apps/crl.c:320: error: BUFFER_OVERRUN_L3
  Offset: [-529, +oo] Size: 12 by call to `ASN1_TIME_print`.
Showing all 13 steps of the trace


apps/crl.c:283:13: Call
281.           EVP_PKEY_free(pkey);
282.           if (delta) {
283.               X509_CRL_free(x);
                   ^
284.               x = delta;
285.           } else {

crypto/asn1/x_crl.c:344:1: Call
  342.   IMPLEMENT_ASN1_FUNCTIONS(X509_CRL_INFO)
  343.   
  344. > IMPLEMENT_ASN1_FUNCTIONS(X509_CRL)
  345.   
  346.   IMPLEMENT_ASN1_DUP_FUNCTION(X509_CRL)

crypto/asn1/tasn_fre.c:70:5: Call
    68.   void ASN1_item_free(ASN1_VALUE *val, const ASN1_ITEM *it)
    69.   {
    70.       ASN1_item_ex_free(&val, it);
              ^
    71.   }
    72.   

crypto/asn1/tasn_fre.c:73:1: Parameter `**pval`
      71.   }
      72.   
      73. > void ASN1_item_ex_free(ASN1_VALUE **pval, const ASN1_ITEM *it)
      74.   {
      75.       const ASN1_TEMPLATE *tt = NULL, *seqtt;

apps/crl.c:320:17: Call
318.               if (lastupdate == i) {
319.                   BIO_printf(bio_out, "lastUpdate=");
320.                   ASN1_TIME_print(bio_out, X509_CRL_get_lastUpdate(x));
                       ^
321.                   BIO_printf(bio_out, "\n");
322.               }

crypto/asn1/t_x509.c:388:1: Parameter `*tm->data`
  386.   }
  387.   
  388. > int ASN1_TIME_print(BIO *bp, const ASN1_TIME *tm)
  389.   {
  390.       if (tm->type == V_ASN1_UTCTIME)

crypto/asn1/t_x509.c:393:16: Call
  391.           return ASN1_UTCTIME_print(bp, tm);
  392.       if (tm->type == V_ASN1_GENERALIZEDTIME)
  393.           return ASN1_GENERALIZEDTIME_print(bp, tm);
                        ^
  394.       BIO_write(bp, "Bad time value", 14);
  395.       return (0);

crypto/asn1/t_x509.c:403:1: <Offset trace>
401.   };
402.   
403. > int ASN1_GENERALIZEDTIME_print(BIO *bp, const ASN1_GENERALIZEDTIME *tm)
404.   {
405.       char *v;

crypto/asn1/t_x509.c:403:1: Parameter `*tm->data`
    401.   };
    402.   
    403. > int ASN1_GENERALIZEDTIME_print(BIO *bp, const ASN1_GENERALIZEDTIME *tm)
    404.   {
    405.       char *v;

crypto/asn1/t_x509.c:424:5: Assignment
    422.       y = (v[0] - '0') * 1000 + (v[1] - '0') * 100
    423.           + (v[2] - '0') * 10 + (v[3] - '0');
    424.       M = (v[4] - '0') * 10 + (v[5] - '0');
               ^
    425.       if ((M > 12) || (M < 1))
    426.           goto err;

crypto/asn1/t_x509.c:398:1: <Length trace>
396.   }
397.   
398. > static const char *mon[12] = {
399.       "Jan", "Feb", "Mar", "Apr", "May", "Jun",
400.       "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"

crypto/asn1/t_x509.c:398:1: Array declaration
    396.   }
    397.   
    398. > static const char *mon[12] = {
    399.       "Jan", "Feb", "Mar", "Apr", "May", "Jun",
    400.       "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"

crypto/asn1/t_x509.c:445:20: Array access: Offset: [-529, +oo] Size: 12 by call to `ASN1_TIME_print` 
    443.   
    444.       if (BIO_printf(bp, "%s %2d %02d:%02d:%02d%.*s %d%s",
    445.                      mon[M - 1], d, h, m, s, f_len, f, y,
                              ^
    446.                      (gmt) ? " GMT" : "") <= 0)
    447.           return (0);

int ASN1_GENERALIZEDTIME_print(BIO *bp, const ASN1_GENERALIZEDTIME *tm)
{
    char *v;
    int gmt = 0;
    int i;
    int y = 0, M = 0, d = 0, h = 0, m = 0, s = 0;
    char *f = NULL;
    int f_len = 0;
    i = tm->length;
    v = (char *)tm->data;
    if (i < 12)
        goto err;
    if (v[i - 1] == 'Z')
        gmt = 1;
    for (i = 0; i < 12; i++)
        if ((v[i] > '9') || (v[i] < '0'))
            goto err;
    y = (v[0] - '0') * 1000 + (v[1] - '0') * 100
        + (v[2] - '0') * 10 + (v[3] - '0');
    M = (v[4] - '0') * 10 + (v[5] - '0');
    if ((M > 12) || (M < 1))
        goto err;
    d = (v[6] - '0') * 10 + (v[7] - '0');
    h = (v[8] - '0') * 10 + (v[9] - '0');
    m = (v[10] - '0') * 10 + (v[11] - '0');
    if (tm->length >= 14 &&
        (v[12] >= '0') && (v[12] <= '9') &&
        (v[13] >= '0') && (v[13] <= '9')) {
        s = (v[12] - '0') * 10 + (v[13] - '0');
        if (tm->length >= 15 && v[14] == '.') {
            int l = tm->length;
            f = &v[14];
            f_len = 1;
            while (14 + f_len < l && f[f_len] >= '0' && f[f_len] <= '9')
                ++f_len;
        }
    }
    if (BIO_printf(bp, "%s %2d %02d:%02d:%02d%.*s %d%s",
                   mon[M - 1], d, h, m, s, f_len, f, y,
                   (gmt) ? " GMT" : "") <= 0)
        return (0);
    else
        return (1);
 err:
    BIO_write(bp, "Bad time value", 14);
    return (0);
}
['int crl_main(int argc, char **argv)\n{\n    X509_CRL *x = NULL;\n    BIO *out = NULL;\n    X509_STORE *store = NULL;\n    X509_STORE_CTX ctx;\n    X509_LOOKUP *lookup = NULL;\n    X509_OBJECT xobj;\n    EVP_PKEY *pkey;\n    const EVP_MD *digest = EVP_sha1();\n    unsigned long nmflag = 0;\n    char nmflag_set = 0;\n    char *infile = NULL, *outfile = NULL, *crldiff = NULL, *keyfile = NULL;\n    char *CAfile = NULL, *CApath = NULL, *prog;\n    OPTION_CHOICE o;\n    int hash = 0, issuer = 0, lastupdate = 0, nextupdate = 0, noout = 0;\n    int informat = FORMAT_PEM, outformat = FORMAT_PEM, keyformat = FORMAT_PEM;\n    int ret = 1, num = 0, badsig = 0, fingerprint = 0, crlnumber = 0;\n    int text = 0, do_ver = 0;\n    int i;\n#ifndef OPENSSL_NO_MD5\n    int hash_old = 0;\n#endif\n    prog = opt_init(argc, argv, crl_options);\n    while ((o = opt_next()) != OPT_EOF) {\n        switch (o) {\n        case OPT_EOF:\n        case OPT_ERR:\n opthelp:\n            BIO_printf(bio_err, "%s: Use -help for summary.\\n", prog);\n            goto end;\n        case OPT_HELP:\n            opt_help(crl_options);\n            ret = 0;\n            goto end;\n        case OPT_INFORM:\n            if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &informat))\n                goto opthelp;\n            break;\n        case OPT_IN:\n            infile = opt_arg();\n            break;\n        case OPT_OUTFORM:\n            if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &outformat))\n                goto opthelp;\n            break;\n        case OPT_OUT:\n            outfile = opt_arg();\n            break;\n        case OPT_KEYFORM:\n            if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &keyformat))\n                goto opthelp;\n            break;\n        case OPT_KEY:\n            keyfile = opt_arg();\n            break;\n        case OPT_GENDELTA:\n            crldiff = opt_arg();\n            break;\n        case OPT_CAPATH:\n            CApath = opt_arg();\n            do_ver = 1;\n            break;\n        case OPT_CAFILE:\n            CAfile = opt_arg();\n            do_ver = 1;\n            break;\n        case OPT_HASH_OLD:\n#ifndef OPENSSL_NO_MD5\n            hash_old = ++num;\n#endif\n            break;\n        case OPT_VERIFY:\n            do_ver = 1;\n            break;\n        case OPT_TEXT:\n            text = 1;\n            break;\n        case OPT_HASH:\n            hash = ++num;\n            break;\n        case OPT_ISSUER:\n            issuer = ++num;\n            break;\n        case OPT_LASTUPDATE:\n            lastupdate = ++num;\n            break;\n        case OPT_NEXTUPDATE:\n            nextupdate = ++num;\n            break;\n        case OPT_NOOUT:\n            noout = ++num;\n            break;\n        case OPT_FINGERPRINT:\n            fingerprint = ++num;\n            break;\n        case OPT_CRLNUMBER:\n            crlnumber = ++num;\n            break;\n        case OPT_BADSIG:\n            badsig = 1;\n            break;\n        case OPT_NAMEOPT:\n            nmflag_set = 1;\n            if (!set_name_ex(&nmflag, opt_arg()))\n                goto opthelp;\n            break;\n        case OPT_MD:\n            if (!opt_md(opt_unknown(), &digest))\n                goto opthelp;\n        }\n    }\n    argc = opt_num_rest();\n    argv = opt_rest();\n    if (!nmflag_set)\n        nmflag = XN_FLAG_ONELINE;\n    if (!app_load_modules(NULL))\n        goto end;\n    x = load_crl(infile, informat);\n    if (x == NULL)\n        goto end;\n    if (do_ver) {\n        if ((store = setup_verify(CAfile, CApath)) == NULL)\n            goto end;\n        lookup = X509_STORE_add_lookup(store, X509_LOOKUP_file());\n        if (lookup == NULL)\n            goto end;\n        if (!X509_STORE_CTX_init(&ctx, store, NULL, NULL)) {\n            BIO_printf(bio_err, "Error initialising X509 store\\n");\n            goto end;\n        }\n        i = X509_STORE_get_by_subject(&ctx, X509_LU_X509,\n                                      X509_CRL_get_issuer(x), &xobj);\n        if (i <= 0) {\n            BIO_printf(bio_err, "Error getting CRL issuer certificate\\n");\n            goto end;\n        }\n        pkey = X509_get_pubkey(xobj.data.x509);\n        X509_OBJECT_free_contents(&xobj);\n        if (!pkey) {\n            BIO_printf(bio_err, "Error getting CRL issuer public key\\n");\n            goto end;\n        }\n        i = X509_CRL_verify(x, pkey);\n        EVP_PKEY_free(pkey);\n        if (i < 0)\n            goto end;\n        if (i == 0)\n            BIO_printf(bio_err, "verify failure\\n");\n        else\n            BIO_printf(bio_err, "verify OK\\n");\n    }\n    if (crldiff) {\n        X509_CRL *newcrl, *delta;\n        if (!keyfile) {\n            BIO_puts(bio_err, "Missing CRL signing key\\n");\n            goto end;\n        }\n        newcrl = load_crl(crldiff, informat);\n        if (!newcrl)\n            goto end;\n        pkey = load_key(keyfile, keyformat, 0, NULL, NULL, "CRL signing key");\n        if (!pkey) {\n            X509_CRL_free(newcrl);\n            goto end;\n        }\n        delta = X509_CRL_diff(x, newcrl, pkey, digest, 0);\n        X509_CRL_free(newcrl);\n        EVP_PKEY_free(pkey);\n        if (delta) {\n            X509_CRL_free(x);\n            x = delta;\n        } else {\n            BIO_puts(bio_err, "Error creating delta CRL\\n");\n            goto end;\n        }\n    }\n    if (num) {\n        for (i = 1; i <= num; i++) {\n            if (issuer == i) {\n                print_name(bio_out, "issuer=", X509_CRL_get_issuer(x),\n                           nmflag);\n            }\n            if (crlnumber == i) {\n                ASN1_INTEGER *crlnum;\n                crlnum = X509_CRL_get_ext_d2i(x, NID_crl_number, NULL, NULL);\n                BIO_printf(bio_out, "crlNumber=");\n                if (crlnum) {\n                    i2a_ASN1_INTEGER(bio_out, crlnum);\n                    ASN1_INTEGER_free(crlnum);\n                } else\n                    BIO_puts(bio_out, "<NONE>");\n                BIO_printf(bio_out, "\\n");\n            }\n            if (hash == i) {\n                BIO_printf(bio_out, "%08lx\\n",\n                           X509_NAME_hash(X509_CRL_get_issuer(x)));\n            }\n#ifndef OPENSSL_NO_MD5\n            if (hash_old == i) {\n                BIO_printf(bio_out, "%08lx\\n",\n                           X509_NAME_hash_old(X509_CRL_get_issuer(x)));\n            }\n#endif\n            if (lastupdate == i) {\n                BIO_printf(bio_out, "lastUpdate=");\n                ASN1_TIME_print(bio_out, X509_CRL_get_lastUpdate(x));\n                BIO_printf(bio_out, "\\n");\n            }\n            if (nextupdate == i) {\n                BIO_printf(bio_out, "nextUpdate=");\n                if (X509_CRL_get_nextUpdate(x))\n                    ASN1_TIME_print(bio_out, X509_CRL_get_nextUpdate(x));\n                else\n                    BIO_printf(bio_out, "NONE");\n                BIO_printf(bio_out, "\\n");\n            }\n            if (fingerprint == i) {\n                int j;\n                unsigned int n;\n                unsigned char md[EVP_MAX_MD_SIZE];\n                if (!X509_CRL_digest(x, digest, md, &n)) {\n                    BIO_printf(bio_err, "out of memory\\n");\n                    goto end;\n                }\n                BIO_printf(bio_out, "%s Fingerprint=",\n                           OBJ_nid2sn(EVP_MD_type(digest)));\n                for (j = 0; j < (int)n; j++) {\n                    BIO_printf(bio_out, "%02X%c", md[j], (j + 1 == (int)n)\n                               ? \'\\n\' : \':\');\n                }\n            }\n        }\n    }\n    out = bio_open_default(outfile, "w");\n    if (out == NULL)\n        goto end;\n    if (text)\n        X509_CRL_print(out, x);\n    if (noout) {\n        ret = 0;\n        goto end;\n    }\n    if (badsig)\n        x->signature->data[x->signature->length - 1] ^= 0x1;\n    if (outformat == FORMAT_ASN1)\n        i = (int)i2d_X509_CRL_bio(out, x);\n    else\n        i = PEM_write_bio_X509_CRL(out, x);\n    if (!i) {\n        BIO_printf(bio_err, "unable to write CRL\\n");\n        goto end;\n    }\n    ret = 0;\n end:\n    if (ret != 0)\n        ERR_print_errors(bio_err);\n    BIO_free_all(out);\n    X509_CRL_free(x);\n    if (store) {\n        X509_STORE_CTX_cleanup(&ctx);\n        X509_STORE_free(store);\n    }\n    return (ret);\n}', 'IMPLEMENT_ASN1_FUNCTIONS(X509_CRL)', 'void ASN1_item_free(ASN1_VALUE *val, const ASN1_ITEM *it)\n{\n    ASN1_item_ex_free(&val, it);\n}', 'void ASN1_item_ex_free(ASN1_VALUE **pval, const ASN1_ITEM *it)\n{\n    const ASN1_TEMPLATE *tt = NULL, *seqtt;\n    const ASN1_EXTERN_FUNCS *ef;\n    const ASN1_AUX *aux = it->funcs;\n    ASN1_aux_cb *asn1_cb;\n    int i;\n    if (!pval)\n        return;\n    if ((it->itype != ASN1_ITYPE_PRIMITIVE) && !*pval)\n        return;\n    if (aux && aux->asn1_cb)\n        asn1_cb = aux->asn1_cb;\n    else\n        asn1_cb = 0;\n    switch (it->itype) {\n    case ASN1_ITYPE_PRIMITIVE:\n        if (it->templates)\n            asn1_template_free(pval, it->templates);\n        else\n            asn1_primitive_free(pval, it);\n        break;\n    case ASN1_ITYPE_MSTRING:\n        asn1_primitive_free(pval, it);\n        break;\n    case ASN1_ITYPE_CHOICE:\n        if (asn1_cb) {\n            i = asn1_cb(ASN1_OP_FREE_PRE, pval, it, NULL);\n            if (i == 2)\n                return;\n        }\n        i = asn1_get_choice_selector(pval, it);\n        if ((i >= 0) && (i < it->tcount)) {\n            ASN1_VALUE **pchval;\n            tt = it->templates + i;\n            pchval = asn1_get_field_ptr(pval, tt);\n            asn1_template_free(pchval, tt);\n        }\n        if (asn1_cb)\n            asn1_cb(ASN1_OP_FREE_POST, pval, it, NULL);\n        OPENSSL_free(*pval);\n        *pval = NULL;\n        break;\n    case ASN1_ITYPE_EXTERN:\n        ef = it->funcs;\n        if (ef && ef->asn1_ex_free)\n            ef->asn1_ex_free(pval, it);\n        break;\n    case ASN1_ITYPE_NDEF_SEQUENCE:\n    case ASN1_ITYPE_SEQUENCE:\n        if (asn1_do_lock(pval, -1, it) > 0)\n            return;\n        if (asn1_cb) {\n            i = asn1_cb(ASN1_OP_FREE_PRE, pval, it, NULL);\n            if (i == 2)\n                return;\n        }\n        asn1_enc_free(pval, it);\n        tt = it->templates + it->tcount - 1;\n        for (i = 0; i < it->tcount; tt--, i++) {\n            ASN1_VALUE **pseqval;\n            seqtt = asn1_do_adb(pval, tt, 0);\n            if (!seqtt)\n                continue;\n            pseqval = asn1_get_field_ptr(pval, seqtt);\n            asn1_template_free(pseqval, seqtt);\n        }\n        if (asn1_cb)\n            asn1_cb(ASN1_OP_FREE_POST, pval, it, NULL);\n        OPENSSL_free(*pval);\n        *pval = NULL;\n        break;\n    }\n}', 'int ASN1_TIME_print(BIO *bp, const ASN1_TIME *tm)\n{\n    if (tm->type == V_ASN1_UTCTIME)\n        return ASN1_UTCTIME_print(bp, tm);\n    if (tm->type == V_ASN1_GENERALIZEDTIME)\n        return ASN1_GENERALIZEDTIME_print(bp, tm);\n    BIO_write(bp, "Bad time value", 14);\n    return (0);\n}', 'int ASN1_GENERALIZEDTIME_print(BIO *bp, const ASN1_GENERALIZEDTIME *tm)\n{\n    char *v;\n    int gmt = 0;\n    int i;\n    int y = 0, M = 0, d = 0, h = 0, m = 0, s = 0;\n    char *f = NULL;\n    int f_len = 0;\n    i = tm->length;\n    v = (char *)tm->data;\n    if (i < 12)\n        goto err;\n    if (v[i - 1] == \'Z\')\n        gmt = 1;\n    for (i = 0; i < 12; i++)\n        if ((v[i] > \'9\') || (v[i] < \'0\'))\n            goto err;\n    y = (v[0] - \'0\') * 1000 + (v[1] - \'0\') * 100\n        + (v[2] - \'0\') * 10 + (v[3] - \'0\');\n    M = (v[4] - \'0\') * 10 + (v[5] - \'0\');\n    if ((M > 12) || (M < 1))\n        goto err;\n    d = (v[6] - \'0\') * 10 + (v[7] - \'0\');\n    h = (v[8] - \'0\') * 10 + (v[9] - \'0\');\n    m = (v[10] - \'0\') * 10 + (v[11] - \'0\');\n    if (tm->length >= 14 &&\n        (v[12] >= \'0\') && (v[12] <= \'9\') &&\n        (v[13] >= \'0\') && (v[13] <= \'9\')) {\n        s = (v[12] - \'0\') * 10 + (v[13] - \'0\');\n        if (tm->length >= 15 && v[14] == \'.\') {\n            int l = tm->length;\n            f = &v[14];\n            f_len = 1;\n            while (14 + f_len < l && f[f_len] >= \'0\' && f[f_len] <= \'9\')\n                ++f_len;\n        }\n    }\n    if (BIO_printf(bp, "%s %2d %02d:%02d:%02d%.*s %d%s",\n                   mon[M - 1], d, h, m, s, f_len, f, y,\n                   (gmt) ? " GMT" : "") <= 0)\n        return (0);\n    else\n        return (1);\n err:\n    BIO_write(bp, "Bad time value", 14);\n    return (0);\n}']