crypto/pem/pem_lib.c:292: error: BUFFER_OVERRUN_L3
  Offset: [-12, +oo] Size: [1, 2147483644] by call to `check_pem`.
Showing all 10 steps of the trace


crypto/pem/pem_lib.c:287:14: Call
285.   
286.       for (;;) {
287.           if (!PEM_read_bio(bp, &nm, &header, &data, &len)) {
                    ^
288.               if (ERR_GET_REASON(ERR_peek_error()) == PEM_R_NO_START_LINE)
289.                   ERR_add_error_data(2, "Expecting: ", name);

crypto/pem/pem_lib.c:722:13: Assignment
  720.               }
  721.               memcpy(nameB->data, &(buf[11]), i - 6);
  722.               nameB->data[i - 6] = '\0';
                     ^
  723.               break;
  724.           }

crypto/pem/pem_lib.c:292:13: Call
290.               return 0;
291.           }
292.           if (check_pem(nm, name))
                   ^
293.               break;
294.           OPENSSL_free(nm);

crypto/pem/pem_lib.c:180:1: Parameter `*nm`
  178.   #endif
  179.   
  180. > static int check_pem(const char *nm, const char *name)
  181.   {
  182.       /* Normal matching nm and name */

crypto/pem/pem_lib.c:195:16: Call
  193.           if (strcmp(nm, PEM_STRING_PKCS8INF) == 0)
  194.               return 1;
  195.           slen = pem_check_suffix(nm, "PRIVATE KEY");
                        ^
  196.           if (slen > 0) {
  197.               /*

crypto/pem/pem_lib.c:855:1: <Length trace>
853.    */
854.   
855. > int pem_check_suffix(const char *pem_str, const char *suffix)
856.   {
857.       int pem_len = strlen(pem_str);

crypto/pem/pem_lib.c:855:1: Parameter `*pem_str`
    853.    */
    854.   
    855. > int pem_check_suffix(const char *pem_str, const char *suffix)
    856.   {
    857.       int pem_len = strlen(pem_str);

crypto/pem/pem_lib.c:862:5: Assignment
    860.       if (suffix_len + 1 >= pem_len)
    861.           return 0;
    862.       p = pem_str + pem_len - suffix_len;
               ^
    863.       if (strcmp(p, suffix))
    864.           return 0;

crypto/pem/pem_lib.c:865:5: Assignment
    863.       if (strcmp(p, suffix))
    864.           return 0;
    865.       p--;
               ^
    866.       if (*p != ' ')
    867.           return 0;

crypto/pem/pem_lib.c:866:9: Array access: Offset: [-12, +oo] Size: [1, 2147483644] by call to `check_pem` 
    864.           return 0;
    865.       p--;
    866.       if (*p != ' ')
                   ^
    867.           return 0;
    868.       return p - pem_str;

int pem_check_suffix(const char *pem_str, const char *suffix)
{
    int pem_len = strlen(pem_str);
    int suffix_len = strlen(suffix);
    const char *p;
    if (suffix_len + 1 >= pem_len)
        return 0;
    p = pem_str + pem_len - suffix_len;
    if (strcmp(p, suffix))
        return 0;
    p--;
    if (*p != ' ')
        return 0;
    return p - pem_str;
}
['int PEM_bytes_read_bio(unsigned char **pdata, long *plen, char **pnm,\n                       const char *name, BIO *bp, pem_password_cb *cb,\n                       void *u)\n{\n    EVP_CIPHER_INFO cipher;\n    char *nm = NULL, *header = NULL;\n    unsigned char *data = NULL;\n    long len;\n    int ret = 0;\n    for (;;) {\n        if (!PEM_read_bio(bp, &nm, &header, &data, &len)) {\n            if (ERR_GET_REASON(ERR_peek_error()) == PEM_R_NO_START_LINE)\n                ERR_add_error_data(2, "Expecting: ", name);\n            return 0;\n        }\n        if (check_pem(nm, name))\n            break;\n        OPENSSL_free(nm);\n        OPENSSL_free(header);\n        OPENSSL_free(data);\n    }\n    if (!PEM_get_EVP_CIPHER_INFO(header, &cipher))\n        goto err;\n    if (!PEM_do_header(&cipher, data, &len, cb, u))\n        goto err;\n    *pdata = data;\n    *plen = len;\n    if (pnm)\n        *pnm = nm;\n    ret = 1;\n err:\n    if (!ret || !pnm)\n        OPENSSL_free(nm);\n    OPENSSL_free(header);\n    if (!ret)\n        OPENSSL_free(data);\n    return ret;\n}', 'int PEM_read_bio(BIO *bp, char **name, char **header, unsigned char **data,\n                 long *len)\n{\n    EVP_ENCODE_CTX *ctx = EVP_ENCODE_CTX_new();\n    int end = 0, i, k, bl = 0, hl = 0, nohead = 0;\n    char buf[256];\n    BUF_MEM *nameB;\n    BUF_MEM *headerB;\n    BUF_MEM *dataB, *tmpB;\n    if (ctx == NULL) {\n        PEMerr(PEM_F_PEM_READ_BIO, ERR_R_MALLOC_FAILURE);\n        return (0);\n    }\n    nameB = BUF_MEM_new();\n    headerB = BUF_MEM_new();\n    dataB = BUF_MEM_new();\n    if ((nameB == NULL) || (headerB == NULL) || (dataB == NULL)) {\n        goto err;\n    }\n    buf[254] = \'\\0\';\n    for (;;) {\n        i = BIO_gets(bp, buf, 254);\n        if (i <= 0) {\n            PEMerr(PEM_F_PEM_READ_BIO, PEM_R_NO_START_LINE);\n            goto err;\n        }\n        while ((i >= 0) && (buf[i] <= \' \'))\n            i--;\n        buf[++i] = \'\\n\';\n        buf[++i] = \'\\0\';\n        if (strncmp(buf, "-----BEGIN ", 11) == 0) {\n            i = strlen(&(buf[11]));\n            if (strncmp(&(buf[11 + i - 6]), "-----\\n", 6) != 0)\n                continue;\n            if (!BUF_MEM_grow(nameB, i + 9)) {\n                PEMerr(PEM_F_PEM_READ_BIO, ERR_R_MALLOC_FAILURE);\n                goto err;\n            }\n            memcpy(nameB->data, &(buf[11]), i - 6);\n            nameB->data[i - 6] = \'\\0\';\n            break;\n        }\n    }\n    hl = 0;\n    if (!BUF_MEM_grow(headerB, 256)) {\n        PEMerr(PEM_F_PEM_READ_BIO, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    headerB->data[0] = \'\\0\';\n    for (;;) {\n        i = BIO_gets(bp, buf, 254);\n        if (i <= 0)\n            break;\n        while ((i >= 0) && (buf[i] <= \' \'))\n            i--;\n        buf[++i] = \'\\n\';\n        buf[++i] = \'\\0\';\n        if (buf[0] == \'\\n\')\n            break;\n        if (!BUF_MEM_grow(headerB, hl + i + 9)) {\n            PEMerr(PEM_F_PEM_READ_BIO, ERR_R_MALLOC_FAILURE);\n            goto err;\n        }\n        if (strncmp(buf, "-----END ", 9) == 0) {\n            nohead = 1;\n            break;\n        }\n        memcpy(&(headerB->data[hl]), buf, i);\n        headerB->data[hl + i] = \'\\0\';\n        hl += i;\n    }\n    bl = 0;\n    if (!BUF_MEM_grow(dataB, 1024)) {\n        PEMerr(PEM_F_PEM_READ_BIO, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    dataB->data[0] = \'\\0\';\n    if (!nohead) {\n        for (;;) {\n            i = BIO_gets(bp, buf, 254);\n            if (i <= 0)\n                break;\n            while ((i >= 0) && (buf[i] <= \' \'))\n                i--;\n            buf[++i] = \'\\n\';\n            buf[++i] = \'\\0\';\n            if (i != 65)\n                end = 1;\n            if (strncmp(buf, "-----END ", 9) == 0)\n                break;\n            if (i > 65)\n                break;\n            if (!BUF_MEM_grow_clean(dataB, i + bl + 9)) {\n                PEMerr(PEM_F_PEM_READ_BIO, ERR_R_MALLOC_FAILURE);\n                goto err;\n            }\n            memcpy(&(dataB->data[bl]), buf, i);\n            dataB->data[bl + i] = \'\\0\';\n            bl += i;\n            if (end) {\n                buf[0] = \'\\0\';\n                i = BIO_gets(bp, buf, 254);\n                if (i <= 0)\n                    break;\n                while ((i >= 0) && (buf[i] <= \' \'))\n                    i--;\n                buf[++i] = \'\\n\';\n                buf[++i] = \'\\0\';\n                break;\n            }\n        }\n    } else {\n        tmpB = headerB;\n        headerB = dataB;\n        dataB = tmpB;\n        bl = hl;\n    }\n    i = strlen(nameB->data);\n    if ((strncmp(buf, "-----END ", 9) != 0) ||\n        (strncmp(nameB->data, &(buf[9]), i) != 0) ||\n        (strncmp(&(buf[9 + i]), "-----\\n", 6) != 0)) {\n        PEMerr(PEM_F_PEM_READ_BIO, PEM_R_BAD_END_LINE);\n        goto err;\n    }\n    EVP_DecodeInit(ctx);\n    i = EVP_DecodeUpdate(ctx,\n                         (unsigned char *)dataB->data, &bl,\n                         (unsigned char *)dataB->data, bl);\n    if (i < 0) {\n        PEMerr(PEM_F_PEM_READ_BIO, PEM_R_BAD_BASE64_DECODE);\n        goto err;\n    }\n    i = EVP_DecodeFinal(ctx, (unsigned char *)&(dataB->data[bl]), &k);\n    if (i < 0) {\n        PEMerr(PEM_F_PEM_READ_BIO, PEM_R_BAD_BASE64_DECODE);\n        goto err;\n    }\n    bl += k;\n    if (bl == 0)\n        goto err;\n    *name = nameB->data;\n    *header = headerB->data;\n    *data = (unsigned char *)dataB->data;\n    *len = bl;\n    OPENSSL_free(nameB);\n    OPENSSL_free(headerB);\n    OPENSSL_free(dataB);\n    EVP_ENCODE_CTX_free(ctx);\n    return (1);\n err:\n    BUF_MEM_free(nameB);\n    BUF_MEM_free(headerB);\n    BUF_MEM_free(dataB);\n    EVP_ENCODE_CTX_free(ctx);\n    return (0);\n}', 'static int check_pem(const char *nm, const char *name)\n{\n    if (strcmp(nm, name) == 0)\n        return 1;\n    if (strcmp(name, PEM_STRING_EVP_PKEY) == 0) {\n        int slen;\n        const EVP_PKEY_ASN1_METHOD *ameth;\n        if (strcmp(nm, PEM_STRING_PKCS8) == 0)\n            return 1;\n        if (strcmp(nm, PEM_STRING_PKCS8INF) == 0)\n            return 1;\n        slen = pem_check_suffix(nm, "PRIVATE KEY");\n        if (slen > 0) {\n            ameth = EVP_PKEY_asn1_find_str(NULL, nm, slen);\n            if (ameth && ameth->old_priv_decode)\n                return 1;\n        }\n        return 0;\n    }\n    if (strcmp(name, PEM_STRING_PARAMETERS) == 0) {\n        int slen;\n        const EVP_PKEY_ASN1_METHOD *ameth;\n        slen = pem_check_suffix(nm, "PARAMETERS");\n        if (slen > 0) {\n            ENGINE *e;\n            ameth = EVP_PKEY_asn1_find_str(&e, nm, slen);\n            if (ameth) {\n                int r;\n                if (ameth->param_decode)\n                    r = 1;\n                else\n                    r = 0;\n#ifndef OPENSSL_NO_ENGINE\n                if (e)\n                    ENGINE_finish(e);\n#endif\n                return r;\n            }\n        }\n        return 0;\n    }\n    if (strcmp(nm, PEM_STRING_DHXPARAMS) == 0\n        && strcmp(name, PEM_STRING_DHPARAMS) == 0)\n        return 1;\n    if (strcmp(nm, PEM_STRING_X509_OLD) == 0\n        && strcmp(name, PEM_STRING_X509) == 0)\n        return 1;\n    if (strcmp(nm, PEM_STRING_X509_REQ_OLD) == 0\n        && strcmp(name, PEM_STRING_X509_REQ) == 0)\n        return 1;\n    if (strcmp(nm, PEM_STRING_X509) == 0\n        && strcmp(name, PEM_STRING_X509_TRUSTED) == 0)\n        return 1;\n    if (strcmp(nm, PEM_STRING_X509_OLD) == 0\n        && strcmp(name, PEM_STRING_X509_TRUSTED) == 0)\n        return 1;\n    if (strcmp(nm, PEM_STRING_X509) == 0\n        && strcmp(name, PEM_STRING_PKCS7) == 0)\n        return 1;\n    if (strcmp(nm, PEM_STRING_PKCS7_SIGNED) == 0\n        && strcmp(name, PEM_STRING_PKCS7) == 0)\n        return 1;\n#ifndef OPENSSL_NO_CMS\n    if (strcmp(nm, PEM_STRING_X509) == 0\n        && strcmp(name, PEM_STRING_CMS) == 0)\n        return 1;\n    if (strcmp(nm, PEM_STRING_PKCS7) == 0\n        && strcmp(name, PEM_STRING_CMS) == 0)\n        return 1;\n#endif\n    return 0;\n}', "int pem_check_suffix(const char *pem_str, const char *suffix)\n{\n    int pem_len = strlen(pem_str);\n    int suffix_len = strlen(suffix);\n    const char *p;\n    if (suffix_len + 1 >= pem_len)\n        return 0;\n    p = pem_str + pem_len - suffix_len;\n    if (strcmp(p, suffix))\n        return 0;\n    p--;\n    if (*p != ' ')\n        return 0;\n    return p - pem_str;\n}"]