crypto/asn1/asn_pack.c:98: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] (⇐ [2, +oo] + [0, +oo]) Size: [0, +oo] by call to `i2d_ASN1_SET`.
Showing all 22 steps of the trace


crypto/asn1/asn_pack.c:88:18: Call
86.   	int safelen;
87.   	unsigned char *safe, *p;
88.   	if (!(safelen = i2d_ASN1_SET(safes, NULL, i2d, V_ASN1_SEQUENCE,
                       ^
89.   					      V_ASN1_UNIVERSAL, IS_SEQUENCE))) {
90.   		ASN1err(ASN1_F_ASN1_SEQ_PACK,ASN1_R_ENCODE_ERROR);

crypto/asn1/a_set.c:98:17: Assignment
  96.           int totSize;
  97.   
  98.   	if (a == NULL) return(0);
                         ^
  99.   	for (i=sk_num(a)-1; i>=0; i--)
  100.   		ret+=func(sk_value(a,i),NULL);

crypto/asn1/asn_pack.c:88:8: Assignment
86.   	int safelen;
87.   	unsigned char *safe, *p;
88.   	if (!(safelen = i2d_ASN1_SET(safes, NULL, i2d, V_ASN1_SEQUENCE,
             ^
89.   					      V_ASN1_UNIVERSAL, IS_SEQUENCE))) {
90.   		ASN1err(ASN1_F_ASN1_SEQ_PACK,ASN1_R_ENCODE_ERROR);

crypto/asn1/asn_pack.c:93:15: Array declaration
91.   		return NULL;
92.   	}
93.   	if (!(safe = Malloc (safelen))) {
                    ^
94.   		ASN1err(ASN1_F_ASN1_SEQ_PACK,ERR_R_MALLOC_FAILURE);
95.   		return NULL;

crypto/asn1/asn_pack.c:93:8: Assignment
91.   		return NULL;
92.   	}
93.   	if (!(safe = Malloc (safelen))) {
             ^
94.   		ASN1err(ASN1_F_ASN1_SEQ_PACK,ERR_R_MALLOC_FAILURE);
95.   		return NULL;

crypto/asn1/asn_pack.c:97:2: Assignment
95.   		return NULL;
96.   	}
97.   	p = safe;
        ^
98.   	i2d_ASN1_SET(safes, &p, i2d, V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL,
99.   								 IS_SEQUENCE);

crypto/asn1/asn_pack.c:98:2: Call
96.   	}
97.   	p = safe;
98.   	i2d_ASN1_SET(safes, &p, i2d, V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL,
        ^
99.   								 IS_SEQUENCE);
100.   	if (len) *len = safelen;

crypto/asn1/a_set.c:88:1: Parameter `**pp`
  86.   
  87.   /* int is_set:  if TRUE, then sort the contents (i.e. it isn't a SEQUENCE)    */
  88. > int i2d_ASN1_SET(STACK *a, unsigned char **pp, int (*func)(), int ex_tag,
  89.   	     int ex_class, int is_set)
  90.   	{

crypto/asn1/a_set.c:104:2: Assignment
  102.   	if (pp == NULL) return(r);
  103.   
  104.   	p= *pp;
          ^
  105.   	ASN1_put_object(&p,1,ret,ex_tag,ex_class);
  106.   

crypto/asn1/a_set.c:105:2: Call
  103.   
  104.   	p= *pp;
  105.   	ASN1_put_object(&p,1,ret,ex_tag,ex_class);
          ^
  106.   
  107.   /* Modified by gp@nsj.co.jp */

crypto/asn1/asn1_lib.c:186:1: Parameter `**pp`
    184.   /* class 0 is constructed
    185.    * constructed == 2 for indefinitle length constructed */
    186. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
    187.   	     int xclass)
    188.   	{

crypto/asn1/asn1_lib.c:189:2: Assignment
    187.   	     int xclass)
    188.   	{
    189.   	unsigned char *p= *pp;
            ^
    190.   	int i;
    191.   

crypto/asn1/asn1_lib.c:195:5: Assignment
    193.   	i|=(xclass&V_ASN1_PRIVATE);
    194.   	if (tag < 31)
    195.   		*(p++)=i|(tag&V_ASN1_PRIMATIVE_TAG);
               ^
    196.   	else
    197.   		{

crypto/asn1/asn1_lib.c:209:3: Call
    207.   		*(p++)=0x80; /* der_put_length would output 0 instead */
    208.   	else
    209.   		asn1_put_length(&p,length);
             ^
    210.   	*pp=p;
    211.   	}

crypto/asn1/asn1_lib.c:222:8: <Offset trace>
220.   		{
221.   		l=length;
222.   		for (i=0; l > 0; i++)
              ^
223.   			l>>=8;
224.   		*(p++)=i|0x80;

crypto/asn1/asn1_lib.c:222:8: Assignment
      220.   		{
      221.   		l=length;
      222.   		for (i=0; l > 0; i++)
                    ^
      223.   			l>>=8;
      224.   		*(p++)=i|0x80;

crypto/asn1/asn1_lib.c:226:10: Assignment
      224.   		*(p++)=i|0x80;
      225.   		l=i;
      226.   		while (i-- > 0)
                      ^
      227.   			{
      228.   			p[i]=length&0xff;

crypto/asn1/asn1_lib.c:213:1: <Length trace>
211.   	}
212.   
213. > static void asn1_put_length(unsigned char **pp, int length)
214.   	{
215.   	unsigned char *p= *pp;

crypto/asn1/asn1_lib.c:213:1: Parameter `**pp`
      211.   	}
      212.   
      213. > static void asn1_put_length(unsigned char **pp, int length)
      214.   	{
      215.   	unsigned char *p= *pp;

crypto/asn1/asn1_lib.c:215:2: Assignment
      213.   static void asn1_put_length(unsigned char **pp, int length)
      214.   	{
      215.   	unsigned char *p= *pp;
              ^
      216.   	int i,l;
      217.   	if (length <= 127)

crypto/asn1/asn1_lib.c:224:5: Assignment
      222.   		for (i=0; l > 0; i++)
      223.   			l>>=8;
      224.   		*(p++)=i|0x80;
                 ^
      225.   		l=i;
      226.   		while (i-- > 0)

crypto/asn1/asn1_lib.c:228:4: Array access: Offset: [2, +oo] (⇐ [2, +oo] + [0, +oo]) Size: [0, +oo] by call to `i2d_ASN1_SET` 
      226.   		while (i-- > 0)
      227.   			{
      228.   			p[i]=length&0xff;
                ^
      229.   			length>>=8;
      230.   			}

static void asn1_put_length(unsigned char **pp, int length)
	{
	unsigned char *p= *pp;
	int i,l;
	if (length <= 127)
		*(p++)=(unsigned char)length;
	else
		{
		l=length;
		for (i=0; l > 0; i++)
			l>>=8;
		*(p++)=i|0x80;
		l=i;
		while (i-- > 0)
			{
			p[i]=length&0xff;
			length>>=8;
			}
		p+=l;
		}
	*pp=p;
	}
['unsigned char *ASN1_seq_pack(STACK *safes, int (*i2d)(), unsigned char **buf,\n\t     int *len)\n{\n\tint safelen;\n\tunsigned char *safe, *p;\n\tif (!(safelen = i2d_ASN1_SET(safes, NULL, i2d, V_ASN1_SEQUENCE,\n\t\t\t\t\t      V_ASN1_UNIVERSAL, IS_SEQUENCE))) {\n\t\tASN1err(ASN1_F_ASN1_SEQ_PACK,ASN1_R_ENCODE_ERROR);\n\t\treturn NULL;\n\t}\n\tif (!(safe = Malloc (safelen))) {\n\t\tASN1err(ASN1_F_ASN1_SEQ_PACK,ERR_R_MALLOC_FAILURE);\n\t\treturn NULL;\n\t}\n\tp = safe;\n\ti2d_ASN1_SET(safes, &p, i2d, V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL,\n\t\t\t\t\t\t\t\t IS_SEQUENCE);\n\tif (len) *len = safelen;\n\tif (buf) *buf = safe;\n\treturn safe;\n}', 'int i2d_ASN1_SET(STACK *a, unsigned char **pp, int (*func)(), int ex_tag,\n\t     int ex_class, int is_set)\n\t{\n\tint ret=0,r;\n\tint i;\n\tunsigned char *p;\n        unsigned char *pStart, *pTempMem;\n        MYBLOB *rgSetBlob;\n        int totSize;\n\tif (a == NULL) return(0);\n\tfor (i=sk_num(a)-1; i>=0; i--)\n\t\tret+=func(sk_value(a,i),NULL);\n\tr=ASN1_object_size(1,ret,ex_tag);\n\tif (pp == NULL) return(r);\n\tp= *pp;\n\tASN1_put_object(&p,1,ret,ex_tag,ex_class);\n\tif(!is_set || (sk_num(a) < 2))\n\t\t{\n\t\tfor (i=0; i<sk_num(a); i++)\n                \tfunc(sk_value(a,i),&p);\n\t\t*pp=p;\n\t\treturn(r);\n\t\t}\n        pStart  = p;\n        rgSetBlob = (MYBLOB *)Malloc( sk_num(a) * sizeof(MYBLOB));\n        for (i=0; i<sk_num(a); i++)\n\t        {\n                rgSetBlob[i].pbData = p;\n                func(sk_value(a,i),&p);\n                rgSetBlob[i].cbData = p - rgSetBlob[i].pbData;\n\t\t}\n        *pp=p;\n        totSize = p - pStart;\n        qsort( rgSetBlob, sk_num(a), sizeof(MYBLOB), SetBlobCmp);\n        pTempMem = Malloc(totSize);\n        p = pTempMem;\n        for(i=0; i<sk_num(a); ++i)\n\t\t{\n                memcpy(p, rgSetBlob[i].pbData, rgSetBlob[i].cbData);\n                p += rgSetBlob[i].cbData;\n\t\t}\n        memcpy(pStart, pTempMem, totSize);\n        Free(pTempMem);\n        Free(rgSetBlob);\n        return(r);\n        }', 'void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,\n\t     int xclass)\n\t{\n\tunsigned char *p= *pp;\n\tint i;\n\ti=(constructed)?V_ASN1_CONSTRUCTED:0;\n\ti|=(xclass&V_ASN1_PRIVATE);\n\tif (tag < 31)\n\t\t*(p++)=i|(tag&V_ASN1_PRIMATIVE_TAG);\n\telse\n\t\t{\n\t\t*(p++)=i|V_ASN1_PRIMATIVE_TAG;\n\t\twhile (tag > 0x7f)\n\t\t\t{\n\t\t\t*(p++)=(tag&0x7f)|0x80;\n\t\t\ttag>>=7;\n\t\t\t}\n\t\t*(p++)=(tag&0x7f);\n\t\t}\n\tif ((constructed == 2) && (length == 0))\n\t\t*(p++)=0x80;\n\telse\n\t\tasn1_put_length(&p,length);\n\t*pp=p;\n\t}', 'static void asn1_put_length(unsigned char **pp, int length)\n\t{\n\tunsigned char *p= *pp;\n\tint i,l;\n\tif (length <= 127)\n\t\t*(p++)=(unsigned char)length;\n\telse\n\t\t{\n\t\tl=length;\n\t\tfor (i=0; l > 0; i++)\n\t\t\tl>>=8;\n\t\t*(p++)=i|0x80;\n\t\tl=i;\n\t\twhile (i-- > 0)\n\t\t\t{\n\t\t\tp[i]=length&0xff;\n\t\t\tlength>>=8;\n\t\t\t}\n\t\tp+=l;\n\t\t}\n\t*pp=p;\n\t}']