crypto/pem/pem_lib.c:212: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, +oo] by call to `d2i_PKCS8_PRIV_KEY_INFO`.
Showing all 15 steps of the trace


crypto/pem/pem_lib.c:176:2: Assignment
174.   	EVP_CIPHER_INFO cipher;
175.   	char *nm=NULL,*header=NULL;
176.   	unsigned char *p=NULL,*data=NULL;
        ^
177.   	long len;
178.   	char *ret=NULL;

crypto/pem/pem_lib.c:182:8: Call
180.   	for (;;)
181.   		{
182.   		if (!PEM_read_bio(bp,&nm,&header,&data,&len)) return(NULL);
              ^
183.   		if (	(strcmp(nm,name) == 0) ||
184.   			((strcmp(nm,PEM_STRING_RSA) == 0) &&

crypto/pem/pem_lib.c:584:1: Parameter `**data`
  582.   #endif
  583.   
  584. > int PEM_read_bio(BIO *bp, char **name, char **header, unsigned char **data,
  585.   	     long *len)
  586.   	{

crypto/pem/pem_lib.c:204:2: Assignment
202.   	if (!PEM_get_EVP_CIPHER_INFO(header,&cipher)) goto err;
203.   	if (!PEM_do_header(&cipher,data,&len,cb,u)) goto err;
204.   	p=data;
        ^
205.   	if (strcmp(name,PEM_STRING_EVP_PKEY) == 0) {
206.   		if (strcmp(nm,PEM_STRING_RSA) == 0)

crypto/pem/pem_lib.c:212:10: Call
210.   		else if (strcmp(nm,PEM_STRING_PKCS8INF) == 0) {
211.   			PKCS8_PRIV_KEY_INFO *p8inf;
212.   			p8inf=d2i_PKCS8_PRIV_KEY_INFO(
                ^
213.   					(PKCS8_PRIV_KEY_INFO **) x, &p, len);
214.   			ret = (char *)EVP_PKCS82PKEY(p8inf);

crypto/asn1/p8_pkey.c:100:1: Parameter `**pp`
  98.   }
  99.   
  100. > PKCS8_PRIV_KEY_INFO *d2i_PKCS8_PRIV_KEY_INFO(PKCS8_PRIV_KEY_INFO **a,
  101.   	     unsigned char **pp, long length)
  102.   {

crypto/asn1/p8_pkey.c:104:2: Assignment
  102.   {
  103.   	M_ASN1_D2I_vars(a,PKCS8_PRIV_KEY_INFO *,PKCS8_PRIV_KEY_INFO_new);
  104.   	M_ASN1_D2I_Init();
          ^
  105.   	M_ASN1_D2I_start_sequence();
  106.   	M_ASN1_D2I_get (ret->version, d2i_ASN1_INTEGER);

crypto/asn1/p8_pkey.c:105:2: Call
  103.   	M_ASN1_D2I_vars(a,PKCS8_PRIV_KEY_INFO *,PKCS8_PRIV_KEY_INFO_new);
  104.   	M_ASN1_D2I_Init();
  105.   	M_ASN1_D2I_start_sequence();
          ^
  106.   	M_ASN1_D2I_get (ret->version, d2i_ASN1_INTEGER);
  107.   	M_ASN1_D2I_get (ret->pkeyalg, d2i_X509_ALGOR);

crypto/asn1/asn1_lib.c:277:1: Parameter `*c->p`
    275.   	}
    276.   
    277. > int asn1_GetSequence(ASN1_CTX *c, long *length)
    278.   	{
    279.   	unsigned char *q;

crypto/asn1/asn1_lib.c:282:9: Call
    280.   
    281.   	q=c->p;
    282.   	c->inf=ASN1_get_object(&(c->p),&(c->slen),&(c->tag),&(c->xclass),
                   ^
    283.   		*length);
    284.   	if (c->inf & 0x80)

crypto/asn1/asn1_lib.c:83:1: <Length trace>
81.   
82.   
83. > int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
84.   	     long omax)
85.   	{

crypto/asn1/asn1_lib.c:83:1: Parameter `**pp`
      81.   
      82.   
      83. > int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
      84.   	     long omax)
      85.   	{

crypto/asn1/asn1_lib.c:88:2: Assignment
      86.   	int i,ret;
      87.   	long l;
      88.   	unsigned char *p= *pp;
             ^
      89.   	int tag,xclass,inf;
      90.   	long max=omax;

crypto/asn1/asn1_lib.c:98:3: Assignment
      96.   	if (i == V_ASN1_PRIMITIVE_TAG)
      97.   		{		/* high-tag */
      98.   		p++;
               ^
      99.   		if (--max == 0) goto err;
      100.   		l=0;

crypto/asn1/asn1_lib.c:101:10: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `d2i_PKCS8_PRIV_KEY_INFO` 
      99.   		if (--max == 0) goto err;
      100.   		l=0;
      101.   		while (*p&0x80)
                      ^
      102.   			{
      103.   			l<<=7L;

int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
	     long omax)
	{
	int i,ret;
	long l;
	unsigned char *p= *pp;
	int tag,xclass,inf;
	long max=omax;
	if (!max) goto err;
	ret=(*p&V_ASN1_CONSTRUCTED);
	xclass=(*p&V_ASN1_PRIVATE);
	i= *p&V_ASN1_PRIMITIVE_TAG;
	if (i == V_ASN1_PRIMITIVE_TAG)
		{
		p++;
		if (--max == 0) goto err;
		l=0;
		while (*p&0x80)
			{
			l<<=7L;
			l|= *(p++)&0x7f;
			if (--max == 0) goto err;
			}
		l<<=7L;
		l|= *(p++)&0x7f;
		tag=(int)l;
		}
	else
		{
		tag=i;
		p++;
		if (--max == 0) goto err;
		}
	*ptag=tag;
	*pclass=xclass;
	if (!asn1_get_length(&p,&inf,plength,(int)max)) goto err;
#if 0
	fprintf(stderr,"p=%d + *plength=%ld > omax=%ld + *pp=%d  (%d > %d)\n",
		(int)p,*plength,omax,(int)*pp,(int)(p+ *plength),
		(int)(omax+ *pp));
#endif
#if 0
	if ((p+ *plength) > (omax+ *pp))
		{
		ASN1err(ASN1_F_ASN1_GET_OBJECT,ASN1_R_TOO_LONG);
		ret|=0x80;
		}
#endif
	*pp=p;
	return(ret|inf);
err:
	ASN1err(ASN1_F_ASN1_GET_OBJECT,ASN1_R_HEADER_TOO_LONG);
	return(0x80);
	}
['char *PEM_ASN1_read_bio(char *(*d2i)(), const char *name, BIO *bp, char **x,\n\t     pem_password_cb *cb, void *u)\n\t{\n\tEVP_CIPHER_INFO cipher;\n\tchar *nm=NULL,*header=NULL;\n\tunsigned char *p=NULL,*data=NULL;\n\tlong len;\n\tchar *ret=NULL;\n\tfor (;;)\n\t\t{\n\t\tif (!PEM_read_bio(bp,&nm,&header,&data,&len)) return(NULL);\n\t\tif (\t(strcmp(nm,name) == 0) ||\n\t\t\t((strcmp(nm,PEM_STRING_RSA) == 0) &&\n\t\t\t (strcmp(name,PEM_STRING_EVP_PKEY) == 0)) ||\n\t\t\t((strcmp(nm,PEM_STRING_DSA) == 0) &&\n\t\t\t (strcmp(name,PEM_STRING_EVP_PKEY) == 0)) ||\n\t\t\t((strcmp(nm,PEM_STRING_PKCS8) == 0) &&\n\t\t\t (strcmp(name,PEM_STRING_EVP_PKEY) == 0)) ||\n\t\t\t((strcmp(nm,PEM_STRING_PKCS8INF) == 0) &&\n\t\t\t (strcmp(name,PEM_STRING_EVP_PKEY) == 0)) ||\n\t\t\t((strcmp(nm,PEM_STRING_X509_OLD) == 0) &&\n\t\t\t (strcmp(name,PEM_STRING_X509) == 0)) ||\n\t\t\t((strcmp(nm,PEM_STRING_X509_REQ_OLD) == 0) &&\n\t\t\t (strcmp(name,PEM_STRING_X509_REQ) == 0))\n\t\t\t)\n\t\t\tbreak;\n\t\tFree(nm);\n\t\tFree(header);\n\t\tFree(data);\n\t\t}\n\tif (!PEM_get_EVP_CIPHER_INFO(header,&cipher)) goto err;\n\tif (!PEM_do_header(&cipher,data,&len,cb,u)) goto err;\n\tp=data;\n\tif (strcmp(name,PEM_STRING_EVP_PKEY) == 0) {\n\t\tif (strcmp(nm,PEM_STRING_RSA) == 0)\n\t\t\tret=d2i(EVP_PKEY_RSA,x,&p,len);\n\t\telse if (strcmp(nm,PEM_STRING_DSA) == 0)\n\t\t\tret=d2i(EVP_PKEY_DSA,x,&p,len);\n\t\telse if (strcmp(nm,PEM_STRING_PKCS8INF) == 0) {\n\t\t\tPKCS8_PRIV_KEY_INFO *p8inf;\n\t\t\tp8inf=d2i_PKCS8_PRIV_KEY_INFO(\n\t\t\t\t\t(PKCS8_PRIV_KEY_INFO **) x, &p, len);\n\t\t\tret = (char *)EVP_PKCS82PKEY(p8inf);\n\t\t\tPKCS8_PRIV_KEY_INFO_free(p8inf);\n\t\t} else if (strcmp(nm,PEM_STRING_PKCS8) == 0) {\n\t\t\tPKCS8_PRIV_KEY_INFO *p8inf;\n\t\t\tX509_SIG *p8;\n\t\t\tint klen;\n\t\t\tchar psbuf[PEM_BUFSIZE];\n\t\t\tp8 = d2i_X509_SIG((X509_SIG **)x, &p, len);\n\t\t\tif(!p8) goto p8err;\n\t\t\tif (cb) klen=cb(psbuf,PEM_BUFSIZE,0,u);\n\t\t\telse klen=def_callback(psbuf,PEM_BUFSIZE,0,u);\n\t\t\tif (klen <= 0) {\n\t\t\t\tPEMerr(PEM_F_PEM_ASN1_READ_BIO,\n\t\t\t\t\t\tPEM_R_BAD_PASSWORD_READ);\n\t\t\t\tgoto err;\n\t\t\t}\n\t\t\tp8inf = M_PKCS8_decrypt(p8, psbuf, klen);\n\t\t\tX509_SIG_free(p8);\n\t\t\tif(!p8inf) goto p8err;\n\t\t\tret = (char *)EVP_PKCS82PKEY(p8inf);\n\t\t\tPKCS8_PRIV_KEY_INFO_free(p8inf);\n\t\t}\n\t} else\tret=d2i(x,&p,len);\np8err:\n\tif (ret == NULL)\n\t\tPEMerr(PEM_F_PEM_ASN1_READ_BIO,ERR_R_ASN1_LIB);\nerr:\n\tFree(nm);\n\tFree(header);\n\tFree(data);\n\treturn(ret);\n\t}', 'int PEM_read_bio(BIO *bp, char **name, char **header, unsigned char **data,\n\t     long *len)\n\t{\n\tEVP_ENCODE_CTX ctx;\n\tint end=0,i,k,bl=0,hl=0,nohead=0;\n\tchar buf[256];\n\tBUF_MEM *nameB;\n\tBUF_MEM *headerB;\n\tBUF_MEM *dataB,*tmpB;\n\tnameB=BUF_MEM_new();\n\theaderB=BUF_MEM_new();\n\tdataB=BUF_MEM_new();\n\tif ((nameB == NULL) || (headerB == NULL) || (dataB == NULL))\n\t\t{\n\t\tPEMerr(PEM_F_PEM_READ_BIO,ERR_R_MALLOC_FAILURE);\n\t\treturn(0);\n\t\t}\n\tbuf[254]=\'\\0\';\n\tfor (;;)\n\t\t{\n\t\ti=BIO_gets(bp,buf,254);\n\t\tif (i <= 0)\n\t\t\t{\n\t\t\tPEMerr(PEM_F_PEM_READ_BIO,PEM_R_NO_START_LINE);\n\t\t\tgoto err;\n\t\t\t}\n\t\twhile ((i >= 0) && (buf[i] <= \' \')) i--;\n\t\tbuf[++i]=\'\\n\'; buf[++i]=\'\\0\';\n\t\tif (strncmp(buf,"-----BEGIN ",11) == 0)\n\t\t\t{\n\t\t\ti=strlen(&(buf[11]));\n\t\t\tif (strncmp(&(buf[11+i-6]),"-----\\n",6) != 0)\n\t\t\t\tcontinue;\n\t\t\tif (!BUF_MEM_grow(nameB,i+9))\n\t\t\t\t{\n\t\t\t\tPEMerr(PEM_F_PEM_READ_BIO,ERR_R_MALLOC_FAILURE);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tmemcpy(nameB->data,&(buf[11]),i-6);\n\t\t\tnameB->data[i-6]=\'\\0\';\n\t\t\tbreak;\n\t\t\t}\n\t\t}\n\thl=0;\n\tif (!BUF_MEM_grow(headerB,256))\n\t\t{ PEMerr(PEM_F_PEM_READ_BIO,ERR_R_MALLOC_FAILURE); goto err; }\n\theaderB->data[0]=\'\\0\';\n\tfor (;;)\n\t\t{\n\t\ti=BIO_gets(bp,buf,254);\n\t\tif (i <= 0) break;\n\t\twhile ((i >= 0) && (buf[i] <= \' \')) i--;\n\t\tbuf[++i]=\'\\n\'; buf[++i]=\'\\0\';\n\t\tif (buf[0] == \'\\n\') break;\n\t\tif (!BUF_MEM_grow(headerB,hl+i+9))\n\t\t\t{ PEMerr(PEM_F_PEM_READ_BIO,ERR_R_MALLOC_FAILURE); goto err; }\n\t\tif (strncmp(buf,"-----END ",9) == 0)\n\t\t\t{\n\t\t\tnohead=1;\n\t\t\tbreak;\n\t\t\t}\n\t\tmemcpy(&(headerB->data[hl]),buf,i);\n\t\theaderB->data[hl+i]=\'\\0\';\n\t\thl+=i;\n\t\t}\n\tbl=0;\n\tif (!BUF_MEM_grow(dataB,1024))\n\t\t{ PEMerr(PEM_F_PEM_READ_BIO,ERR_R_MALLOC_FAILURE); goto err; }\n\tdataB->data[0]=\'\\0\';\n\tif (!nohead)\n\t\t{\n\t\tfor (;;)\n\t\t\t{\n\t\t\ti=BIO_gets(bp,buf,254);\n\t\t\tif (i <= 0) break;\n\t\t\twhile ((i >= 0) && (buf[i] <= \' \')) i--;\n\t\t\tbuf[++i]=\'\\n\'; buf[++i]=\'\\0\';\n\t\t\tif (i != 65) end=1;\n\t\t\tif (strncmp(buf,"-----END ",9) == 0)\n\t\t\t\tbreak;\n\t\t\tif (i > 65) break;\n\t\t\tif (!BUF_MEM_grow(dataB,i+bl+9))\n\t\t\t\t{\n\t\t\t\tPEMerr(PEM_F_PEM_READ_BIO,ERR_R_MALLOC_FAILURE);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tmemcpy(&(dataB->data[bl]),buf,i);\n\t\t\tdataB->data[bl+i]=\'\\0\';\n\t\t\tbl+=i;\n\t\t\tif (end)\n\t\t\t\t{\n\t\t\t\tbuf[0]=\'\\0\';\n\t\t\t\ti=BIO_gets(bp,buf,254);\n\t\t\t\tif (i <= 0) break;\n\t\t\t\twhile ((i >= 0) && (buf[i] <= \' \')) i--;\n\t\t\t\tbuf[++i]=\'\\n\'; buf[++i]=\'\\0\';\n\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\telse\n\t\t{\n\t\ttmpB=headerB;\n\t\theaderB=dataB;\n\t\tdataB=tmpB;\n\t\tbl=hl;\n\t\t}\n\ti=strlen(nameB->data);\n\tif (\t(strncmp(buf,"-----END ",9) != 0) ||\n\t\t(strncmp(nameB->data,&(buf[9]),i) != 0) ||\n\t\t(strncmp(&(buf[9+i]),"-----\\n",6) != 0))\n\t\t{\n\t\tPEMerr(PEM_F_PEM_READ_BIO,PEM_R_BAD_END_LINE);\n\t\tgoto err;\n\t\t}\n\tEVP_DecodeInit(&ctx);\n\ti=EVP_DecodeUpdate(&ctx,\n\t\t(unsigned char *)dataB->data,&bl,\n\t\t(unsigned char *)dataB->data,bl);\n\tif (i < 0)\n\t\t{\n\t\tPEMerr(PEM_F_PEM_READ_BIO,PEM_R_BAD_BASE64_DECODE);\n\t\tgoto err;\n\t\t}\n\ti=EVP_DecodeFinal(&ctx,(unsigned char *)&(dataB->data[bl]),&k);\n\tif (i < 0)\n\t\t{\n\t\tPEMerr(PEM_F_PEM_READ_BIO,PEM_R_BAD_BASE64_DECODE);\n\t\tgoto err;\n\t\t}\n\tbl+=k;\n\tif (bl == 0) goto err;\n\t*name=nameB->data;\n\t*header=headerB->data;\n\t*data=(unsigned char *)dataB->data;\n\t*len=bl;\n\tFree(nameB);\n\tFree(headerB);\n\tFree(dataB);\n\treturn(1);\nerr:\n\tBUF_MEM_free(nameB);\n\tBUF_MEM_free(headerB);\n\tBUF_MEM_free(dataB);\n\treturn(0);\n\t}', 'PKCS8_PRIV_KEY_INFO *d2i_PKCS8_PRIV_KEY_INFO(PKCS8_PRIV_KEY_INFO **a,\n\t     unsigned char **pp, long length)\n{\n\tM_ASN1_D2I_vars(a,PKCS8_PRIV_KEY_INFO *,PKCS8_PRIV_KEY_INFO_new);\n\tM_ASN1_D2I_Init();\n\tM_ASN1_D2I_start_sequence();\n\tM_ASN1_D2I_get (ret->version, d2i_ASN1_INTEGER);\n\tM_ASN1_D2I_get (ret->pkeyalg, d2i_X509_ALGOR);\n\tM_ASN1_D2I_get (ret->pkey, d2i_ASN1_TYPE);\n\tM_ASN1_D2I_get_IMP_set_opt_type(X509_ATTRIBUTE, ret->attributes,\n\t\t\t\t\td2i_X509_ATTRIBUTE,\n\t\t\t\t\tX509_ATTRIBUTE_free, 0);\n\tif (ASN1_TYPE_get(ret->pkey) == V_ASN1_SEQUENCE)\n\t\t\t\t\t\tret->broken = PKCS8_NO_OCTET;\n\tM_ASN1_D2I_Finish(a, PKCS8_PRIV_KEY_INFO_free, ASN1_F_D2I_PKCS8_PRIV_KEY_INFO);\n}', 'int asn1_GetSequence(ASN1_CTX *c, long *length)\n\t{\n\tunsigned char *q;\n\tq=c->p;\n\tc->inf=ASN1_get_object(&(c->p),&(c->slen),&(c->tag),&(c->xclass),\n\t\t*length);\n\tif (c->inf & 0x80)\n\t\t{\n\t\tc->error=ERR_R_BAD_GET_ASN1_OBJECT_CALL;\n\t\treturn(0);\n\t\t}\n\tif (c->tag != V_ASN1_SEQUENCE)\n\t\t{\n\t\tc->error=ERR_R_EXPECTING_AN_ASN1_SEQUENCE;\n\t\treturn(0);\n\t\t}\n\t(*length)-=(c->p-q);\n\tif (c->max && (*length < 0))\n\t\t{\n\t\tc->error=ERR_R_ASN1_LENGTH_MISMATCH;\n\t\treturn(0);\n\t\t}\n\tif (c->inf == (1|V_ASN1_CONSTRUCTED))\n\t\tc->slen= *length+ *(c->pp)-c->p;\n\tc->eos=0;\n\treturn(1);\n\t}', 'int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,\n\t     long omax)\n\t{\n\tint i,ret;\n\tlong l;\n\tunsigned char *p= *pp;\n\tint tag,xclass,inf;\n\tlong max=omax;\n\tif (!max) goto err;\n\tret=(*p&V_ASN1_CONSTRUCTED);\n\txclass=(*p&V_ASN1_PRIVATE);\n\ti= *p&V_ASN1_PRIMITIVE_TAG;\n\tif (i == V_ASN1_PRIMITIVE_TAG)\n\t\t{\n\t\tp++;\n\t\tif (--max == 0) goto err;\n\t\tl=0;\n\t\twhile (*p&0x80)\n\t\t\t{\n\t\t\tl<<=7L;\n\t\t\tl|= *(p++)&0x7f;\n\t\t\tif (--max == 0) goto err;\n\t\t\t}\n\t\tl<<=7L;\n\t\tl|= *(p++)&0x7f;\n\t\ttag=(int)l;\n\t\t}\n\telse\n\t\t{\n\t\ttag=i;\n\t\tp++;\n\t\tif (--max == 0) goto err;\n\t\t}\n\t*ptag=tag;\n\t*pclass=xclass;\n\tif (!asn1_get_length(&p,&inf,plength,(int)max)) goto err;\n#if 0\n\tfprintf(stderr,"p=%d + *plength=%ld > omax=%ld + *pp=%d  (%d > %d)\\n",\n\t\t(int)p,*plength,omax,(int)*pp,(int)(p+ *plength),\n\t\t(int)(omax+ *pp));\n#endif\n#if 0\n\tif ((p+ *plength) > (omax+ *pp))\n\t\t{\n\t\tASN1err(ASN1_F_ASN1_GET_OBJECT,ASN1_R_TOO_LONG);\n\t\tret|=0x80;\n\t\t}\n#endif\n\t*pp=p;\n\treturn(ret|inf);\nerr:\n\tASN1err(ASN1_F_ASN1_GET_OBJECT,ASN1_R_HEADER_TOO_LONG);\n\treturn(0x80);\n\t}']