crypto/dsa/dsa_asn1.c:82: error: INTEGER_OVERFLOW_L2
  ([1, +oo] - [2, 4]):unsigned64 by call to `encode_der_dsa_sig`.
Showing all 10 steps of the trace


crypto/dsa/dsa_asn1.c:79:9: Assignment
77.           pp = &tmp;
78.       } else {
79.           len = SIZE_MAX;
              ^
80.           pp = ppout;
81.       }

crypto/dsa/dsa_asn1.c:82:24: Call
80.           pp = ppout;
81.       }
82.       if ((encoded_len = encode_der_dsa_sig(sig->r, sig->s, pp, len)) == 0) {
                             ^
83.           OPENSSL_free(buf);
84.           return -1;

crypto/asn1_dsa.c:149:1: Parameter `len`
  147.    * or 0 if an error occurs.
  148.    */
  149. > size_t encode_der_dsa_sig(const BIGNUM *r, const BIGNUM *s,
  150.                             unsigned char **ppout, size_t len)
  151.   {

crypto/asn1_dsa.c:176:14: Call
  174.           return 0;
  175.       produced += c;
  176.       if ((c = encode_der_integer(r, pp, len - produced)) == 0)
                      ^
  177.           return 0;
  178.       produced += c;

crypto/asn1_dsa.c:94:1: <LHS trace>
92.    * or 0 if an error occurs.
93.    */
94. > size_t encode_der_integer(const BIGNUM *n, unsigned char **ppout, size_t len)
95.   {
96.       unsigned char *out = NULL;

crypto/asn1_dsa.c:94:1: Parameter `len`
    92.    * or 0 if an error occurs.
    93.    */
    94. > size_t encode_der_integer(const BIGNUM *n, unsigned char **ppout, size_t len)
    95.   {
    96.       unsigned char *out = NULL;

crypto/asn1_dsa.c:121:5: <RHS trace>
119.           *out++ = ID_INTEGER;
120.       }
121.       produced = 1;
           ^
122.       if ((c = encode_der_length(cont_len, pp, len - produced)) == 0)
123.           return 0;

crypto/asn1_dsa.c:121:5: Assignment
    119.           *out++ = ID_INTEGER;
    120.       }
    121.       produced = 1;
               ^
    122.       if ((c = encode_der_length(cont_len, pp, len - produced)) == 0)
    123.           return 0;

crypto/asn1_dsa.c:124:5: Assignment
    122.       if ((c = encode_der_length(cont_len, pp, len - produced)) == 0)
    123.           return 0;
    124.       produced += c;
               ^
    125.       if (cont_len > len - produced)
    126.           return 0;

crypto/asn1_dsa.c:125:9: Binary operation: ([1, +oo] - [2, 4]):unsigned64 by call to `encode_der_dsa_sig` 
    123.           return 0;
    124.       produced += c;
    125.       if (cont_len > len - produced)
                   ^
    126.           return 0;
    127.       if (pp != NULL) {

size_t encode_der_integer(const BIGNUM *n, unsigned char **ppout, size_t len)
{
    unsigned char *out = NULL;
    unsigned char **pp = NULL;
    size_t produced;
    size_t c;
    size_t cont_len;
    if (len < 1 || BN_is_negative(n))
        return 0;
    cont_len = BN_num_bits(n) / 8 + 1;
    if (ppout != NULL) {
        out = *ppout;
        pp = &out;
        *out++ = ID_INTEGER;
    }
    produced = 1;
    if ((c = encode_der_length(cont_len, pp, len - produced)) == 0)
        return 0;
    produced += c;
    if (cont_len > len - produced)
        return 0;
    if (pp != NULL) {
        if (BN_bn2binpad(n, out, (int)cont_len) != (int)cont_len)
            return 0;
        out += cont_len;
        *ppout = out;
    }
    produced += cont_len;
    return produced;
}
['int i2d_DSA_SIG(const DSA_SIG *sig, unsigned char **ppout)\n{\n    unsigned char *buf = NULL;\n    unsigned char *tmp;\n    unsigned char **pp = NULL;\n    size_t len;\n    size_t encoded_len;\n    if (ppout != NULL && *ppout == NULL) {\n        if ((len = encode_der_dsa_sig(sig->r, sig->s, NULL, SIZE_MAX)) == 0)\n            return -1;\n        buf = OPENSSL_malloc(len);\n        if (buf == NULL)\n            return -1;\n        tmp = buf;\n        pp = &tmp;\n    } else {\n        len = SIZE_MAX;\n        pp = ppout;\n    }\n    if ((encoded_len = encode_der_dsa_sig(sig->r, sig->s, pp, len)) == 0) {\n        OPENSSL_free(buf);\n        return -1;\n    }\n    if (buf != NULL)\n        *ppout = buf;\n    return (int)encoded_len;\n}', 'size_t encode_der_dsa_sig(const BIGNUM *r, const BIGNUM *s,\n                          unsigned char **ppout, size_t len)\n{\n    unsigned char *out = NULL;\n    unsigned char **pp = NULL;\n    size_t produced;\n    size_t c;\n    size_t r_der_len;\n    size_t s_der_len;\n    size_t cont_len;\n    if (len < 1\n            || (r_der_len = encode_der_integer(r, NULL, SIZE_MAX)) == 0\n            || (s_der_len = encode_der_integer(s, NULL, SIZE_MAX)) == 0)\n        return 0;\n    cont_len = r_der_len + s_der_len;\n    if (ppout != NULL) {\n        out = *ppout;\n        pp = &out;\n        *out++ = ID_SEQUENCE;\n    }\n    produced = 1;\n    if ((c = encode_der_length(cont_len, pp, len - produced)) == 0)\n        return 0;\n    produced += c;\n    if ((c = encode_der_integer(r, pp, len - produced)) == 0)\n        return 0;\n    produced += c;\n    if ((c = encode_der_integer(s, pp, len - produced)) == 0)\n        return 0;\n    produced += c;\n    if (pp != NULL)\n        *ppout = out;\n    return produced;\n}', 'size_t encode_der_integer(const BIGNUM *n, unsigned char **ppout, size_t len)\n{\n    unsigned char *out = NULL;\n    unsigned char **pp = NULL;\n    size_t produced;\n    size_t c;\n    size_t cont_len;\n    if (len < 1 || BN_is_negative(n))\n        return 0;\n    cont_len = BN_num_bits(n) / 8 + 1;\n    if (ppout != NULL) {\n        out = *ppout;\n        pp = &out;\n        *out++ = ID_INTEGER;\n    }\n    produced = 1;\n    if ((c = encode_der_length(cont_len, pp, len - produced)) == 0)\n        return 0;\n    produced += c;\n    if (cont_len > len - produced)\n        return 0;\n    if (pp != NULL) {\n        if (BN_bn2binpad(n, out, (int)cont_len) != (int)cont_len)\n            return 0;\n        out += cont_len;\n        *ppout = out;\n    }\n    produced += cont_len;\n    return produced;\n}']