apps/ca.c:2015: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] Size: [1, +oo] by call to `NETSCAPE_SPKI_b64_decode`.
Showing all 22 steps of the trace


apps/ca.c:2034:11: Call
2032.   			}
2033.   
2034.   		if ((ne=X509_NAME_ENTRY_create_by_NID(&ne,nid,j,
                  ^
2035.   			(unsigned char *)buf,
2036.   			strlen(buf))) == NULL)

crypto/x509/x509name.c:239:1: Parameter `(*ne)->value->data->strlen`
  237.   	}
  238.   
  239. > X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_NID(X509_NAME_ENTRY **ne, int nid,
  240.   	     int type, unsigned char *bytes, int len)
  241.   	{

apps/ca.c:2015:12: Call
2013.   			if (strcmp(type, "SPKAC") == 0)
2014.   				{
2015.   				spki = NETSCAPE_SPKI_b64_decode(cv->value, -1);
                   ^
2016.   				if (spki == NULL)
2017.   					{

crypto/x509/x509spki.c:79:1: Parameter `len`
  77.   /* Load a Netscape SPKI from a base64 encoded string */
  78.   
  79. > NETSCAPE_SPKI * NETSCAPE_SPKI_b64_decode(char *str, int len)
  80.   {
  81.   	unsigned char *spki_der, *p;

crypto/x509/x509spki.c:85:19: Array declaration
  83.   	NETSCAPE_SPKI *spki;
  84.   	if(len <= 0) len = strlen(str);
  85.   	if (!(spki_der = Malloc(len + 1))) {
                          ^
  86.   		X509err(X509_F_NETSCAPE_SPKI_B64_DECODE, ERR_R_MALLOC_FAILURE);
  87.   		return NULL;

crypto/x509/x509spki.c:85:8: Assignment
  83.   	NETSCAPE_SPKI *spki;
  84.   	if(len <= 0) len = strlen(str);
  85.   	if (!(spki_der = Malloc(len + 1))) {
               ^
  86.   		X509err(X509_F_NETSCAPE_SPKI_B64_DECODE, ERR_R_MALLOC_FAILURE);
  87.   		return NULL;

crypto/x509/x509spki.c:96:2: Assignment
  94.   		return NULL;
  95.   	}
  96.   	p = spki_der;
         ^
  97.   	spki = d2i_NETSCAPE_SPKI(NULL, &p, spki_len);
  98.   	Free(spki_der);

crypto/x509/x509spki.c:97:9: Call
  95.   	}
  96.   	p = spki_der;
  97.   	spki = d2i_NETSCAPE_SPKI(NULL, &p, spki_len);
                 ^
  98.   	Free(spki_der);
  99.   	return spki;

crypto/asn1/x_spki.c:132:1: Parameter `**pp`
    130.   	}
    131.   
    132. > NETSCAPE_SPKI *d2i_NETSCAPE_SPKI(NETSCAPE_SPKI **a, unsigned char **pp,
    133.   	     long length)
    134.   	{

crypto/asn1/x_spki.c:137:2: Assignment
    135.   	M_ASN1_D2I_vars(a,NETSCAPE_SPKI *,NETSCAPE_SPKI_new);
    136.   
    137.   	M_ASN1_D2I_Init();
            ^
    138.   	M_ASN1_D2I_start_sequence();
    139.   	M_ASN1_D2I_get(ret->spkac,d2i_NETSCAPE_SPKAC);

crypto/asn1/x_spki.c:138:2: Call
    136.   
    137.   	M_ASN1_D2I_Init();
    138.   	M_ASN1_D2I_start_sequence();
            ^
    139.   	M_ASN1_D2I_get(ret->spkac,d2i_NETSCAPE_SPKAC);
    140.   	M_ASN1_D2I_get(ret->sig_algor,d2i_X509_ALGOR);

crypto/asn1/asn1_lib.c:277:1: Parameter `*c->p`
      275.   	}
      276.   
      277. > int asn1_GetSequence(ASN1_CTX *c, long *length)
      278.   	{
      279.   	unsigned char *q;

crypto/asn1/asn1_lib.c:282:9: Call
      280.   
      281.   	q=c->p;
      282.   	c->inf=ASN1_get_object(&(c->p),&(c->slen),&(c->tag),&(c->xclass),
                     ^
      283.   		*length);
      284.   	if (c->inf & 0x80)

crypto/asn1/asn1_lib.c:83:1: Parameter `**pp`
        81.   
        82.   
        83. > int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
        84.   	     long omax)
        85.   	{

crypto/asn1/asn1_lib.c:88:2: Assignment
        86.   	int i,ret;
        87.   	long l;
        88.   	unsigned char *p= *pp;
               ^
        89.   	int tag,xclass,inf;
        90.   	long max=omax;

crypto/asn1/asn1_lib.c:114:3: Assignment
        112.   		{ 
        113.   		tag=i;
        114.   		p++;
                 ^
        115.   		if (--max == 0) goto err;
        116.   		}

crypto/asn1/asn1_lib.c:119:7: Call
        117.   	*ptag=tag;
        118.   	*pclass=xclass;
        119.   	if (!asn1_get_length(&p,&inf,plength,(int)max)) goto err;
                     ^
        120.   
        121.   #if 0

crypto/asn1/asn1_lib.c:143:1: <Length trace>
141.   	}
142.   
143. > static int asn1_get_length(unsigned char **pp, int *inf, long *rl, int max)
144.   	{
145.   	unsigned char *p= *pp;

crypto/asn1/asn1_lib.c:143:1: Parameter `**pp`
          141.   	}
          142.   
          143. > static int asn1_get_length(unsigned char **pp, int *inf, long *rl, int max)
          144.   	{
          145.   	unsigned char *p= *pp;

crypto/asn1/asn1_lib.c:145:2: Assignment
          143.   static int asn1_get_length(unsigned char **pp, int *inf, long *rl, int max)
          144.   	{
          145.   	unsigned char *p= *pp;
                  ^
          146.   	long ret=0;
          147.   	int i;

crypto/asn1/asn1_lib.c:160:9: Assignment
          158.   		*inf=0;
          159.   		i= *p&0x7f;
          160.   		if (*(p++) & 0x80)
                         ^
          161.   			{
          162.   			if (max-- == 0) return(0);

crypto/asn1/asn1_lib.c:166:11: Array access: Offset: [2, +oo] Size: [1, +oo] by call to `NETSCAPE_SPKI_b64_decode` 
          164.   				{
          165.   				ret<<=8L;
          166.   				ret|= *(p++);
                           ^
          167.   				if (max-- == 0) return(0);
          168.   				}

static int asn1_get_length(unsigned char **pp, int *inf, long *rl, int max)
	{
	unsigned char *p= *pp;
	long ret=0;
	int i;
	if (max-- < 1) return(0);
	if (*p == 0x80)
		{
		*inf=1;
		ret=0;
		p++;
		}
	else
		{
		*inf=0;
		i= *p&0x7f;
		if (*(p++) & 0x80)
			{
			if (max-- == 0) return(0);
			while (i-- > 0)
				{
				ret<<=8L;
				ret|= *(p++);
				if (max-- == 0) return(0);
				}
			}
		else
			ret=i;
		}
	*pp=p;
	*rl=ret;
	return(1);
	}
['static int certify_spkac(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,\n\t     const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, TXT_DB *db,\n\t     BIGNUM *serial, char *startdate, char *enddate, int days,\n\t     char *ext_sect, LHASH *lconf, int verbose)\n\t{\n\tSTACK_OF(CONF_VALUE) *sk=NULL;\n\tLHASH *parms=NULL;\n\tX509_REQ *req=NULL;\n\tCONF_VALUE *cv=NULL;\n\tNETSCAPE_SPKI *spki = NULL;\n\tX509_REQ_INFO *ri;\n\tchar *type,*buf;\n\tEVP_PKEY *pktmp=NULL;\n\tX509_NAME *n=NULL;\n\tX509_NAME_ENTRY *ne=NULL;\n\tint ok= -1,i,j;\n\tlong errline;\n\tint nid;\n\tparms=CONF_load(NULL,infile,&errline);\n\tif (parms == NULL)\n\t\t{\n\t\tBIO_printf(bio_err,"error on line %ld of %s\\n",errline,infile);\n\t\tERR_print_errors(bio_err);\n\t\tgoto err;\n\t\t}\n\tsk=CONF_get_section(parms, "default");\n\tif (sk_CONF_VALUE_num(sk) == 0)\n\t\t{\n\t\tBIO_printf(bio_err, "no name/value pairs found in %s\\n", infile);\n\t\tCONF_free(parms);\n\t\tgoto err;\n\t\t}\n\treq=X509_REQ_new();\n\tif (req == NULL)\n\t\t{\n\t\tERR_print_errors(bio_err);\n\t\tgoto err;\n\t\t}\n\tri=req->req_info;\n\tn = ri->subject;\n\tfor (i = 0; ; i++)\n\t\t{\n\t\tif (sk_CONF_VALUE_num(sk) <= i) break;\n\t\tcv=sk_CONF_VALUE_value(sk,i);\n\t\ttype=cv->name;\n\t\tfor(buf = cv->name; *buf ; buf++)\n\t\t\tif ((*buf == \':\') || (*buf == \',\') || (*buf == \'.\')) {\n\t\t\t\t\tbuf++;\n\t\t\t\t\tif(*buf) type = buf;\n\t\t\t\t\tbreak;\n\t\t}\n\t\tbuf=cv->value;\n\t\tif ((nid=OBJ_txt2nid(type)) == NID_undef)\n\t\t\t{\n\t\t\tif (strcmp(type, "SPKAC") == 0)\n\t\t\t\t{\n\t\t\t\tspki = NETSCAPE_SPKI_b64_decode(cv->value, -1);\n\t\t\t\tif (spki == NULL)\n\t\t\t\t\t{\n\t\t\t\t\tBIO_printf(bio_err,"unable to load Netscape SPKAC structure\\n");\n\t\t\t\t\tERR_print_errors(bio_err);\n\t\t\t\t\tgoto err;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\tcontinue;\n\t\t\t}\n\t\tj=ASN1_PRINTABLE_type((unsigned char *)buf,-1);\n\t\tif (fix_data(nid, &j) == 0)\n\t\t\t{\n\t\t\tBIO_printf(bio_err,\n\t\t\t\t"invalid characters in string %s\\n",buf);\n\t\t\tgoto err;\n\t\t\t}\n\t\tif ((ne=X509_NAME_ENTRY_create_by_NID(&ne,nid,j,\n\t\t\t(unsigned char *)buf,\n\t\t\tstrlen(buf))) == NULL)\n\t\t\tgoto err;\n\t\tif (!X509_NAME_add_entry(n,ne,X509_NAME_entry_count(n),0))\n\t\t\tgoto err;\n\t\t}\n\tif (spki == NULL)\n\t\t{\n\t\tBIO_printf(bio_err,"Netscape SPKAC structure not found in %s\\n",\n\t\t\tinfile);\n\t\tgoto err;\n\t\t}\n\tBIO_printf(bio_err,"Check that the SPKAC request matches the signature\\n");\n\tif ((pktmp=NETSCAPE_SPKI_get_pubkey(spki)) == NULL)\n\t\t{\n\t\tBIO_printf(bio_err,"error unpacking SPKAC public key\\n");\n\t\tgoto err;\n\t\t}\n\tj = NETSCAPE_SPKI_verify(spki, pktmp);\n\tif (j <= 0)\n\t\t{\n\t\tBIO_printf(bio_err,"signature verification failed on SPKAC public key\\n");\n\t\tgoto err;\n\t\t}\n\tBIO_printf(bio_err,"Signature ok\\n");\n\tX509_REQ_set_pubkey(req,pktmp);\n\tEVP_PKEY_free(pktmp);\n\tok=do_body(xret,pkey,x509,dgst,policy,db,serial,startdate,enddate,\n\t\t   days,1,verbose,req,ext_sect,lconf);\nerr:\n\tif (req != NULL) X509_REQ_free(req);\n\tif (parms != NULL) CONF_free(parms);\n\tif (spki != NULL) NETSCAPE_SPKI_free(spki);\n\tif (ne != NULL) X509_NAME_ENTRY_free(ne);\n\treturn(ok);\n\t}', 'X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_NID(X509_NAME_ENTRY **ne, int nid,\n\t     int type, unsigned char *bytes, int len)\n\t{\n\tASN1_OBJECT *obj;\n\tobj=OBJ_nid2obj(nid);\n\tif (obj == NULL)\n\t\t{\n\t\tX509err(X509_F_X509_NAME_ENTRY_CREATE_BY_NID,X509_R_UNKNOWN_NID);\n\t\treturn(NULL);\n\t\t}\n\treturn(X509_NAME_ENTRY_create_by_OBJ(ne,obj,type,bytes,len));\n\t}', 'NETSCAPE_SPKI * NETSCAPE_SPKI_b64_decode(char *str, int len)\n{\n\tunsigned char *spki_der, *p;\n\tint spki_len;\n\tNETSCAPE_SPKI *spki;\n\tif(len <= 0) len = strlen(str);\n\tif (!(spki_der = Malloc(len + 1))) {\n\t\tX509err(X509_F_NETSCAPE_SPKI_B64_DECODE, ERR_R_MALLOC_FAILURE);\n\t\treturn NULL;\n\t}\n\tspki_len = EVP_DecodeBlock(spki_der, str, len);\n\tif(spki_len < 0) {\n\t\tX509err(X509_F_NETSCAPE_SPKI_B64_DECODE,\n\t\t\t\t\t\tX509_R_BASE64_DECODE_ERROR);\n\t\tFree(spki_der);\n\t\treturn NULL;\n\t}\n\tp = spki_der;\n\tspki = d2i_NETSCAPE_SPKI(NULL, &p, spki_len);\n\tFree(spki_der);\n\treturn spki;\n}', 'NETSCAPE_SPKI *d2i_NETSCAPE_SPKI(NETSCAPE_SPKI **a, unsigned char **pp,\n\t     long length)\n\t{\n\tM_ASN1_D2I_vars(a,NETSCAPE_SPKI *,NETSCAPE_SPKI_new);\n\tM_ASN1_D2I_Init();\n\tM_ASN1_D2I_start_sequence();\n\tM_ASN1_D2I_get(ret->spkac,d2i_NETSCAPE_SPKAC);\n\tM_ASN1_D2I_get(ret->sig_algor,d2i_X509_ALGOR);\n\tM_ASN1_D2I_get(ret->signature,d2i_ASN1_BIT_STRING);\n\tM_ASN1_D2I_Finish(a,NETSCAPE_SPKI_free,ASN1_F_D2I_NETSCAPE_SPKI);\n\t}', 'int asn1_GetSequence(ASN1_CTX *c, long *length)\n\t{\n\tunsigned char *q;\n\tq=c->p;\n\tc->inf=ASN1_get_object(&(c->p),&(c->slen),&(c->tag),&(c->xclass),\n\t\t*length);\n\tif (c->inf & 0x80)\n\t\t{\n\t\tc->error=ERR_R_BAD_GET_ASN1_OBJECT_CALL;\n\t\treturn(0);\n\t\t}\n\tif (c->tag != V_ASN1_SEQUENCE)\n\t\t{\n\t\tc->error=ERR_R_EXPECTING_AN_ASN1_SEQUENCE;\n\t\treturn(0);\n\t\t}\n\t(*length)-=(c->p-q);\n\tif (c->max && (*length < 0))\n\t\t{\n\t\tc->error=ERR_R_ASN1_LENGTH_MISMATCH;\n\t\treturn(0);\n\t\t}\n\tif (c->inf == (1|V_ASN1_CONSTRUCTED))\n\t\tc->slen= *length+ *(c->pp)-c->p;\n\tc->eos=0;\n\treturn(1);\n\t}', 'int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,\n\t     long omax)\n\t{\n\tint i,ret;\n\tlong l;\n\tunsigned char *p= *pp;\n\tint tag,xclass,inf;\n\tlong max=omax;\n\tif (!max) goto err;\n\tret=(*p&V_ASN1_CONSTRUCTED);\n\txclass=(*p&V_ASN1_PRIVATE);\n\ti= *p&V_ASN1_PRIMITIVE_TAG;\n\tif (i == V_ASN1_PRIMITIVE_TAG)\n\t\t{\n\t\tp++;\n\t\tif (--max == 0) goto err;\n\t\tl=0;\n\t\twhile (*p&0x80)\n\t\t\t{\n\t\t\tl<<=7L;\n\t\t\tl|= *(p++)&0x7f;\n\t\t\tif (--max == 0) goto err;\n\t\t\t}\n\t\tl<<=7L;\n\t\tl|= *(p++)&0x7f;\n\t\ttag=(int)l;\n\t\t}\n\telse\n\t\t{\n\t\ttag=i;\n\t\tp++;\n\t\tif (--max == 0) goto err;\n\t\t}\n\t*ptag=tag;\n\t*pclass=xclass;\n\tif (!asn1_get_length(&p,&inf,plength,(int)max)) goto err;\n#if 0\n\tfprintf(stderr,"p=%d + *plength=%ld > omax=%ld + *pp=%d  (%d > %d)\\n",\n\t\t(int)p,*plength,omax,(int)*pp,(int)(p+ *plength),\n\t\t(int)(omax+ *pp));\n#endif\n#if 0\n\tif ((p+ *plength) > (omax+ *pp))\n\t\t{\n\t\tASN1err(ASN1_F_ASN1_GET_OBJECT,ASN1_R_TOO_LONG);\n\t\tret|=0x80;\n\t\t}\n#endif\n\t*pp=p;\n\treturn(ret|inf);\nerr:\n\tASN1err(ASN1_F_ASN1_GET_OBJECT,ASN1_R_HEADER_TOO_LONG);\n\treturn(0x80);\n\t}', 'static int asn1_get_length(unsigned char **pp, int *inf, long *rl, int max)\n\t{\n\tunsigned char *p= *pp;\n\tlong ret=0;\n\tint i;\n\tif (max-- < 1) return(0);\n\tif (*p == 0x80)\n\t\t{\n\t\t*inf=1;\n\t\tret=0;\n\t\tp++;\n\t\t}\n\telse\n\t\t{\n\t\t*inf=0;\n\t\ti= *p&0x7f;\n\t\tif (*(p++) & 0x80)\n\t\t\t{\n\t\t\tif (max-- == 0) return(0);\n\t\t\twhile (i-- > 0)\n\t\t\t\t{\n\t\t\t\tret<<=8L;\n\t\t\t\tret|= *(p++);\n\t\t\t\tif (max-- == 0) return(0);\n\t\t\t\t}\n\t\t\t}\n\t\telse\n\t\t\tret=i;\n\t\t}\n\t*pp=p;\n\t*rl=ret;\n\treturn(1);\n\t}']