crypto/asn1/n_pkey.c:149: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, +oo] by call to `i2d_RSAPrivateKey`.
Showing all 15 steps of the trace


crypto/asn1/n_pkey.c:110:7: Call
108.   	pkey->algor->parameter->type=V_ASN1_NULL;
109.   
110.   	l[0]=i2d_RSAPrivateKey(a,NULL);
             ^
111.   	pkey->private_key->length=l[0];
112.   

crypto/asn1/i2d_r_pr.c:75:17: Assignment
  73.   	unsigned char *p;
  74.   
  75.   	if (a == NULL) return(0);
                        ^
  76.   
  77.   	num[1]=a->n;

crypto/asn1/n_pkey.c:110:2: Assignment
108.   	pkey->algor->parameter->type=V_ASN1_NULL;
109.   
110.   	l[0]=i2d_RSAPrivateKey(a,NULL);
        ^
111.   	pkey->private_key->length=l[0];
112.   

crypto/asn1/n_pkey.c:143:48: Array declaration
141.   	if (pkey->private_key->data != NULL)
142.   		Free((char *)pkey->private_key->data);
143.   	if ((pkey->private_key->data=(unsigned char *)Malloc(l[0])) == NULL)
                                                      ^
144.   		{
145.   		ASN1err(ASN1_F_I2D_NETSCAPE_RSA,ERR_R_MALLOC_FAILURE);

crypto/asn1/n_pkey.c:143:7: Assignment
141.   	if (pkey->private_key->data != NULL)
142.   		Free((char *)pkey->private_key->data);
143.   	if ((pkey->private_key->data=(unsigned char *)Malloc(l[0])) == NULL)
             ^
144.   		{
145.   		ASN1err(ASN1_F_I2D_NETSCAPE_RSA,ERR_R_MALLOC_FAILURE);

crypto/asn1/n_pkey.c:148:2: Assignment
146.   		goto err;
147.   		}
148.   	zz=pkey->private_key->data;
        ^
149.   	i2d_RSAPrivateKey(a,&zz);
150.   

crypto/asn1/n_pkey.c:149:2: Call
147.   		}
148.   	zz=pkey->private_key->data;
149.   	i2d_RSAPrivateKey(a,&zz);
        ^
150.   
151.   	if ((os2.data=(unsigned char *)Malloc(os2.length)) == NULL)

crypto/asn1/i2d_r_pr.c:67:1: Parameter `**pp`
  65.   #include <openssl/asn1_mac.h>
  66.   
  67. > int i2d_RSAPrivateKey(RSA *a, unsigned char **pp)
  68.   	{
  69.   	BIGNUM *num[9];

crypto/asn1/i2d_r_pr.c:105:2: Assignment
  103.   	if (pp == NULL) return(t);
  104.   
  105.   	p= *pp;
          ^
  106.   	ASN1_put_object(&p,1,tot,V_ASN1_SEQUENCE,V_ASN1_UNIVERSAL);
  107.   

crypto/asn1/i2d_r_pr.c:106:2: Call
  104.   
  105.   	p= *pp;
  106.   	ASN1_put_object(&p,1,tot,V_ASN1_SEQUENCE,V_ASN1_UNIVERSAL);
          ^
  107.   
  108.   	i2d_ASN1_INTEGER(&bs,&p);

crypto/asn1/asn1_lib.c:180:1: <Length trace>
178.   /* class 0 is constructed
179.    * constructed == 2 for indefinitle length constructed */
180. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
181.   	     int xclass)
182.   	{

crypto/asn1/asn1_lib.c:180:1: Parameter `**pp`
    178.   /* class 0 is constructed
    179.    * constructed == 2 for indefinitle length constructed */
    180. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
    181.   	     int xclass)
    182.   	{

crypto/asn1/asn1_lib.c:183:2: Assignment
    181.   	     int xclass)
    182.   	{
    183.   	unsigned char *p= *pp;
            ^
    184.   	int i;
    185.   

crypto/asn1/asn1_lib.c:192:5: Assignment
    190.   	else
    191.   		{
    192.   		*(p++)=i|V_ASN1_PRIMATIVE_TAG;
               ^
    193.   		while (tag > 0x7f)
    194.   			{

crypto/asn1/asn1_lib.c:198:3: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `i2d_RSAPrivateKey` 
    196.   			tag>>=7;
    197.   			}
    198.   		*(p++)=(tag&0x7f);
             ^
    199.   		}
    200.   	if ((constructed == 2) && (length == 0))

void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
	     int xclass)
	{
	unsigned char *p= *pp;
	int i;
	i=(constructed)?V_ASN1_CONSTRUCTED:0;
	i|=(xclass&V_ASN1_PRIVATE);
	if (tag < 31)
		*(p++)=i|(tag&V_ASN1_PRIMATIVE_TAG);
	else
		{
		*(p++)=i|V_ASN1_PRIMATIVE_TAG;
		while (tag > 0x7f)
			{
			*(p++)=(tag&0x7f)|0x80;
			tag>>=7;
			}
		*(p++)=(tag&0x7f);
		}
	if ((constructed == 2) && (length == 0))
		*(p++)=0x80;
	else
		asn1_put_length(&p,length);
	*pp=p;
	}
['int i2d_Netscape_RSA(RSA *a, unsigned char **pp, int (*cb)())\n\t{\n\tint i,j,l[6];\n\tNETSCAPE_PKEY *pkey;\n\tunsigned char buf[256],*zz;\n\tunsigned char key[EVP_MAX_KEY_LENGTH];\n\tEVP_CIPHER_CTX ctx;\n\tX509_ALGOR *alg=NULL;\n\tASN1_OCTET_STRING os,os2;\n\tM_ASN1_I2D_vars(a);\n\tif (a == NULL) return(0);\n#ifdef WIN32\n\tr=r;\n#endif\n\tos.data=os2.data=NULL;\n\tif ((pkey=NETSCAPE_PKEY_new()) == NULL) goto err;\n\tif (!ASN1_INTEGER_set(pkey->version,0)) goto err;\n\tif (pkey->algor->algorithm != NULL)\n\t\tASN1_OBJECT_free(pkey->algor->algorithm);\n\tpkey->algor->algorithm=OBJ_nid2obj(NID_rsaEncryption);\n\tif ((pkey->algor->parameter=ASN1_TYPE_new()) == NULL) goto err;\n\tpkey->algor->parameter->type=V_ASN1_NULL;\n\tl[0]=i2d_RSAPrivateKey(a,NULL);\n\tpkey->private_key->length=l[0];\n\tos2.length=i2d_NETSCAPE_PKEY(pkey,NULL);\n\tl[1]=i2d_ASN1_OCTET_STRING(&os2,NULL);\n\tif ((alg=X509_ALGOR_new()) == NULL) goto err;\n\tif (alg->algorithm != NULL)\n\t\tASN1_OBJECT_free(alg->algorithm);\n\talg->algorithm=OBJ_nid2obj(NID_rc4);\n\tif ((alg->parameter=ASN1_TYPE_new()) == NULL) goto err;\n\talg->parameter->type=V_ASN1_NULL;\n\tl[2]=i2d_X509_ALGOR(alg,NULL);\n\tl[3]=ASN1_object_size(1,l[2]+l[1],V_ASN1_SEQUENCE);\n#ifndef CONST_STRICT\n\tos.data=(unsigned char *)"private-key";\n#endif\n\tos.length=11;\n\tl[4]=i2d_ASN1_OCTET_STRING(&os,NULL);\n\tl[5]=ASN1_object_size(1,l[4]+l[3],V_ASN1_SEQUENCE);\n\tif (pp == NULL)\n\t\t{\n\t\tif (pkey != NULL) NETSCAPE_PKEY_free(pkey);\n\t\tif (alg != NULL) X509_ALGOR_free(alg);\n\t\treturn(l[5]);\n\t\t}\n\tif (pkey->private_key->data != NULL)\n\t\tFree((char *)pkey->private_key->data);\n\tif ((pkey->private_key->data=(unsigned char *)Malloc(l[0])) == NULL)\n\t\t{\n\t\tASN1err(ASN1_F_I2D_NETSCAPE_RSA,ERR_R_MALLOC_FAILURE);\n\t\tgoto err;\n\t\t}\n\tzz=pkey->private_key->data;\n\ti2d_RSAPrivateKey(a,&zz);\n\tif ((os2.data=(unsigned char *)Malloc(os2.length)) == NULL)\n\t\t{\n\t\tASN1err(ASN1_F_I2D_NETSCAPE_RSA,ERR_R_MALLOC_FAILURE);\n\t\tgoto err;\n\t\t}\n\tzz=os2.data;\n\ti2d_NETSCAPE_PKEY(pkey,&zz);\n\tif (cb == NULL)\n\t\tcb=EVP_read_pw_string;\n\ti=cb(buf,256,"Enter Private Key password:",1);\n\tif (i != 0)\n\t\t{\n\t\tASN1err(ASN1_F_I2D_NETSCAPE_RSA,ASN1_R_BAD_PASSWORD_READ);\n\t\tgoto err;\n\t\t}\n\tEVP_BytesToKey(EVP_rc4(),EVP_md5(),NULL,buf,\n\t\tstrlen((char *)buf),1,key,NULL);\n\tmemset(buf,0,256);\n\tEVP_CIPHER_CTX_init(&ctx);\n\tEVP_EncryptInit(&ctx,EVP_rc4(),key,NULL);\n\tEVP_EncryptUpdate(&ctx,os2.data,&i,os2.data,os2.length);\n\tEVP_EncryptFinal(&ctx,&(os2.data[i]),&j);\n\tEVP_CIPHER_CTX_cleanup(&ctx);\n\tp= *pp;\n\tASN1_put_object(&p,1,l[4]+l[3],V_ASN1_SEQUENCE,V_ASN1_UNIVERSAL);\n\ti2d_ASN1_OCTET_STRING(&os,&p);\n\tASN1_put_object(&p,1,l[2]+l[1],V_ASN1_SEQUENCE,V_ASN1_UNIVERSAL);\n\ti2d_X509_ALGOR(alg,&p);\n\ti2d_ASN1_OCTET_STRING(&os2,&p);\n\tret=l[5];\nerr:\n\tif (os2.data != NULL) Free(os2.data);\n\tif (alg != NULL) X509_ALGOR_free(alg);\n\tif (pkey != NULL) NETSCAPE_PKEY_free(pkey);\n\tr=r;\n\treturn(ret);\n\t}', 'int i2d_RSAPrivateKey(RSA *a, unsigned char **pp)\n\t{\n\tBIGNUM *num[9];\n\tunsigned char data[1];\n\tASN1_INTEGER bs;\n\tunsigned int j,i,tot,t,len,max=0;\n\tunsigned char *p;\n\tif (a == NULL) return(0);\n\tnum[1]=a->n;\n\tnum[2]=a->e;\n\tnum[3]=a->d;\n\tnum[4]=a->p;\n\tnum[5]=a->q;\n\tnum[6]=a->dmp1;\n\tnum[7]=a->dmq1;\n\tnum[8]=a->iqmp;\n\tbs.length=1;\n\tbs.data=data;\n\tbs.type=V_ASN1_INTEGER;\n\tdata[0]=a->version&0x7f;\n\ttot=i2d_ASN1_INTEGER(&(bs),NULL);\n\tfor (i=1; i<9; i++)\n\t\t{\n\t\tj=BN_num_bits(num[i]);\n\t\tlen=((j == 0)?0:((j/8)+1));\n\t\tif (len > max) max=len;\n\t\tlen=ASN1_object_size(0,len,\n\t\t\t(num[i]->neg)?V_ASN1_NEG_INTEGER:V_ASN1_INTEGER);\n\t\ttot+=len;\n\t\t}\n\tt=ASN1_object_size(1,tot,V_ASN1_SEQUENCE);\n\tif (pp == NULL) return(t);\n\tp= *pp;\n\tASN1_put_object(&p,1,tot,V_ASN1_SEQUENCE,V_ASN1_UNIVERSAL);\n\ti2d_ASN1_INTEGER(&bs,&p);\n\tbs.data=(unsigned char *)Malloc(max+4);\n\tif (bs.data == NULL)\n\t\t{\n\t\tASN1err(ASN1_F_I2D_RSAPRIVATEKEY,ERR_R_MALLOC_FAILURE);\n\t\treturn(-1);\n\t\t}\n\tfor (i=1; i<9; i++)\n\t\t{\n\t\tbs.length=BN_bn2bin(num[i],bs.data);\n\t\ti2d_ASN1_INTEGER(&bs,&p);\n\t\t}\n\tFree((char *)bs.data);\n\t*pp=p;\n\treturn(t);\n\t}', 'void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,\n\t     int xclass)\n\t{\n\tunsigned char *p= *pp;\n\tint i;\n\ti=(constructed)?V_ASN1_CONSTRUCTED:0;\n\ti|=(xclass&V_ASN1_PRIVATE);\n\tif (tag < 31)\n\t\t*(p++)=i|(tag&V_ASN1_PRIMATIVE_TAG);\n\telse\n\t\t{\n\t\t*(p++)=i|V_ASN1_PRIMATIVE_TAG;\n\t\twhile (tag > 0x7f)\n\t\t\t{\n\t\t\t*(p++)=(tag&0x7f)|0x80;\n\t\t\ttag>>=7;\n\t\t\t}\n\t\t*(p++)=(tag&0x7f);\n\t\t}\n\tif ((constructed == 2) && (length == 0))\n\t\t*(p++)=0x80;\n\telse\n\t\tasn1_put_length(&p,length);\n\t*pp=p;\n\t}']