apps/rsa.c:278: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] (⇐ [2, +oo] + [0, +oo]) Size: [0, +oo] by call to `i2d_Netscape_RSA`.
Showing all 21 steps of the trace


apps/rsa.c:271:8: Call
269.   
270.   		i=1;
271.   		size=i2d_Netscape_RSA(rsa,NULL,NULL);
              ^
272.   		if ((p=(unsigned char *)Malloc(size)) == NULL)
273.   			{

crypto/asn1/n_pkey.c:92:2: Assignment
  90.   	X509_ALGOR *alg=NULL;
  91.   	ASN1_OCTET_STRING os,os2;
  92.   	M_ASN1_I2D_vars(a);
         ^
  93.   
  94.   	if (a == NULL) return(0);

apps/rsa.c:271:3: Assignment
269.   
270.   		i=1;
271.   		size=i2d_Netscape_RSA(rsa,NULL,NULL);
         ^
272.   		if ((p=(unsigned char *)Malloc(size)) == NULL)
273.   			{

apps/rsa.c:272:27: Array declaration
270.   		i=1;
271.   		size=i2d_Netscape_RSA(rsa,NULL,NULL);
272.   		if ((p=(unsigned char *)Malloc(size)) == NULL)
                                 ^
273.   			{
274.   			BIO_printf(bio_err,"Malloc failure\n");

apps/rsa.c:272:8: Assignment
270.   		i=1;
271.   		size=i2d_Netscape_RSA(rsa,NULL,NULL);
272.   		if ((p=(unsigned char *)Malloc(size)) == NULL)
              ^
273.   			{
274.   			BIO_printf(bio_err,"Malloc failure\n");

apps/rsa.c:278:3: Call
276.   			}
277.   		pp=p;
278.   		i2d_Netscape_RSA(rsa,&p,NULL);
         ^
279.   		BIO_write(out,(char *)pp,size);
280.   		Free(pp);

crypto/asn1/n_pkey.c:83:1: Parameter `**pp`
  81.   static void NETSCAPE_PKEY_free(NETSCAPE_PKEY *);
  82.   
  83. > int i2d_Netscape_RSA(RSA *a, unsigned char **pp, int (*cb)())
  84.   	{
  85.   	int i,j,l[6];

crypto/asn1/n_pkey.c:177:2: Assignment
  175.   	EVP_CIPHER_CTX_cleanup(&ctx);
  176.   
  177.   	p= *pp;
          ^
  178.   	ASN1_put_object(&p,1,l[4]+l[3],V_ASN1_SEQUENCE,V_ASN1_UNIVERSAL);
  179.   	i2d_ASN1_OCTET_STRING(&os,&p);

crypto/asn1/n_pkey.c:178:2: Call
  176.   
  177.   	p= *pp;
  178.   	ASN1_put_object(&p,1,l[4]+l[3],V_ASN1_SEQUENCE,V_ASN1_UNIVERSAL);
          ^
  179.   	i2d_ASN1_OCTET_STRING(&os,&p);
  180.   	ASN1_put_object(&p,1,l[2]+l[1],V_ASN1_SEQUENCE,V_ASN1_UNIVERSAL);

crypto/asn1/asn1_lib.c:180:1: Parameter `**pp`
    178.   /* class 0 is constructed
    179.    * constructed == 2 for indefinitle length constructed */
    180. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
    181.   	     int xclass)
    182.   	{

crypto/asn1/asn1_lib.c:183:2: Assignment
    181.   	     int xclass)
    182.   	{
    183.   	unsigned char *p= *pp;
            ^
    184.   	int i;
    185.   

crypto/asn1/asn1_lib.c:189:5: Assignment
    187.   	i|=(xclass&V_ASN1_PRIVATE);
    188.   	if (tag < 31)
    189.   		*(p++)=i|(tag&V_ASN1_PRIMATIVE_TAG);
               ^
    190.   	else
    191.   		{

crypto/asn1/asn1_lib.c:203:3: Call
    201.   		*(p++)=0x80; /* der_put_length would output 0 instead */
    202.   	else
    203.   		asn1_put_length(&p,length);
             ^
    204.   	*pp=p;
    205.   	}

crypto/asn1/asn1_lib.c:216:8: <Offset trace>
214.   		{
215.   		l=length;
216.   		for (i=0; l > 0; i++)
              ^
217.   			l>>=8;
218.   		*(p++)=i|0x80;

crypto/asn1/asn1_lib.c:216:8: Assignment
      214.   		{
      215.   		l=length;
      216.   		for (i=0; l > 0; i++)
                    ^
      217.   			l>>=8;
      218.   		*(p++)=i|0x80;

crypto/asn1/asn1_lib.c:220:10: Assignment
      218.   		*(p++)=i|0x80;
      219.   		l=i;
      220.   		while (i-- > 0)
                      ^
      221.   			{
      222.   			p[i]=length&0xff;

crypto/asn1/asn1_lib.c:207:1: <Length trace>
205.   	}
206.   
207. > static void asn1_put_length(unsigned char **pp, int length)
208.   	{
209.   	unsigned char *p= *pp;

crypto/asn1/asn1_lib.c:207:1: Parameter `**pp`
      205.   	}
      206.   
      207. > static void asn1_put_length(unsigned char **pp, int length)
      208.   	{
      209.   	unsigned char *p= *pp;

crypto/asn1/asn1_lib.c:209:2: Assignment
      207.   static void asn1_put_length(unsigned char **pp, int length)
      208.   	{
      209.   	unsigned char *p= *pp;
              ^
      210.   	int i,l;
      211.   	if (length <= 127)

crypto/asn1/asn1_lib.c:218:5: Assignment
      216.   		for (i=0; l > 0; i++)
      217.   			l>>=8;
      218.   		*(p++)=i|0x80;
                 ^
      219.   		l=i;
      220.   		while (i-- > 0)

crypto/asn1/asn1_lib.c:222:4: Array access: Offset: [2, +oo] (⇐ [2, +oo] + [0, +oo]) Size: [0, +oo] by call to `i2d_Netscape_RSA` 
      220.   		while (i-- > 0)
      221.   			{
      222.   			p[i]=length&0xff;
                ^
      223.   			length>>=8;
      224.   			}

static void asn1_put_length(unsigned char **pp, int length)
	{
	unsigned char *p= *pp;
	int i,l;
	if (length <= 127)
		*(p++)=(unsigned char)length;
	else
		{
		l=length;
		for (i=0; l > 0; i++)
			l>>=8;
		*(p++)=i|0x80;
		l=i;
		while (i-- > 0)
			{
			p[i]=length&0xff;
			length>>=8;
			}
		p+=l;
		}
	*pp=p;
	}
['int MAIN(int argc, char **argv)\n\t{\n\tint ret=1;\n\tRSA *rsa=NULL;\n\tint i,badops=0;\n\tconst EVP_CIPHER *enc=NULL;\n\tBIO *in=NULL,*out=NULL;\n\tint informat,outformat,text=0,noout=0;\n\tchar *infile,*outfile,*prog;\n\tint modulus=0;\n\tapps_startup();\n\tif (bio_err == NULL)\n\t\tif ((bio_err=BIO_new(BIO_s_file())) != NULL)\n\t\t\tBIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);\n\tinfile=NULL;\n\toutfile=NULL;\n\tinformat=FORMAT_PEM;\n\toutformat=FORMAT_PEM;\n\tprog=argv[0];\n\targc--;\n\targv++;\n\twhile (argc >= 1)\n\t\t{\n\t\tif \t(strcmp(*argv,"-inform") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tinformat=str2fmt(*(++argv));\n\t\t\t}\n\t\telse if (strcmp(*argv,"-outform") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\toutformat=str2fmt(*(++argv));\n\t\t\t}\n\t\telse if (strcmp(*argv,"-in") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tinfile= *(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-out") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\toutfile= *(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-noout") == 0)\n\t\t\tnoout=1;\n\t\telse if (strcmp(*argv,"-text") == 0)\n\t\t\ttext=1;\n\t\telse if (strcmp(*argv,"-modulus") == 0)\n\t\t\tmodulus=1;\n\t\telse if ((enc=EVP_get_cipherbyname(&(argv[0][1]))) == NULL)\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"unknown option %s\\n",*argv);\n\t\t\tbadops=1;\n\t\t\tbreak;\n\t\t\t}\n\t\targc--;\n\t\targv++;\n\t\t}\n\tif (badops)\n\t\t{\nbad:\n\t\tBIO_printf(bio_err,"%s [options] <infile >outfile\\n",prog);\n\t\tBIO_printf(bio_err,"where options are\\n");\n\t\tBIO_printf(bio_err," -inform arg   input format - one of DER NET PEM\\n");\n\t\tBIO_printf(bio_err," -outform arg  output format - one of DER NET PEM\\n");\n\t\tBIO_printf(bio_err," -in arg       input file\\n");\n\t\tBIO_printf(bio_err," -out arg      output file\\n");\n\t\tBIO_printf(bio_err," -des          encrypt PEM output with cbc des\\n");\n\t\tBIO_printf(bio_err," -des3         encrypt PEM output with ede cbc des using 168 bit key\\n");\n#ifndef NO_IDEA\n\t\tBIO_printf(bio_err," -idea         encrypt PEM output with cbc idea\\n");\n#endif\n\t\tBIO_printf(bio_err," -text         print the key in text\\n");\n\t\tBIO_printf(bio_err," -noout        don\'t print key out\\n");\n\t\tBIO_printf(bio_err," -modulus      print the RSA key modulus\\n");\n\t\tgoto end;\n\t\t}\n\tERR_load_crypto_strings();\n\tin=BIO_new(BIO_s_file());\n\tout=BIO_new(BIO_s_file());\n\tif ((in == NULL) || (out == NULL))\n\t\t{\n\t\tERR_print_errors(bio_err);\n\t\tgoto end;\n\t\t}\n\tif (infile == NULL)\n\t\tBIO_set_fp(in,stdin,BIO_NOCLOSE);\n\telse\n\t\t{\n\t\tif (BIO_read_filename(in,infile) <= 0)\n\t\t\t{\n\t\t\tperror(infile);\n\t\t\tgoto end;\n\t\t\t}\n\t\t}\n\tBIO_printf(bio_err,"read RSA private key\\n");\n\tif\t(informat == FORMAT_ASN1)\n\t\trsa=d2i_RSAPrivateKey_bio(in,NULL);\n#ifndef NO_RC4\n\telse if (informat == FORMAT_NETSCAPE)\n\t\t{\n\t\tBUF_MEM *buf=NULL;\n\t\tunsigned char *p;\n\t\tint size=0;\n\t\tbuf=BUF_MEM_new();\n\t\tfor (;;)\n\t\t\t{\n\t\t\tif ((buf == NULL) || (!BUF_MEM_grow(buf,size+1024*10)))\n\t\t\t\tgoto end;\n\t\t\ti=BIO_read(in,&(buf->data[size]),1024*10);\n\t\t\tsize+=i;\n\t\t\tif (i == 0) break;\n\t\t\tif (i < 0)\n\t\t\t\t{\n\t\t\t\tperror("reading private key");\n\t\t\t\tBUF_MEM_free(buf);\n\t\t\t\tgoto end;\n\t\t\t\t}\n\t\t\t}\n\t\tp=(unsigned char *)buf->data;\n\t\trsa=(RSA *)d2i_Netscape_RSA(NULL,&p,(long)size,NULL);\n\t\tBUF_MEM_free(buf);\n\t\t}\n#endif\n\telse if (informat == FORMAT_PEM)\n\t\trsa=PEM_read_bio_RSAPrivateKey(in,NULL,NULL);\n\telse\n\t\t{\n\t\tBIO_printf(bio_err,"bad input format specified for key\\n");\n\t\tgoto end;\n\t\t}\n\tif (rsa == NULL)\n\t\t{\n\t\tBIO_printf(bio_err,"unable to load Private Key\\n");\n\t\tERR_print_errors(bio_err);\n\t\tgoto end;\n\t\t}\n\tif (outfile == NULL)\n\t\tBIO_set_fp(out,stdout,BIO_NOCLOSE);\n\telse\n\t\t{\n\t\tif (BIO_write_filename(out,outfile) <= 0)\n\t\t\t{\n\t\t\tperror(outfile);\n\t\t\tgoto end;\n\t\t\t}\n\t\t}\n\tif (text)\n\t\tif (!RSA_print(out,rsa,0))\n\t\t\t{\n\t\t\tperror(outfile);\n\t\t\tERR_print_errors(bio_err);\n\t\t\tgoto end;\n\t\t\t}\n\tif (modulus)\n\t\t{\n\t\tfprintf(stdout,"Modulus=");\n\t\tBN_print(out,rsa->n);\n\t\tfprintf(stdout,"\\n");\n\t\t}\n\tif (noout) goto end;\n\tBIO_printf(bio_err,"writing RSA private key\\n");\n\tif \t(outformat == FORMAT_ASN1)\n\t\ti=i2d_RSAPrivateKey_bio(out,rsa);\n#ifndef NO_RC4\n\telse if (outformat == FORMAT_NETSCAPE)\n\t\t{\n\t\tunsigned char *p,*pp;\n\t\tint size;\n\t\ti=1;\n\t\tsize=i2d_Netscape_RSA(rsa,NULL,NULL);\n\t\tif ((p=(unsigned char *)Malloc(size)) == NULL)\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"Malloc failure\\n");\n\t\t\tgoto end;\n\t\t\t}\n\t\tpp=p;\n\t\ti2d_Netscape_RSA(rsa,&p,NULL);\n\t\tBIO_write(out,(char *)pp,size);\n\t\tFree(pp);\n\t\t}\n#endif\n\telse if (outformat == FORMAT_PEM)\n\t\ti=PEM_write_bio_RSAPrivateKey(out,rsa,enc,NULL,0,NULL);\n\telse\t{\n\t\tBIO_printf(bio_err,"bad output format specified for outfile\\n");\n\t\tgoto end;\n\t\t}\n\tif (!i)\n\t\t{\n\t\tBIO_printf(bio_err,"unable to write private key\\n");\n\t\tERR_print_errors(bio_err);\n\t\t}\n\telse\n\t\tret=0;\nend:\n\tif (in != NULL) BIO_free(in);\n\tif (out != NULL) BIO_free(out);\n\tif (rsa != NULL) RSA_free(rsa);\n\tEXIT(ret);\n\t}', 'int i2d_Netscape_RSA(RSA *a, unsigned char **pp, int (*cb)())\n\t{\n\tint i,j,l[6];\n\tNETSCAPE_PKEY *pkey;\n\tunsigned char buf[256],*zz;\n\tunsigned char key[EVP_MAX_KEY_LENGTH];\n\tEVP_CIPHER_CTX ctx;\n\tX509_ALGOR *alg=NULL;\n\tASN1_OCTET_STRING os,os2;\n\tM_ASN1_I2D_vars(a);\n\tif (a == NULL) return(0);\n#ifdef WIN32\n\tr=r;\n#endif\n\tos.data=os2.data=NULL;\n\tif ((pkey=NETSCAPE_PKEY_new()) == NULL) goto err;\n\tif (!ASN1_INTEGER_set(pkey->version,0)) goto err;\n\tif (pkey->algor->algorithm != NULL)\n\t\tASN1_OBJECT_free(pkey->algor->algorithm);\n\tpkey->algor->algorithm=OBJ_nid2obj(NID_rsaEncryption);\n\tif ((pkey->algor->parameter=ASN1_TYPE_new()) == NULL) goto err;\n\tpkey->algor->parameter->type=V_ASN1_NULL;\n\tl[0]=i2d_RSAPrivateKey(a,NULL);\n\tpkey->private_key->length=l[0];\n\tos2.length=i2d_NETSCAPE_PKEY(pkey,NULL);\n\tl[1]=i2d_ASN1_OCTET_STRING(&os2,NULL);\n\tif ((alg=X509_ALGOR_new()) == NULL) goto err;\n\tif (alg->algorithm != NULL)\n\t\tASN1_OBJECT_free(alg->algorithm);\n\talg->algorithm=OBJ_nid2obj(NID_rc4);\n\tif ((alg->parameter=ASN1_TYPE_new()) == NULL) goto err;\n\talg->parameter->type=V_ASN1_NULL;\n\tl[2]=i2d_X509_ALGOR(alg,NULL);\n\tl[3]=ASN1_object_size(1,l[2]+l[1],V_ASN1_SEQUENCE);\n#ifndef CONST_STRICT\n\tos.data=(unsigned char *)"private-key";\n#endif\n\tos.length=11;\n\tl[4]=i2d_ASN1_OCTET_STRING(&os,NULL);\n\tl[5]=ASN1_object_size(1,l[4]+l[3],V_ASN1_SEQUENCE);\n\tif (pp == NULL)\n\t\t{\n\t\tif (pkey != NULL) NETSCAPE_PKEY_free(pkey);\n\t\tif (alg != NULL) X509_ALGOR_free(alg);\n\t\treturn(l[5]);\n\t\t}\n\tif (pkey->private_key->data != NULL)\n\t\tFree((char *)pkey->private_key->data);\n\tif ((pkey->private_key->data=(unsigned char *)Malloc(l[0])) == NULL)\n\t\t{\n\t\tASN1err(ASN1_F_I2D_NETSCAPE_RSA,ERR_R_MALLOC_FAILURE);\n\t\tgoto err;\n\t\t}\n\tzz=pkey->private_key->data;\n\ti2d_RSAPrivateKey(a,&zz);\n\tif ((os2.data=(unsigned char *)Malloc(os2.length)) == NULL)\n\t\t{\n\t\tASN1err(ASN1_F_I2D_NETSCAPE_RSA,ERR_R_MALLOC_FAILURE);\n\t\tgoto err;\n\t\t}\n\tzz=os2.data;\n\ti2d_NETSCAPE_PKEY(pkey,&zz);\n\tif (cb == NULL)\n\t\tcb=EVP_read_pw_string;\n\ti=cb(buf,256,"Enter Private Key password:",1);\n\tif (i != 0)\n\t\t{\n\t\tASN1err(ASN1_F_I2D_NETSCAPE_RSA,ASN1_R_BAD_PASSWORD_READ);\n\t\tgoto err;\n\t\t}\n\tEVP_BytesToKey(EVP_rc4(),EVP_md5(),NULL,buf,\n\t\tstrlen((char *)buf),1,key,NULL);\n\tmemset(buf,0,256);\n\tEVP_CIPHER_CTX_init(&ctx);\n\tEVP_EncryptInit(&ctx,EVP_rc4(),key,NULL);\n\tEVP_EncryptUpdate(&ctx,os2.data,&i,os2.data,os2.length);\n\tEVP_EncryptFinal(&ctx,&(os2.data[i]),&j);\n\tEVP_CIPHER_CTX_cleanup(&ctx);\n\tp= *pp;\n\tASN1_put_object(&p,1,l[4]+l[3],V_ASN1_SEQUENCE,V_ASN1_UNIVERSAL);\n\ti2d_ASN1_OCTET_STRING(&os,&p);\n\tASN1_put_object(&p,1,l[2]+l[1],V_ASN1_SEQUENCE,V_ASN1_UNIVERSAL);\n\ti2d_X509_ALGOR(alg,&p);\n\ti2d_ASN1_OCTET_STRING(&os2,&p);\n\tret=l[5];\nerr:\n\tif (os2.data != NULL) Free(os2.data);\n\tif (alg != NULL) X509_ALGOR_free(alg);\n\tif (pkey != NULL) NETSCAPE_PKEY_free(pkey);\n\tr=r;\n\treturn(ret);\n\t}', 'void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,\n\t     int xclass)\n\t{\n\tunsigned char *p= *pp;\n\tint i;\n\ti=(constructed)?V_ASN1_CONSTRUCTED:0;\n\ti|=(xclass&V_ASN1_PRIVATE);\n\tif (tag < 31)\n\t\t*(p++)=i|(tag&V_ASN1_PRIMATIVE_TAG);\n\telse\n\t\t{\n\t\t*(p++)=i|V_ASN1_PRIMATIVE_TAG;\n\t\twhile (tag > 0x7f)\n\t\t\t{\n\t\t\t*(p++)=(tag&0x7f)|0x80;\n\t\t\ttag>>=7;\n\t\t\t}\n\t\t*(p++)=(tag&0x7f);\n\t\t}\n\tif ((constructed == 2) && (length == 0))\n\t\t*(p++)=0x80;\n\telse\n\t\tasn1_put_length(&p,length);\n\t*pp=p;\n\t}', 'static void asn1_put_length(unsigned char **pp, int length)\n\t{\n\tunsigned char *p= *pp;\n\tint i,l;\n\tif (length <= 127)\n\t\t*(p++)=(unsigned char)length;\n\telse\n\t\t{\n\t\tl=length;\n\t\tfor (i=0; l > 0; i++)\n\t\t\tl>>=8;\n\t\t*(p++)=i|0x80;\n\t\tl=i;\n\t\twhile (i-- > 0)\n\t\t\t{\n\t\t\tp[i]=length&0xff;\n\t\t\tlength>>=8;\n\t\t\t}\n\t\tp+=l;\n\t\t}\n\t*pp=p;\n\t}']