crypto/evp/evp_pkey.c:242: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] (⇐ [2, +oo] + [0, +oo]) Size: [0, +oo] by call to `i2d_DSAparams`.
Showing all 22 steps of the trace


crypto/evp/evp_pkey.c:235:9: Call
233.   
234.   		/* get paramaters and place in AlgorithmIdentifier */
235.   		len = i2d_DSAparams (pkey->pkey.dsa, NULL);
               ^
236.   		if (!(p = Malloc(len))) {
237.   			EVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);

crypto/asn1/i2d_dsap.c:74:17: Assignment
  72.   	unsigned char *p;
  73.   
  74.   	if (a == NULL) return(0);
                        ^
  75.   	num[0]=a->p;
  76.   	num[1]=a->q;

crypto/evp/evp_pkey.c:235:3: Assignment
233.   
234.   		/* get paramaters and place in AlgorithmIdentifier */
235.   		len = i2d_DSAparams (pkey->pkey.dsa, NULL);
         ^
236.   		if (!(p = Malloc(len))) {
237.   			EVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);

crypto/evp/evp_pkey.c:236:13: Array declaration
234.   		/* get paramaters and place in AlgorithmIdentifier */
235.   		len = i2d_DSAparams (pkey->pkey.dsa, NULL);
236.   		if (!(p = Malloc(len))) {
                   ^
237.   			EVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
238.   			PKCS8_PRIV_KEY_INFO_free (p8);

crypto/evp/evp_pkey.c:236:9: Assignment
234.   		/* get paramaters and place in AlgorithmIdentifier */
235.   		len = i2d_DSAparams (pkey->pkey.dsa, NULL);
236.   		if (!(p = Malloc(len))) {
               ^
237.   			EVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
238.   			PKCS8_PRIV_KEY_INFO_free (p8);

crypto/evp/evp_pkey.c:241:3: Assignment
239.   			return NULL;
240.   		}
241.   		q = p;
         ^
242.   		i2d_DSAparams (pkey->pkey.dsa, &q);
243.   		p8->pkeyalg->parameter->type = V_ASN1_SEQUENCE;

crypto/evp/evp_pkey.c:242:3: Call
240.   		}
241.   		q = p;
242.   		i2d_DSAparams (pkey->pkey.dsa, &q);
         ^
243.   		p8->pkeyalg->parameter->type = V_ASN1_SEQUENCE;
244.   		p8->pkeyalg->parameter->value.sequence = ASN1_STRING_new();

crypto/asn1/i2d_dsap.c:66:1: Parameter `**pp`
  64.   #include <openssl/dsa.h>
  65.   
  66. > int i2d_DSAparams(DSA *a, unsigned char **pp)
  67.   	{
  68.   	BIGNUM *num[3];

crypto/asn1/i2d_dsap.c:93:2: Assignment
  91.   	if (pp == NULL) return(t);
  92.   
  93.   	p= *pp;
         ^
  94.   	ASN1_put_object(&p,1,tot,V_ASN1_SEQUENCE,V_ASN1_UNIVERSAL);
  95.   

crypto/asn1/i2d_dsap.c:94:2: Call
  92.   
  93.   	p= *pp;
  94.   	ASN1_put_object(&p,1,tot,V_ASN1_SEQUENCE,V_ASN1_UNIVERSAL);
         ^
  95.   
  96.   	bs.type=V_ASN1_INTEGER;

crypto/asn1/asn1_lib.c:180:1: Parameter `**pp`
    178.   /* class 0 is constructed
    179.    * constructed == 2 for indefinitle length constructed */
    180. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
    181.   	     int xclass)
    182.   	{

crypto/asn1/asn1_lib.c:183:2: Assignment
    181.   	     int xclass)
    182.   	{
    183.   	unsigned char *p= *pp;
            ^
    184.   	int i;
    185.   

crypto/asn1/asn1_lib.c:189:5: Assignment
    187.   	i|=(xclass&V_ASN1_PRIVATE);
    188.   	if (tag < 31)
    189.   		*(p++)=i|(tag&V_ASN1_PRIMATIVE_TAG);
               ^
    190.   	else
    191.   		{

crypto/asn1/asn1_lib.c:203:3: Call
    201.   		*(p++)=0x80; /* der_put_length would output 0 instead */
    202.   	else
    203.   		asn1_put_length(&p,length);
             ^
    204.   	*pp=p;
    205.   	}

crypto/asn1/asn1_lib.c:216:8: <Offset trace>
214.   		{
215.   		l=length;
216.   		for (i=0; l > 0; i++)
              ^
217.   			l>>=8;
218.   		*(p++)=i|0x80;

crypto/asn1/asn1_lib.c:216:8: Assignment
      214.   		{
      215.   		l=length;
      216.   		for (i=0; l > 0; i++)
                    ^
      217.   			l>>=8;
      218.   		*(p++)=i|0x80;

crypto/asn1/asn1_lib.c:220:10: Assignment
      218.   		*(p++)=i|0x80;
      219.   		l=i;
      220.   		while (i-- > 0)
                      ^
      221.   			{
      222.   			p[i]=length&0xff;

crypto/asn1/asn1_lib.c:207:1: <Length trace>
205.   	}
206.   
207. > static void asn1_put_length(unsigned char **pp, int length)
208.   	{
209.   	unsigned char *p= *pp;

crypto/asn1/asn1_lib.c:207:1: Parameter `**pp`
      205.   	}
      206.   
      207. > static void asn1_put_length(unsigned char **pp, int length)
      208.   	{
      209.   	unsigned char *p= *pp;

crypto/asn1/asn1_lib.c:209:2: Assignment
      207.   static void asn1_put_length(unsigned char **pp, int length)
      208.   	{
      209.   	unsigned char *p= *pp;
              ^
      210.   	int i,l;
      211.   	if (length <= 127)

crypto/asn1/asn1_lib.c:218:5: Assignment
      216.   		for (i=0; l > 0; i++)
      217.   			l>>=8;
      218.   		*(p++)=i|0x80;
                 ^
      219.   		l=i;
      220.   		while (i-- > 0)

crypto/asn1/asn1_lib.c:222:4: Array access: Offset: [2, +oo] (⇐ [2, +oo] + [0, +oo]) Size: [0, +oo] by call to `i2d_DSAparams` 
      220.   		while (i-- > 0)
      221.   			{
      222.   			p[i]=length&0xff;
                ^
      223.   			length>>=8;
      224.   			}

static void asn1_put_length(unsigned char **pp, int length)
	{
	unsigned char *p= *pp;
	int i,l;
	if (length <= 127)
		*(p++)=(unsigned char)length;
	else
		{
		l=length;
		for (i=0; l > 0; i++)
			l>>=8;
		*(p++)=i|0x80;
		l=i;
		while (i-- > 0)
			{
			p[i]=length&0xff;
			length>>=8;
			}
		p+=l;
		}
	*pp=p;
	}
['PKCS8_PRIV_KEY_INFO *EVP_PKEY2PKCS8(EVP_PKEY *pkey)\n{\n\tPKCS8_PRIV_KEY_INFO *p8;\n#ifndef NO_DSA\n\tASN1_INTEGER *dpkey;\n\tunsigned char *p, *q;\n\tint len;\n#endif\n\tif (!(p8 = PKCS8_PRIV_KEY_INFO_new())) {\n\t\tEVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);\n\t\treturn NULL;\n\t}\n\tASN1_INTEGER_set (p8->version, 0);\n\tif (!(p8->pkeyalg->parameter = ASN1_TYPE_new ())) {\n\t\tEVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);\n\t\tPKCS8_PRIV_KEY_INFO_free (p8);\n\t\treturn NULL;\n\t}\n\tswitch (EVP_PKEY_type(pkey->type)) {\n#ifndef NO_RSA\n\t\tcase EVP_PKEY_RSA:\n\t\tp8->pkeyalg->algorithm = OBJ_nid2obj(NID_rsaEncryption);\n\t\tp8->pkeyalg->parameter->type = V_ASN1_NULL;\n\t\tif (!ASN1_pack_string ((char *)pkey, i2d_PrivateKey,\n\t\t\t\t\t &p8->pkey->value.octet_string)) {\n\t\t\tEVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);\n\t\t\tPKCS8_PRIV_KEY_INFO_free (p8);\n\t\t\treturn NULL;\n\t\t}\n\t\tbreak;\n#endif\n#ifndef NO_DSA\n\t\tcase EVP_PKEY_DSA:\n\t\tp8->pkeyalg->algorithm = OBJ_nid2obj(NID_dsa);\n\t\tlen = i2d_DSAparams (pkey->pkey.dsa, NULL);\n\t\tif (!(p = Malloc(len))) {\n\t\t\tEVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);\n\t\t\tPKCS8_PRIV_KEY_INFO_free (p8);\n\t\t\treturn NULL;\n\t\t}\n\t\tq = p;\n\t\ti2d_DSAparams (pkey->pkey.dsa, &q);\n\t\tp8->pkeyalg->parameter->type = V_ASN1_SEQUENCE;\n\t\tp8->pkeyalg->parameter->value.sequence = ASN1_STRING_new();\n\t\tASN1_STRING_set(p8->pkeyalg->parameter->value.sequence, p, len);\n\t\tFree(p);\n\t\tif (!(dpkey = BN_to_ASN1_INTEGER (pkey->pkey.dsa->priv_key, NULL))) {\n\t\t\tEVPerr(EVP_F_EVP_PKEY2PKCS8,EVP_R_ENCODE_ERROR);\n\t\t\tPKCS8_PRIV_KEY_INFO_free (p8);\n\t\t\treturn NULL;\n\t\t}\n\t\tif (!ASN1_pack_string((char *)dpkey, i2d_ASN1_INTEGER,\n\t\t\t\t\t &p8->pkey->value.octet_string)) {\n\t\t\tEVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);\n\t\t\tASN1_INTEGER_free (dpkey);\n\t\t\tPKCS8_PRIV_KEY_INFO_free (p8);\n\t\t\treturn NULL;\n\t\t}\n\t\tASN1_INTEGER_free (dpkey);\n\t\tbreak;\n#endif\n\t\tdefault:\n\t\tEVPerr(EVP_F_EVP_PKEY2PKCS8, EVP_R_UNSUPPORTED_PRIVATE_KEY_ALGORITHM);\n\t\tPKCS8_PRIV_KEY_INFO_free (p8);\n\t\treturn NULL;\n\t}\n\tp8->pkey->type = V_ASN1_OCTET_STRING;\n\tRAND_seed (p8->pkey->value.octet_string->data,\n\t\t\t\t\t p8->pkey->value.octet_string->length);\n\treturn p8;\n}', 'int i2d_DSAparams(DSA *a, unsigned char **pp)\n\t{\n\tBIGNUM *num[3];\n\tASN1_INTEGER bs;\n\tunsigned int j,i,tot=0,len,max=0;\n\tint t,ret= -1;\n\tunsigned char *p;\n\tif (a == NULL) return(0);\n\tnum[0]=a->p;\n\tnum[1]=a->q;\n\tnum[2]=a->g;\n\tfor (i=0; i<3; i++)\n\t\t{\n\t\tif (num[i] == NULL) continue;\n\t\tj=BN_num_bits(num[i]);\n\t\tlen=((j == 0)?0:((j/8)+1));\n\t\tif (len > max) max=len;\n\t\tlen=ASN1_object_size(0,len,\n\t\t\t(num[i]->neg)?V_ASN1_NEG_INTEGER:V_ASN1_INTEGER);\n\t\ttot+=len;\n\t\t}\n\tt=ASN1_object_size(1,tot,V_ASN1_SEQUENCE);\n\tif (pp == NULL) return(t);\n\tp= *pp;\n\tASN1_put_object(&p,1,tot,V_ASN1_SEQUENCE,V_ASN1_UNIVERSAL);\n\tbs.type=V_ASN1_INTEGER;\n\tbs.data=(unsigned char *)Malloc(max+4);\n\tif (bs.data == NULL)\n\t\t{\n\t\tASN1err(ASN1_F_I2D_DSAPARAMS,ERR_R_MALLOC_FAILURE);\n\t\tgoto err;\n\t\t}\n\tfor (i=0; i<3; i++)\n\t\t{\n\t\tif (num[i] == NULL) continue;\n\t\tbs.length=BN_bn2bin(num[i],bs.data);\n\t\ti2d_ASN1_INTEGER(&bs,&p);\n\t\t}\n\tFree((char *)bs.data);\n\tret=t;\nerr:\n\t*pp=p;\n\treturn(ret);\n\t}', 'void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,\n\t     int xclass)\n\t{\n\tunsigned char *p= *pp;\n\tint i;\n\ti=(constructed)?V_ASN1_CONSTRUCTED:0;\n\ti|=(xclass&V_ASN1_PRIVATE);\n\tif (tag < 31)\n\t\t*(p++)=i|(tag&V_ASN1_PRIMATIVE_TAG);\n\telse\n\t\t{\n\t\t*(p++)=i|V_ASN1_PRIMATIVE_TAG;\n\t\twhile (tag > 0x7f)\n\t\t\t{\n\t\t\t*(p++)=(tag&0x7f)|0x80;\n\t\t\ttag>>=7;\n\t\t\t}\n\t\t*(p++)=(tag&0x7f);\n\t\t}\n\tif ((constructed == 2) && (length == 0))\n\t\t*(p++)=0x80;\n\telse\n\t\tasn1_put_length(&p,length);\n\t*pp=p;\n\t}', 'static void asn1_put_length(unsigned char **pp, int length)\n\t{\n\tunsigned char *p= *pp;\n\tint i,l;\n\tif (length <= 127)\n\t\t*(p++)=(unsigned char)length;\n\telse\n\t\t{\n\t\tl=length;\n\t\tfor (i=0; l > 0; i++)\n\t\t\tl>>=8;\n\t\t*(p++)=i|0x80;\n\t\tl=i;\n\t\twhile (i-- > 0)\n\t\t\t{\n\t\t\tp[i]=length&0xff;\n\t\t\tlength>>=8;\n\t\t\t}\n\t\tp+=l;\n\t\t}\n\t*pp=p;\n\t}']