crypto/x509v3/v3_utl.c:143: error: BUFFER_OVERRUN_L3
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `BN_bn2dec`.
Showing all 13 steps of the trace


crypto/x509v3/v3_utl.c:142:15: Call
140.   	char *strtmp = NULL;
141.   	if(!a) return NULL;
142.   	if(!(bntmp = ASN1_INTEGER_to_BN(a, NULL)) ||
                     ^
143.   	    !(strtmp = BN_bn2dec(bntmp)) )
144.   		X509V3err(X509V3_F_I2S_ASN1_INTEGER,ERR_R_MALLOC_FAILURE);

crypto/asn1/a_int.c:408:1: Parameter `*bn->d`
  406.   	}
  407.   
  408. > BIGNUM *ASN1_INTEGER_to_BN(ASN1_INTEGER *ai, BIGNUM *bn)
  409.   	{
  410.   	BIGNUM *ret;

crypto/asn1/a_int.c:412:11: Call
  410.   	BIGNUM *ret;
  411.   
  412.   	if ((ret=BN_bin2bn(ai->data,ai->length,bn)) == NULL)
                   ^
  413.   		ASN1err(ASN1_F_ASN1_INTEGER_TO_BN,ASN1_R_BN_LIB);
  414.   	if(ai->type == V_ASN1_NEG_INTEGER) bn->neg = 1;

crypto/bn/bn_lib.c:595:1: Parameter `*ret->d`
    593.   
    594.   /* ignore negative */
    595. > BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)
    596.   	{
    597.   	unsigned int i,m;

crypto/x509v3/v3_utl.c:143:17: Call
141.   	if(!a) return NULL;
142.   	if(!(bntmp = ASN1_INTEGER_to_BN(a, NULL)) ||
143.   	    !(strtmp = BN_bn2dec(bntmp)) )
                       ^
144.   		X509V3err(X509V3_F_I2S_ASN1_INTEGER,ERR_R_MALLOC_FAILURE);
145.   	BN_free(bntmp);

crypto/bn/bn_print.c:103:1: Parameter `*a->d`
  101.   
  102.   /* Must 'Free' the returned data */
  103. > char *BN_bn2dec(const BIGNUM *a)
  104.   	{
  105.   	int i=0,num;

crypto/bn/bn_print.c:120:9: Call
  118.   		goto err;
  119.   		}
  120.   	if ((t=BN_dup(a)) == NULL) goto err;
                 ^
  121.   
  122.   	p=buf;

crypto/bn/bn_lib.c:488:1: Parameter `*a->d`
    486.   	}
    487.   
    488. > BIGNUM *BN_dup(const BIGNUM *a)
    489.   	{
    490.   	BIGNUM *r;

crypto/bn/bn_lib.c:496:19: Call
    494.   	r=BN_new();
    495.   	if (r == NULL) return(NULL);
    496.   	return((BIGNUM *)BN_copy(r,a));
                             ^
    497.   	}
    498.   

crypto/bn/bn_lib.c:499:1: <Length trace>
497.   	}
498.   
499. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
500.   	{
501.   	int i;

crypto/bn/bn_lib.c:499:1: Parameter `*b->d`
      497.   	}
      498.   
      499. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      500.   	{
      501.   	int i;

crypto/bn/bn_lib.c:512:2: Assignment
      510.   #if 1
      511.   	A=a->d;
      512.   	B=b->d;
              ^
      513.   	for (i=b->top>>2; i>0; i--,A+=4,B+=4)
      514.   		{

crypto/bn/bn_lib.c:516:33: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `BN_bn2dec` 
      514.   		{
      515.   		BN_ULONG a0,a1,a2,a3;
      516.   		a0=B[0]; a1=B[1]; a2=B[2]; a3=B[3];
                                             ^
      517.   		A[0]=a0; A[1]=a1; A[2]=a2; A[3]=a3;
      518.   		}

BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
	{
	int i;
	BN_ULONG *A;
	const BN_ULONG *B;
	bn_check_top(b);
	if (a == b) return(a);
	if (bn_wexpand(a,b->top) == NULL) return(NULL);
#if 1
	A=a->d;
	B=b->d;
	for (i=b->top>>2; i>0; i--,A+=4,B+=4)
		{
		BN_ULONG a0,a1,a2,a3;
		a0=B[0]; a1=B[1]; a2=B[2]; a3=B[3];
		A[0]=a0; A[1]=a1; A[2]=a2; A[3]=a3;
		}
	switch (b->top&3)
		{
		case 3: A[2]=B[2];
		case 2: A[1]=B[1];
		case 1: A[0]=B[0];
		case 0: ;
		}
#else
	memcpy(a->d,b->d,sizeof(b->d[0])*b->top);
#endif
	a->top=b->top;
	if ((a->top == 0) && (a->d != NULL))
		a->d[0]=0;
	a->neg=b->neg;
	return(a);
	}
['char *i2s_ASN1_INTEGER(X509V3_EXT_METHOD *method, ASN1_INTEGER *a)\n{\n\tBIGNUM *bntmp = NULL;\n\tchar *strtmp = NULL;\n\tif(!a) return NULL;\n\tif(!(bntmp = ASN1_INTEGER_to_BN(a, NULL)) ||\n\t    !(strtmp = BN_bn2dec(bntmp)) )\n\t\tX509V3err(X509V3_F_I2S_ASN1_INTEGER,ERR_R_MALLOC_FAILURE);\n\tBN_free(bntmp);\n\treturn strtmp;\n}', 'BIGNUM *ASN1_INTEGER_to_BN(ASN1_INTEGER *ai, BIGNUM *bn)\n\t{\n\tBIGNUM *ret;\n\tif ((ret=BN_bin2bn(ai->data,ai->length,bn)) == NULL)\n\t\tASN1err(ASN1_F_ASN1_INTEGER_TO_BN,ASN1_R_BN_LIB);\n\tif(ai->type == V_ASN1_NEG_INTEGER) bn->neg = 1;\n\treturn(ret);\n\t}', 'BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)\n\t{\n\tunsigned int i,m;\n\tunsigned int n;\n\tBN_ULONG l;\n\tif (ret == NULL) ret=BN_new();\n\tif (ret == NULL) return(NULL);\n\tl=0;\n\tn=len;\n\tif (n == 0)\n\t\t{\n\t\tret->top=0;\n\t\treturn(ret);\n\t\t}\n\tif (bn_expand(ret,(int)(n+2)*8) == NULL)\n\t\treturn(NULL);\n\ti=((n-1)/BN_BYTES)+1;\n\tm=((n-1)%(BN_BYTES));\n\tret->top=i;\n\twhile (n-- > 0)\n\t\t{\n\t\tl=(l<<8L)| *(s++);\n\t\tif (m-- == 0)\n\t\t\t{\n\t\t\tret->d[--i]=l;\n\t\t\tl=0;\n\t\t\tm=BN_BYTES-1;\n\t\t\t}\n\t\t}\n\tbn_fix_top(ret);\n\treturn(ret);\n\t}', "char *BN_bn2dec(const BIGNUM *a)\n\t{\n\tint i=0,num;\n\tchar *buf=NULL;\n\tchar *p;\n\tBIGNUM *t=NULL;\n\tBN_ULONG *bn_data=NULL,*lp;\n\ti=BN_num_bits(a)*3;\n\tnum=(i/10+i/1000+3)+1;\n\tbn_data=(BN_ULONG *)Malloc((num/BN_DEC_NUM+1)*sizeof(BN_ULONG));\n\tbuf=(char *)Malloc(num+3);\n\tif ((buf == NULL) || (bn_data == NULL))\n\t\t{\n\t\tBNerr(BN_F_BN_BN2DEC,ERR_R_MALLOC_FAILURE);\n\t\tgoto err;\n\t\t}\n\tif ((t=BN_dup(a)) == NULL) goto err;\n\tp=buf;\n\tlp=bn_data;\n\tif (t->neg) *(p++)='-';\n\tif (t->top == 0)\n\t\t{\n\t\t*(p++)='0';\n\t\t*(p++)='\\0';\n\t\t}\n\telse\n\t\t{\n\t\ti=0;\n\t\twhile (!BN_is_zero(t))\n\t\t\t{\n\t\t\t*lp=BN_div_word(t,BN_DEC_CONV);\n\t\t\tlp++;\n\t\t\t}\n\t\tlp--;\n\t\tsprintf(p,BN_DEC_FMT1,*lp);\n\t\twhile (*p) p++;\n\t\twhile (lp != bn_data)\n\t\t\t{\n\t\t\tlp--;\n\t\t\tsprintf(p,BN_DEC_FMT2,*lp);\n\t\t\twhile (*p) p++;\n\t\t\t}\n\t\t}\nerr:\n\tif (bn_data != NULL) Free(bn_data);\n\tif (t != NULL) BN_free(t);\n\treturn(buf);\n\t}", 'BIGNUM *BN_dup(const BIGNUM *a)\n\t{\n\tBIGNUM *r;\n\tbn_check_top(a);\n\tr=BN_new();\n\tif (r == NULL) return(NULL);\n\treturn((BIGNUM *)BN_copy(r,a));\n\t}', 'BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)\n\t{\n\tint i;\n\tBN_ULONG *A;\n\tconst BN_ULONG *B;\n\tbn_check_top(b);\n\tif (a == b) return(a);\n\tif (bn_wexpand(a,b->top) == NULL) return(NULL);\n#if 1\n\tA=a->d;\n\tB=b->d;\n\tfor (i=b->top>>2; i>0; i--,A+=4,B+=4)\n\t\t{\n\t\tBN_ULONG a0,a1,a2,a3;\n\t\ta0=B[0]; a1=B[1]; a2=B[2]; a3=B[3];\n\t\tA[0]=a0; A[1]=a1; A[2]=a2; A[3]=a3;\n\t\t}\n\tswitch (b->top&3)\n\t\t{\n\t\tcase 3: A[2]=B[2];\n\t\tcase 2: A[1]=B[1];\n\t\tcase 1: A[0]=B[0];\n\t\tcase 0: ;\n\t\t}\n#else\n\tmemcpy(a->d,b->d,sizeof(b->d[0])*b->top);\n#endif\n\ta->top=b->top;\n\tif ((a->top == 0) && (a->d != NULL))\n\t\ta->d[0]=0;\n\ta->neg=b->neg;\n\treturn(a);\n\t}']