crypto/x509/x_name.c:511: error: BUFFER_OVERRUN_L3
  Offset: [4, +oo] (⇐ [1, +oo] + 3) Size: [1, 2147483644].
Showing all 6 steps of the trace


crypto/x509/x_name.c:498:9: <Length trace>
496.       l = 80 - 2 - obase;
497.   
498.       b = X509_NAME_oneline(name, NULL, 0);
               ^
499.       if (!b)
500.           return 0;

crypto/x509/x_name.c:498:9: Call
496.       l = 80 - 2 - obase;
497.   
498.       b = X509_NAME_oneline(name, NULL, 0);
               ^
499.       if (!b)
500.           return 0;

crypto/x509/x509_obj.c:49:9: Assignment
  47.           len = 200;
  48.       } else if (len == 0) {
  49.           return NULL;
                ^
  50.       }
  51.       if (a == NULL) {

crypto/x509/x_name.c:498:5: Assignment
496.       l = 80 - 2 - obase;
497.   
498.       b = X509_NAME_oneline(name, NULL, 0);
           ^
499.       if (!b)
500.           return 0;

crypto/x509/x_name.c:505:5: Assignment
503.           return 1;
504.       }
505.       s = b + 1;                  /* skip the first slash */
           ^
506.   
507.       c = s;

crypto/x509/x_name.c:511:57: Array access: Offset: [4, +oo] (⇐ [1, +oo] + 3) Size: [1, 2147483644]
509.           if (((*s == '/') &&
510.                (ossl_isupper(s[1]) && ((s[2] == '=') ||
511.                                   (ossl_isupper(s[2]) && (s[3] == '='))
                                                               ^
512.                 ))) || (*s == '\0'))
513.           {

int X509_NAME_print(BIO *bp, const X509_NAME *name, int obase)
{
    char *s, *c, *b;
    int l, i;
    l = 80 - 2 - obase;
    b = X509_NAME_oneline(name, NULL, 0);
    if (!b)
        return 0;
    if (!*b) {
        OPENSSL_free(b);
        return 1;
    }
    s = b + 1;
    c = s;
    for (;;) {
        if (((*s == '/') &&
             (ossl_isupper(s[1]) && ((s[2] == '=') ||
                                (ossl_isupper(s[2]) && (s[3] == '='))
              ))) || (*s == '\0'))
        {
            i = s - c;
            if (BIO_write(bp, c, i) != i)
                goto err;
            c = s + 1;
            if (*s != '\0') {
                if (BIO_write(bp, ", ", 2) != 2)
                    goto err;
            }
            l--;
        }
        if (*s == '\0')
            break;
        s++;
        l--;
    }
    OPENSSL_free(b);
    return 1;
 err:
    X509err(X509_F_X509_NAME_PRINT, ERR_R_BUF_LIB);
    OPENSSL_free(b);
    return 0;
}
['int X509_NAME_print(BIO *bp, const X509_NAME *name, int obase)\n{\n    char *s, *c, *b;\n    int l, i;\n    l = 80 - 2 - obase;\n    b = X509_NAME_oneline(name, NULL, 0);\n    if (!b)\n        return 0;\n    if (!*b) {\n        OPENSSL_free(b);\n        return 1;\n    }\n    s = b + 1;\n    c = s;\n    for (;;) {\n        if (((*s == \'/\') &&\n             (ossl_isupper(s[1]) && ((s[2] == \'=\') ||\n                                (ossl_isupper(s[2]) && (s[3] == \'=\'))\n              ))) || (*s == \'\\0\'))\n        {\n            i = s - c;\n            if (BIO_write(bp, c, i) != i)\n                goto err;\n            c = s + 1;\n            if (*s != \'\\0\') {\n                if (BIO_write(bp, ", ", 2) != 2)\n                    goto err;\n            }\n            l--;\n        }\n        if (*s == \'\\0\')\n            break;\n        s++;\n        l--;\n    }\n    OPENSSL_free(b);\n    return 1;\n err:\n    X509err(X509_F_X509_NAME_PRINT, ERR_R_BUF_LIB);\n    OPENSSL_free(b);\n    return 0;\n}', 'char *X509_NAME_oneline(const X509_NAME *a, char *buf, int len)\n{\n    const X509_NAME_ENTRY *ne;\n    int i;\n    int n, lold, l, l1, l2, num, j, type;\n    const char *s;\n    char *p;\n    unsigned char *q;\n    BUF_MEM *b = NULL;\n    static const char hex[17] = "0123456789ABCDEF";\n    int gs_doit[4];\n    char tmp_buf[80];\n#ifdef CHARSET_EBCDIC\n    unsigned char ebcdic_buf[1024];\n#endif\n    if (buf == NULL) {\n        if ((b = BUF_MEM_new()) == NULL)\n            goto err;\n        if (!BUF_MEM_grow(b, 200))\n            goto err;\n        b->data[0] = \'\\0\';\n        len = 200;\n    } else if (len == 0) {\n        return NULL;\n    }\n    if (a == NULL) {\n        if (b) {\n            buf = b->data;\n            OPENSSL_free(b);\n        }\n        strncpy(buf, "NO X509_NAME", len);\n        buf[len - 1] = \'\\0\';\n        return buf;\n    }\n    len--;\n    l = 0;\n    for (i = 0; i < sk_X509_NAME_ENTRY_num(a->entries); i++) {\n        ne = sk_X509_NAME_ENTRY_value(a->entries, i);\n        n = OBJ_obj2nid(ne->object);\n        if ((n == NID_undef) || ((s = OBJ_nid2sn(n)) == NULL)) {\n            i2t_ASN1_OBJECT(tmp_buf, sizeof(tmp_buf), ne->object);\n            s = tmp_buf;\n        }\n        l1 = strlen(s);\n        type = ne->value->type;\n        num = ne->value->length;\n        if (num > NAME_ONELINE_MAX) {\n            X509err(X509_F_X509_NAME_ONELINE, X509_R_NAME_TOO_LONG);\n            goto end;\n        }\n        q = ne->value->data;\n#ifdef CHARSET_EBCDIC\n        if (type == V_ASN1_GENERALSTRING ||\n            type == V_ASN1_VISIBLESTRING ||\n            type == V_ASN1_PRINTABLESTRING ||\n            type == V_ASN1_TELETEXSTRING ||\n            type == V_ASN1_IA5STRING) {\n            if (num > (int)sizeof(ebcdic_buf))\n                num = sizeof(ebcdic_buf);\n            ascii2ebcdic(ebcdic_buf, q, num);\n            q = ebcdic_buf;\n        }\n#endif\n        if ((type == V_ASN1_GENERALSTRING) && ((num % 4) == 0)) {\n            gs_doit[0] = gs_doit[1] = gs_doit[2] = gs_doit[3] = 0;\n            for (j = 0; j < num; j++)\n                if (q[j] != 0)\n                    gs_doit[j & 3] = 1;\n            if (gs_doit[0] | gs_doit[1] | gs_doit[2])\n                gs_doit[0] = gs_doit[1] = gs_doit[2] = gs_doit[3] = 1;\n            else {\n                gs_doit[0] = gs_doit[1] = gs_doit[2] = 0;\n                gs_doit[3] = 1;\n            }\n        } else\n            gs_doit[0] = gs_doit[1] = gs_doit[2] = gs_doit[3] = 1;\n        for (l2 = j = 0; j < num; j++) {\n            if (!gs_doit[j & 3])\n                continue;\n            l2++;\n#ifndef CHARSET_EBCDIC\n            if ((q[j] < \' \') || (q[j] > \'~\'))\n                l2 += 3;\n#else\n            if ((os_toascii[q[j]] < os_toascii[\' \']) ||\n                (os_toascii[q[j]] > os_toascii[\'~\']))\n                l2 += 3;\n#endif\n        }\n        lold = l;\n        l += 1 + l1 + 1 + l2;\n        if (l > NAME_ONELINE_MAX) {\n            X509err(X509_F_X509_NAME_ONELINE, X509_R_NAME_TOO_LONG);\n            goto end;\n        }\n        if (b != NULL) {\n            if (!BUF_MEM_grow(b, l + 1))\n                goto err;\n            p = &(b->data[lold]);\n        } else if (l > len) {\n            break;\n        } else\n            p = &(buf[lold]);\n        *(p++) = \'/\';\n        memcpy(p, s, (unsigned int)l1);\n        p += l1;\n        *(p++) = \'=\';\n#ifndef CHARSET_EBCDIC\n        q = ne->value->data;\n#endif\n        for (j = 0; j < num; j++) {\n            if (!gs_doit[j & 3])\n                continue;\n#ifndef CHARSET_EBCDIC\n            n = q[j];\n            if ((n < \' \') || (n > \'~\')) {\n                *(p++) = \'\\\\\';\n                *(p++) = \'x\';\n                *(p++) = hex[(n >> 4) & 0x0f];\n                *(p++) = hex[n & 0x0f];\n            } else\n                *(p++) = n;\n#else\n            n = os_toascii[q[j]];\n            if ((n < os_toascii[\' \']) || (n > os_toascii[\'~\'])) {\n                *(p++) = \'\\\\\';\n                *(p++) = \'x\';\n                *(p++) = hex[(n >> 4) & 0x0f];\n                *(p++) = hex[n & 0x0f];\n            } else\n                *(p++) = q[j];\n#endif\n        }\n        *p = \'\\0\';\n    }\n    if (b != NULL) {\n        p = b->data;\n        OPENSSL_free(b);\n    } else\n        p = buf;\n    if (i == 0)\n        *p = \'\\0\';\n    return (p);\n err:\n    X509err(X509_F_X509_NAME_ONELINE, ERR_R_MALLOC_FAILURE);\n end:\n    BUF_MEM_free(b);\n    return (NULL);\n}']