apps/spkac.c:234: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, +oo] by call to `NETSCAPE_SPKI_get_pubkey`.
Showing all 19 steps of the trace


apps/spkac.c:215:9: Call
213.   	}
214.   
215.   	spki = NETSCAPE_SPKI_b64_decode(spkstr, -1);
               ^
216.   	if(!spki) {
217.   		BIO_printf(bio_err, "Error loading SPKAC\n");

crypto/x509/x509spki.c:97:9: Call
  95.   	}
  96.   	p = spki_der;
  97.   	spki = d2i_NETSCAPE_SPKI(NULL, &p, spki_len);
                 ^
  98.   	Free(spki_der);
  99.   	return spki;

crypto/asn1/x_spki.c:132:1: Parameter `(*a)->spkac->pubkey->algor->parameter->value.ptr->data`
    130.   	}
    131.   
    132. > NETSCAPE_SPKI *d2i_NETSCAPE_SPKI(NETSCAPE_SPKI **a, unsigned char **pp,
    133.   	     long length)
    134.   	{

apps/spkac.c:234:11: Call
232.   	if(verify) {
233.   		EVP_PKEY *pktmp;
234.   		pktmp = NETSCAPE_SPKI_get_pubkey(spki);
                 ^
235.   		i = NETSCAPE_SPKI_verify(spki, pktmp);
236.   		EVP_PKEY_free(pktmp);

crypto/x509/x509spki.c:70:1: Parameter `*x->spkac->pubkey->algor->parameter->value.sequence->data`
  68.   }
  69.   
  70. > EVP_PKEY *NETSCAPE_SPKI_get_pubkey(NETSCAPE_SPKI *x)
  71.   {
  72.   	if ((x == NULL) || (x->spkac == NULL))

crypto/x509/x509spki.c:74:9: Call
  72.   	if ((x == NULL) || (x->spkac == NULL))
  73.   		return(NULL);
  74.   	return(X509_PUBKEY_get(x->spkac->pubkey));
                ^
  75.   }
  76.   

crypto/asn1/x_pubkey.c:201:1: Parameter `*key->algor->parameter->value.sequence->data`
    199.   	}
    200.   
    201. > EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)
    202.   	{
    203.   	EVP_PKEY *ret=NULL;

crypto/asn1/x_pubkey.c:238:4: Assignment
    236.   			{
    237.   			ret->pkey.dsa->write_params=0;
    238.   			p=a->parameter->value.sequence->data;
              ^
    239.   			j=a->parameter->value.sequence->length;
    240.   			if (!d2i_DSAparams(&ret->pkey.dsa,&p,(long)j))

crypto/asn1/x_pubkey.c:240:9: Call
    238.   			p=a->parameter->value.sequence->data;
    239.   			j=a->parameter->value.sequence->length;
    240.   			if (!d2i_DSAparams(&ret->pkey.dsa,&p,(long)j))
                   ^
    241.   				goto err;
    242.   			}

crypto/asn1/d2i_dsap.c:71:1: Parameter `**pp`
      69.   #endif
      70.   
      71. > DSA *d2i_DSAparams(DSA **a, unsigned char **pp, long length)
      72.   	{
      73.   	int i=ERR_R_NESTED_ASN1_ERROR;

crypto/asn1/d2i_dsap.c:77:2: Assignment
      75.   	M_ASN1_D2I_vars(a,DSA *,DSA_new);
      76.   
      77.   	M_ASN1_D2I_Init();
             ^
      78.   	M_ASN1_D2I_start_sequence();
      79.   	M_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);

crypto/asn1/d2i_dsap.c:78:2: Call
      76.   
      77.   	M_ASN1_D2I_Init();
      78.   	M_ASN1_D2I_start_sequence();
             ^
      79.   	M_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);
      80.   	if ((ret->p=BN_bin2bn(bs->data,bs->length,ret->p)) == NULL) goto err_bn;

crypto/asn1/asn1_lib.c:277:1: Parameter `*c->p`
        275.   	}
        276.   
        277. > int asn1_GetSequence(ASN1_CTX *c, long *length)
        278.   	{
        279.   	unsigned char *q;

crypto/asn1/asn1_lib.c:282:9: Call
        280.   
        281.   	q=c->p;
        282.   	c->inf=ASN1_get_object(&(c->p),&(c->slen),&(c->tag),&(c->xclass),
                       ^
        283.   		*length);
        284.   	if (c->inf & 0x80)

crypto/asn1/asn1_lib.c:83:1: <Length trace>
81.   
82.   
83. > int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
84.   	     long omax)
85.   	{

crypto/asn1/asn1_lib.c:83:1: Parameter `**pp`
          81.   
          82.   
          83. > int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
          84.   	     long omax)
          85.   	{

crypto/asn1/asn1_lib.c:88:2: Assignment
          86.   	int i,ret;
          87.   	long l;
          88.   	unsigned char *p= *pp;
                 ^
          89.   	int tag,xclass,inf;
          90.   	long max=omax;

crypto/asn1/asn1_lib.c:98:3: Assignment
          96.   	if (i == V_ASN1_PRIMITIVE_TAG)
          97.   		{		/* high-tag */
          98.   		p++;
                   ^
          99.   		if (--max == 0) goto err;
          100.   		l=0;

crypto/asn1/asn1_lib.c:101:10: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `NETSCAPE_SPKI_get_pubkey` 
          99.   		if (--max == 0) goto err;
          100.   		l=0;
          101.   		while (*p&0x80)
                          ^
          102.   			{
          103.   			l<<=7L;

int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
	     long omax)
	{
	int i,ret;
	long l;
	unsigned char *p= *pp;
	int tag,xclass,inf;
	long max=omax;
	if (!max) goto err;
	ret=(*p&V_ASN1_CONSTRUCTED);
	xclass=(*p&V_ASN1_PRIVATE);
	i= *p&V_ASN1_PRIMITIVE_TAG;
	if (i == V_ASN1_PRIMITIVE_TAG)
		{
		p++;
		if (--max == 0) goto err;
		l=0;
		while (*p&0x80)
			{
			l<<=7L;
			l|= *(p++)&0x7f;
			if (--max == 0) goto err;
			}
		l<<=7L;
		l|= *(p++)&0x7f;
		tag=(int)l;
		}
	else
		{
		tag=i;
		p++;
		if (--max == 0) goto err;
		}
	*ptag=tag;
	*pclass=xclass;
	if (!asn1_get_length(&p,&inf,plength,(int)max)) goto err;
#if 0
	fprintf(stderr,"p=%d + *plength=%ld > omax=%ld + *pp=%d  (%d > %d)\n",
		(int)p,*plength,omax,(int)*pp,(int)(p+ *plength),
		(int)(omax+ *pp));
#endif
#if 0
	if ((p+ *plength) > (omax+ *pp))
		{
		ASN1err(ASN1_F_ASN1_GET_OBJECT,ASN1_R_TOO_LONG);
		ret|=0x80;
		}
#endif
	*pp=p;
	return(ret|inf);
err:
	ASN1err(ASN1_F_ASN1_GET_OBJECT,ASN1_R_HEADER_TOO_LONG);
	return(0x80);
	}
['int MAIN(int argc, char **argv)\n\t{\n\tint i,badops=0, ret = 1;\n\tBIO *in = NULL,*out = NULL, *key = NULL;\n\tint verify=0,noout=0;\n\tchar *infile = NULL,*outfile = NULL,*prog;\n\tchar *spkac = "SPKAC", *spksect = "default", *spkstr = NULL;\n\tchar *challenge = NULL, *keyfile = NULL;\n\tLHASH *conf;\n\tNETSCAPE_SPKI *spki = NULL;\n\tEVP_PKEY *pkey = NULL;\n\tapps_startup();\n\tif (!bio_err) bio_err = BIO_new_fp(stderr, BIO_NOCLOSE);\n\tprog=argv[0];\n\targc--;\n\targv++;\n\twhile (argc >= 1)\n\t\t{\n\t\tif (strcmp(*argv,"-in") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tinfile= *(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-out") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\toutfile= *(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-key") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tkeyfile= *(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-challenge") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tchallenge= *(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-spkac") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tspkac= *(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-spksect") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tspksect= *(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-noout") == 0)\n\t\t\tnoout=1;\n\t\telse if (strcmp(*argv,"-verify") == 0)\n\t\t\tverify=1;\n\t\telse badops = 1;\n\t\targc--;\n\t\targv++;\n\t\t}\n\tif (badops)\n\t\t{\nbad:\n\t\tBIO_printf(bio_err,"%s [options] <infile >outfile\\n",prog);\n\t\tBIO_printf(bio_err,"where options are\\n");\n\t\tBIO_printf(bio_err," -in arg       input file\\n");\n\t\tBIO_printf(bio_err," -out arg      output file\\n");\n\t\tBIO_printf(bio_err," -spkac arg    alternative SPKAC name\\n");\n\t\tBIO_printf(bio_err," -noout        don\'t print SPKAC\\n");\n\t\tBIO_printf(bio_err," -verify       verify SPKAC signature\\n");\n\t\tgoto end;\n\t\t}\n\tERR_load_crypto_strings();\n\tif(keyfile) {\n\t\tif(strcmp(keyfile, "-")) key = BIO_new_file(keyfile, "r");\n\t\telse key = BIO_new_fp(stdin, BIO_NOCLOSE);\n\t\tif(!key) {\n\t\t\tBIO_printf(bio_err, "Error opening key file\\n");\n\t\t\tERR_print_errors(bio_err);\n\t\t\tgoto end;\n\t\t}\n\t\tpkey = PEM_read_bio_PrivateKey(key, NULL, NULL, NULL);\n\t\tif(!pkey) {\n\t\t\tBIO_printf(bio_err, "Error reading private key\\n");\n\t\t\tERR_print_errors(bio_err);\n\t\t\tgoto end;\n\t\t}\n\t\tspki = NETSCAPE_SPKI_new();\n\t\tif(challenge) ASN1_STRING_set(spki->spkac->challenge,\n\t\t\t\t\t\t challenge, strlen(challenge));\n\t\tNETSCAPE_SPKI_set_pubkey(spki, pkey);\n\t\tNETSCAPE_SPKI_sign(spki, pkey, EVP_md5());\n\t\tspkstr = NETSCAPE_SPKI_b64_encode(spki);\n\t\tif (outfile) out = BIO_new_file(outfile, "w");\n\t\telse out = BIO_new_fp(stdout, BIO_NOCLOSE);\n\t\tif(!out) {\n\t\t\tBIO_printf(bio_err, "Error opening output file\\n");\n\t\t\tERR_print_errors(bio_err);\n\t\t\tgoto end;\n\t\t}\n\t\tBIO_printf(out, "SPKAC=%s\\n", spkstr);\n\t\tret = 0;\n\t\tgoto end;\n\t}\n\tif (infile) in = BIO_new_file(infile, "r");\n\telse in = BIO_new_fp(stdin, BIO_NOCLOSE);\n\tif(!in) {\n\t\tBIO_printf(bio_err, "Error opening input file\\n");\n\t\tERR_print_errors(bio_err);\n\t\tgoto end;\n\t}\n\tconf = CONF_load_bio(NULL, in, NULL);\n\tif(!conf) {\n\t\tBIO_printf(bio_err, "Error parsing config file\\n");\n\t\tERR_print_errors(bio_err);\n\t\tgoto end;\n\t}\n\tspkstr = CONF_get_string(conf, spksect, spkac);\n\tif(!spkstr) {\n\t\tBIO_printf(bio_err, "Can\'t find SPKAC called \\"%s\\"\\n", spkac);\n\t\tERR_print_errors(bio_err);\n\t\tgoto end;\n\t}\n\tspki = NETSCAPE_SPKI_b64_decode(spkstr, -1);\n\tif(!spki) {\n\t\tBIO_printf(bio_err, "Error loading SPKAC\\n");\n\t\tERR_print_errors(bio_err);\n\t\tgoto end;\n\t}\n\tif (outfile) out = BIO_new_file(outfile, "w");\n\telse out = BIO_new_fp(stdout, BIO_NOCLOSE);\n\tif(!out) {\n\t\tBIO_printf(bio_err, "Error opening output file\\n");\n\t\tERR_print_errors(bio_err);\n\t\tgoto end;\n\t}\n\tif(!noout) NETSCAPE_SPKI_print(out, spki);\n\tif(verify) {\n\t\tEVP_PKEY *pktmp;\n\t\tpktmp = NETSCAPE_SPKI_get_pubkey(spki);\n\t\ti = NETSCAPE_SPKI_verify(spki, pktmp);\n\t\tEVP_PKEY_free(pktmp);\n\t\tif(i) BIO_printf(bio_err, "Signature OK\\n");\n\t\telse {\n\t\t\tBIO_printf(bio_err, "Signature Failure\\n");\n\t\t\tERR_print_errors(bio_err);\n\t\t\tgoto end;\n\t\t}\n\t}\n\tret = 0;\nend:\n\tNETSCAPE_SPKI_free(spki);\n\tBIO_free(in);\n\tBIO_free(out);\n\tBIO_free(key);\n\tEVP_PKEY_free(pkey);\n\tif(spkstr) Free(spkstr);\n\tEXIT(ret);\n\t}', 'NETSCAPE_SPKI * NETSCAPE_SPKI_b64_decode(char *str, int len)\n{\n\tunsigned char *spki_der, *p;\n\tint spki_len;\n\tNETSCAPE_SPKI *spki;\n\tif(len <= 0) len = strlen(str);\n\tif (!(spki_der = Malloc(len + 1))) {\n\t\tX509err(X509_F_NETSCAPE_SPKI_B64_DECODE, ERR_R_MALLOC_FAILURE);\n\t\treturn NULL;\n\t}\n\tspki_len = EVP_DecodeBlock(spki_der, str, len);\n\tif(spki_len < 0) {\n\t\tX509err(X509_F_NETSCAPE_SPKI_B64_DECODE,\n\t\t\t\t\t\tX509_R_BASE64_DECODE_ERROR);\n\t\tFree(spki_der);\n\t\treturn NULL;\n\t}\n\tp = spki_der;\n\tspki = d2i_NETSCAPE_SPKI(NULL, &p, spki_len);\n\tFree(spki_der);\n\treturn spki;\n}', 'NETSCAPE_SPKI *d2i_NETSCAPE_SPKI(NETSCAPE_SPKI **a, unsigned char **pp,\n\t     long length)\n\t{\n\tM_ASN1_D2I_vars(a,NETSCAPE_SPKI *,NETSCAPE_SPKI_new);\n\tM_ASN1_D2I_Init();\n\tM_ASN1_D2I_start_sequence();\n\tM_ASN1_D2I_get(ret->spkac,d2i_NETSCAPE_SPKAC);\n\tM_ASN1_D2I_get(ret->sig_algor,d2i_X509_ALGOR);\n\tM_ASN1_D2I_get(ret->signature,d2i_ASN1_BIT_STRING);\n\tM_ASN1_D2I_Finish(a,NETSCAPE_SPKI_free,ASN1_F_D2I_NETSCAPE_SPKI);\n\t}', 'EVP_PKEY *NETSCAPE_SPKI_get_pubkey(NETSCAPE_SPKI *x)\n{\n\tif ((x == NULL) || (x->spkac == NULL))\n\t\treturn(NULL);\n\treturn(X509_PUBKEY_get(x->spkac->pubkey));\n}', 'EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)\n\t{\n\tEVP_PKEY *ret=NULL;\n\tlong j;\n\tint type;\n\tunsigned char *p;\n#ifndef NO_DSA\n\tX509_ALGOR *a;\n#endif\n\tif (key == NULL) goto err;\n\tif (key->pkey != NULL)\n\t    {\n\t    CRYPTO_add(&key->pkey->references,1,CRYPTO_LOCK_EVP_PKEY);\n\t    return(key->pkey);\n\t    }\n\tif (key->public_key == NULL) goto err;\n\ttype=OBJ_obj2nid(key->algor->algorithm);\n\tp=key->public_key->data;\n        j=key->public_key->length;\n        if ((ret=d2i_PublicKey(type,NULL,&p,(long)j)) == NULL)\n\t\t{\n\t\tX509err(X509_F_X509_PUBKEY_GET,X509_R_ERR_ASN1_LIB);\n\t\tgoto err;\n\t\t}\n\tret->save_parameters=0;\n#ifndef NO_DSA\n\ta=key->algor;\n\tif (ret->type == EVP_PKEY_DSA)\n\t\t{\n\t\tif (a->parameter->type == V_ASN1_SEQUENCE)\n\t\t\t{\n\t\t\tret->pkey.dsa->write_params=0;\n\t\t\tp=a->parameter->value.sequence->data;\n\t\t\tj=a->parameter->value.sequence->length;\n\t\t\tif (!d2i_DSAparams(&ret->pkey.dsa,&p,(long)j))\n\t\t\t\tgoto err;\n\t\t\t}\n\t\tret->save_parameters=1;\n\t\t}\n#endif\n\tkey->pkey=ret;\n\tCRYPTO_add(&ret->references,1,CRYPTO_LOCK_EVP_PKEY);\n\treturn(ret);\nerr:\n\tif (ret != NULL)\n\t\tEVP_PKEY_free(ret);\n\treturn(NULL);\n\t}', 'DSA *d2i_DSAparams(DSA **a, unsigned char **pp, long length)\n\t{\n\tint i=ERR_R_NESTED_ASN1_ERROR;\n\tASN1_INTEGER *bs=NULL;\n\tM_ASN1_D2I_vars(a,DSA *,DSA_new);\n\tM_ASN1_D2I_Init();\n\tM_ASN1_D2I_start_sequence();\n\tM_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);\n\tif ((ret->p=BN_bin2bn(bs->data,bs->length,ret->p)) == NULL) goto err_bn;\n\tM_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);\n\tif ((ret->q=BN_bin2bn(bs->data,bs->length,ret->q)) == NULL) goto err_bn;\n\tM_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);\n\tif ((ret->g=BN_bin2bn(bs->data,bs->length,ret->g)) == NULL) goto err_bn;\n\tASN1_BIT_STRING_free(bs);\n\tM_ASN1_D2I_Finish_2(a);\nerr_bn:\n\ti=ERR_R_BN_LIB;\nerr:\n\tASN1err(ASN1_F_D2I_DSAPARAMS,i);\n\tif ((ret != NULL) && ((a == NULL) || (*a != ret))) DSA_free(ret);\n\tif (bs != NULL) ASN1_BIT_STRING_free(bs);\n\treturn(NULL);\n\t}', 'int asn1_GetSequence(ASN1_CTX *c, long *length)\n\t{\n\tunsigned char *q;\n\tq=c->p;\n\tc->inf=ASN1_get_object(&(c->p),&(c->slen),&(c->tag),&(c->xclass),\n\t\t*length);\n\tif (c->inf & 0x80)\n\t\t{\n\t\tc->error=ERR_R_BAD_GET_ASN1_OBJECT_CALL;\n\t\treturn(0);\n\t\t}\n\tif (c->tag != V_ASN1_SEQUENCE)\n\t\t{\n\t\tc->error=ERR_R_EXPECTING_AN_ASN1_SEQUENCE;\n\t\treturn(0);\n\t\t}\n\t(*length)-=(c->p-q);\n\tif (c->max && (*length < 0))\n\t\t{\n\t\tc->error=ERR_R_ASN1_LENGTH_MISMATCH;\n\t\treturn(0);\n\t\t}\n\tif (c->inf == (1|V_ASN1_CONSTRUCTED))\n\t\tc->slen= *length+ *(c->pp)-c->p;\n\tc->eos=0;\n\treturn(1);\n\t}', 'int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,\n\t     long omax)\n\t{\n\tint i,ret;\n\tlong l;\n\tunsigned char *p= *pp;\n\tint tag,xclass,inf;\n\tlong max=omax;\n\tif (!max) goto err;\n\tret=(*p&V_ASN1_CONSTRUCTED);\n\txclass=(*p&V_ASN1_PRIVATE);\n\ti= *p&V_ASN1_PRIMITIVE_TAG;\n\tif (i == V_ASN1_PRIMITIVE_TAG)\n\t\t{\n\t\tp++;\n\t\tif (--max == 0) goto err;\n\t\tl=0;\n\t\twhile (*p&0x80)\n\t\t\t{\n\t\t\tl<<=7L;\n\t\t\tl|= *(p++)&0x7f;\n\t\t\tif (--max == 0) goto err;\n\t\t\t}\n\t\tl<<=7L;\n\t\tl|= *(p++)&0x7f;\n\t\ttag=(int)l;\n\t\t}\n\telse\n\t\t{\n\t\ttag=i;\n\t\tp++;\n\t\tif (--max == 0) goto err;\n\t\t}\n\t*ptag=tag;\n\t*pclass=xclass;\n\tif (!asn1_get_length(&p,&inf,plength,(int)max)) goto err;\n#if 0\n\tfprintf(stderr,"p=%d + *plength=%ld > omax=%ld + *pp=%d  (%d > %d)\\n",\n\t\t(int)p,*plength,omax,(int)*pp,(int)(p+ *plength),\n\t\t(int)(omax+ *pp));\n#endif\n#if 0\n\tif ((p+ *plength) > (omax+ *pp))\n\t\t{\n\t\tASN1err(ASN1_F_ASN1_GET_OBJECT,ASN1_R_TOO_LONG);\n\t\tret|=0x80;\n\t\t}\n#endif\n\t*pp=p;\n\treturn(ret|inf);\nerr:\n\tASN1err(ASN1_F_ASN1_GET_OBJECT,ASN1_R_HEADER_TOO_LONG);\n\treturn(0x80);\n\t}']