/asn1/asn1_lib.c:215:1: Parameter `length`
  213.   }
  214.   
  215. > int ASN1_object_size(int constructed, int length, int tag)
  216.   {
  217.       int ret = 1;

crypto/asn1/asn1_lib.c:215:1: <RHS trace>
213.   }
214.   
215. > int ASN1_object_size(int constructed, int length, int tag)
216.   {
217.       int ret = 1;

crypto/asn1/asn1_lib.c:215:1: Parameter `length`
  213.   }
  214.   
  215. > int ASN1_object_size(int constructed, int length, int tag)
  216.   {
  217.       int ret = 1;

crypto/asn1/asn1_lib.c:240:5: Binary operation: ([2, 2147483645] + [1, 2147483644]):signed32 by call to `ASN1_object_size` 
  238.       if (ret >= INT_MAX - length)
  239.           return -1;
  240.       return ret + length;
             ^
  241.   }
  242.   

int ASN1_object_size(int constructed, int length, int tag)
{
    int ret = 1;
    if (length < 0)
        return -1;
    if (tag >= 31) {
        while (tag > 0) {
            tag >>= 7;
            ret++;
        }
    }
    if (constructed == 2) {
        ret += 3;
    } else {
        ret++;
        if (length > 127) {
            int tmplen = length;
            while (tmplen > 0) {
                tmplen >>= 8;
                ret++;
            }
        }
    }
    if (ret >= INT_MAX - length)
        return -1;
    return ret + length;
}
['ASN1_OBJECT *OBJ_txt2obj(const char *s, int no_name)\n{\n    int nid = NID_undef;\n    ASN1_OBJECT *op = NULL;\n    unsigned char *buf;\n    unsigned char *p;\n    const unsigned char *cp;\n    int i, j;\n    if (!no_name) {\n        if (((nid = OBJ_sn2nid(s)) != NID_undef) ||\n            ((nid = OBJ_ln2nid(s)) != NID_undef))\n            return OBJ_nid2obj(nid);\n    }\n    i = a2d_ASN1_OBJECT(NULL, 0, s, -1);\n    if (i <= 0) {\n        return NULL;\n    }\n    j = ASN1_object_size(0, i, V_ASN1_OBJECT);\n    if (j < 0)\n        return NULL;\n    if ((buf = OPENSSL_malloc(j)) == NULL)\n        return NULL;\n    p = buf;\n    ASN1_put_object(&p, 0, i, V_ASN1_OBJECT, V_ASN1_UNIVERSAL);\n    a2d_ASN1_OBJECT(p, i, s, -1);\n    cp = buf;\n    op = d2i_ASN1_OBJECT(NULL, &cp, j);\n    OPENSSL_free(buf);\n    return op;\n}', "int a2d_ASN1_OBJECT(unsigned char *out, int olen, const char *buf, int num)\n{\n    int i, first, len = 0, c, use_bn;\n    char ftmp[24], *tmp = ftmp;\n    int tmpsize = sizeof ftmp;\n    const char *p;\n    unsigned long l;\n    BIGNUM *bl = NULL;\n    if (num == 0)\n        return 0;\n    else if (num == -1)\n        num = strlen(buf);\n    p = buf;\n    c = *(p++);\n    num--;\n    if ((c >= '0') && (c <= '2')) {\n        first = c - '0';\n    } else {\n        ASN1err(ASN1_F_A2D_ASN1_OBJECT, ASN1_R_FIRST_NUM_TOO_LARGE);\n        goto err;\n    }\n    if (num <= 0) {\n        ASN1err(ASN1_F_A2D_ASN1_OBJECT, ASN1_R_MISSING_SECOND_NUMBER);\n        goto err;\n    }\n    c = *(p++);\n    num--;\n    for (;;) {\n        if (num <= 0)\n            break;\n        if ((c != '.') && (c != ' ')) {\n            ASN1err(ASN1_F_A2D_ASN1_OBJECT, ASN1_R_INVALID_SEPARATOR);\n            goto err;\n        }\n        l = 0;\n        use_bn = 0;\n        for (;;) {\n            if (num <= 0)\n                break;\n            num--;\n            c = *(p++);\n            if ((c == ' ') || (c == '.'))\n                break;\n            if (!ossl_isdigit(c)) {\n                ASN1err(ASN1_F_A2D_ASN1_OBJECT, ASN1_R_INVALID_DIGIT);\n                goto err;\n            }\n            if (!use_bn && l >= ((ULONG_MAX - 80) / 10L)) {\n                use_bn = 1;\n                if (bl == NULL)\n                    bl = BN_new();\n                if (bl == NULL || !BN_set_word(bl, l))\n                    goto err;\n            }\n            if (use_bn) {\n                if (!BN_mul_word(bl, 10L)\n                    || !BN_add_word(bl, c - '0'))\n                    goto err;\n            } else\n                l = l * 10L + (long)(c - '0');\n        }\n        if (len == 0) {\n            if ((first < 2) && (l >= 40)) {\n                ASN1err(ASN1_F_A2D_ASN1_OBJECT,\n                        ASN1_R_SECOND_NUMBER_TOO_LARGE);\n                goto err;\n            }\n            if (use_bn) {\n                if (!BN_add_word(bl, first * 40))\n                    goto err;\n            } else\n                l += (long)first *40;\n        }\n        i = 0;\n        if (use_bn) {\n            int blsize;\n            blsize = BN_num_bits(bl);\n            blsize = (blsize + 6) / 7;\n            if (blsize > tmpsize) {\n                if (tmp != ftmp)\n                    OPENSSL_free(tmp);\n                tmpsize = blsize + 32;\n                tmp = OPENSSL_malloc(tmpsize);\n                if (tmp == NULL)\n                    goto err;\n            }\n            while (blsize--) {\n                BN_ULONG t = BN_div_word(bl, 0x80L);\n                if (t == (BN_ULONG)-1)\n                    goto err;\n                tmp[i++] = (unsigned char)t;\n            }\n        } else {\n            for (;;) {\n                tmp[i++] = (unsigned char)l & 0x7f;\n                l >>= 7L;\n                if (l == 0L)\n                    break;\n            }\n        }\n        if (out != NULL) {\n            if (len + i > olen) {\n                ASN1err(ASN1_F_A2D_ASN1_OBJECT, ASN1_R_BUFFER_TOO_SMALL);\n                goto err;\n            }\n            while (--i > 0)\n                out[len++] = tmp[i] | 0x80;\n            out[len++] = tmp[0];\n        } else\n            len += i;\n    }\n    if (tmp != ftmp)\n        OPENSSL_free(tmp);\n    BN_free(bl);\n    return len;\n err:\n    if (tmp != ftmp)\n        OPENSSL_free(tmp);\n    BN_free(bl);\n    return 0;\n}", 'int ASN1_object_size(int constructed, int length, int tag)\n{\n    int ret = 1;\n    if (length < 0)\n        return -1;\n    if (tag >= 31) {\n        while (tag > 0) {\n            tag >>= 7;\n            ret++;\n        }\n    }\n    if (constructed == 2) {\n        ret += 3;\n    } else {\n        ret++;\n        if (length > 127) {\n            int tmplen = length;\n            while (tmplen > 0) {\n                tmplen >>= 8;\n                ret++;\n            }\n        }\n    }\n    if (ret >= INT_MAX - length)\n        return -1;\n    return ret + length;\n}']