crypto/pem/pem_info.c:206: error: BUFFER_OVERRUN_L3
  Offset: 12 Size: [0, +oo] by call to `PEM_get_EVP_CIPHER_INFO`.
Showing all 8 steps of the trace


crypto/pem/pem_info.c:111:5: Call
109.   		{
110.   		raw=0;
111.   		i=PEM_read_bio(bp,&name,&header,&data,&len);
           ^
112.   		if (i == 0)
113.   			{

crypto/pem/pem_lib.c:584:1: Parameter `**header`
  582.   #endif
  583.   
  584. > int PEM_read_bio(BIO *bp, char **name, char **header, unsigned char **data,
  585.   	     long *len)
  586.   	{

crypto/pem/pem_info.c:206:10: Call
204.   				EVP_CIPHER_INFO cipher;
205.   
206.   				if (!PEM_get_EVP_CIPHER_INFO(header,&cipher))
                ^
207.   					goto err;
208.   				if (!PEM_do_header(&cipher,data,&len,cb,u))

crypto/pem/pem_lib.c:406:1: <Length trace>
404.   	}
405.   
406. > int PEM_get_EVP_CIPHER_INFO(char *header, EVP_CIPHER_INFO *cipher)
407.   	{
408.   	int o;

crypto/pem/pem_lib.c:406:1: Parameter `*header`
  404.   	}
  405.   
  406. > int PEM_get_EVP_CIPHER_INFO(char *header, EVP_CIPHER_INFO *cipher)
  407.   	{
  408.   	int o;

crypto/pem/pem_lib.c:417:2: Assignment
  415.   	if (strncmp(header,"Proc-Type: ",11) != 0)
  416.   		{ PEMerr(PEM_F_PEM_GET_EVP_CIPHER_INFO,PEM_R_NOT_PROC_TYPE); return(0); }
  417.   	header+=11;
          ^
  418.   	if (*header != '4') return(0); header++;
  419.   	if (*header != ',') return(0); header++;

crypto/pem/pem_lib.c:418:33: Assignment
  416.   		{ PEMerr(PEM_F_PEM_GET_EVP_CIPHER_INFO,PEM_R_NOT_PROC_TYPE); return(0); }
  417.   	header+=11;
  418.   	if (*header != '4') return(0); header++;
                                         ^
  419.   	if (*header != ',') return(0); header++;
  420.   	if (strncmp(header,"ENCRYPTED",9) != 0)

crypto/pem/pem_lib.c:419:6: Array access: Offset: 12 Size: [0, +oo] by call to `PEM_get_EVP_CIPHER_INFO` 
  417.   	header+=11;
  418.   	if (*header != '4') return(0); header++;
  419.   	if (*header != ',') return(0); header++;
              ^
  420.   	if (strncmp(header,"ENCRYPTED",9) != 0)
  421.   		{ PEMerr(PEM_F_PEM_GET_EVP_CIPHER_INFO,PEM_R_NOT_ENCRYPTED); return(0); }

int PEM_get_EVP_CIPHER_INFO(char *header, EVP_CIPHER_INFO *cipher)
	{
	int o;
	const EVP_CIPHER *enc=NULL;
	char *p,c;
	cipher->cipher=NULL;
	if ((header == NULL) || (*header == '\0') || (*header == '\n'))
		return(1);
	if (strncmp(header,"Proc-Type: ",11) != 0)
		{ PEMerr(PEM_F_PEM_GET_EVP_CIPHER_INFO,PEM_R_NOT_PROC_TYPE); return(0); }
	header+=11;
	if (*header != '4') return(0); header++;
	if (*header != ',') return(0); header++;
	if (strncmp(header,"ENCRYPTED",9) != 0)
		{ PEMerr(PEM_F_PEM_GET_EVP_CIPHER_INFO,PEM_R_NOT_ENCRYPTED); return(0); }
	for (; (*header != '\n') && (*header != '\0'); header++)
		;
	if (*header == '\0')
		{ PEMerr(PEM_F_PEM_GET_EVP_CIPHER_INFO,PEM_R_SHORT_HEADER); return(0); }
	header++;
	if (strncmp(header,"DEK-Info: ",10) != 0)
		{ PEMerr(PEM_F_PEM_GET_EVP_CIPHER_INFO,PEM_R_NOT_DEK_INFO); return(0); }
	header+=10;
	p=header;
	for (;;)
		{
		c= *header;
#ifndef CHARSET_EBCDIC
		if (!(	((c >= 'A') && (c <= 'Z')) || (c == '-') ||
			((c >= '0') && (c <= '9'))))
			break;
#else
		if (!(	isupper(c) || (c == '-') ||
			isdigit(c)))
			break;
#endif
		header++;
		}
	*header='\0';
	o=OBJ_sn2nid(p);
	cipher->cipher=enc=EVP_get_cipherbyname(p);
	*header=c;
	header++;
	if (enc == NULL)
		{
		PEMerr(PEM_F_PEM_GET_EVP_CIPHER_INFO,PEM_R_UNSUPPORTED_ENCRYPTION);
		return(0);
		}
	if (!load_iv((unsigned char **)&header,&(cipher->iv[0]),8)) return(0);
	return(1);
	}
['STACK_OF(X509_INFO) *PEM_X509_INFO_read_bio(BIO *bp, STACK_OF(X509_INFO) *sk, pem_password_cb *cb, void *u)\n\t{\n\tX509_INFO *xi=NULL;\n\tchar *name=NULL,*header=NULL,**pp;\n\tunsigned char *data=NULL,*p;\n\tlong len,error=0;\n\tint ok=0;\n\tSTACK_OF(X509_INFO) *ret=NULL;\n\tunsigned int i,raw;\n\tchar *(*d2i)();\n\tif (sk == NULL)\n\t\t{\n\t\tif ((ret=sk_X509_INFO_new_null()) == NULL)\n\t\t\t{\n\t\t\tPEMerr(PEM_F_PEM_X509_INFO_READ_BIO,ERR_R_MALLOC_FAILURE);\n\t\t\tgoto err;\n\t\t\t}\n\t\t}\n\telse\n\t\tret=sk;\n\tif ((xi=X509_INFO_new()) == NULL) goto err;\n\tfor (;;)\n\t\t{\n\t\traw=0;\n\t\ti=PEM_read_bio(bp,&name,&header,&data,&len);\n\t\tif (i == 0)\n\t\t\t{\n\t\t\terror=ERR_GET_REASON(ERR_peek_error());\n\t\t\tif (error == PEM_R_NO_START_LINE)\n\t\t\t\t{\n\t\t\t\tERR_clear_error();\n\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\tgoto err;\n\t\t\t}\nstart:\n\t\tif (\t(strcmp(name,PEM_STRING_X509) == 0) ||\n\t\t\t(strcmp(name,PEM_STRING_X509_OLD) == 0))\n\t\t\t{\n\t\t\td2i=(char *(*)())d2i_X509;\n\t\t\tif (xi->x509 != NULL)\n\t\t\t\t{\n\t\t\t\tif (!sk_X509_INFO_push(ret,xi)) goto err;\n\t\t\t\tif ((xi=X509_INFO_new()) == NULL) goto err;\n\t\t\t\tgoto start;\n\t\t\t\t}\n\t\t\tpp=(char **)&(xi->x509);\n\t\t\t}\n\t\telse if (strcmp(name,PEM_STRING_X509_CRL) == 0)\n\t\t\t{\n\t\t\td2i=(char *(*)())d2i_X509_CRL;\n\t\t\tif (xi->crl != NULL)\n\t\t\t\t{\n\t\t\t\tif (!sk_X509_INFO_push(ret,xi)) goto err;\n\t\t\t\tif ((xi=X509_INFO_new()) == NULL) goto err;\n\t\t\t\tgoto start;\n\t\t\t\t}\n\t\t\tpp=(char **)&(xi->crl);\n\t\t\t}\n\t\telse\n#ifndef NO_RSA\n\t\t\tif (strcmp(name,PEM_STRING_RSA) == 0)\n\t\t\t{\n\t\t\td2i=(char *(*)())d2i_RSAPrivateKey;\n\t\t\tif (xi->x_pkey != NULL)\n\t\t\t\t{\n\t\t\t\tif (!sk_X509_INFO_push(ret,xi)) goto err;\n\t\t\t\tif ((xi=X509_INFO_new()) == NULL) goto err;\n\t\t\t\tgoto start;\n\t\t\t\t}\n\t\t\txi->enc_data=NULL;\n\t\t\txi->enc_len=0;\n\t\t\txi->x_pkey=X509_PKEY_new();\n\t\t\tif ((xi->x_pkey->dec_pkey=EVP_PKEY_new()) == NULL)\n\t\t\t\tgoto err;\n\t\t\txi->x_pkey->dec_pkey->type=EVP_PKEY_RSA;\n\t\t\tpp=(char **)&(xi->x_pkey->dec_pkey->pkey.rsa);\n\t\t\tif ((int)strlen(header) > 10)\n\t\t\t\traw=1;\n\t\t\t}\n\t\telse\n#endif\n#ifndef NO_DSA\n\t\t\tif (strcmp(name,PEM_STRING_DSA) == 0)\n\t\t\t{\n\t\t\td2i=(char *(*)())d2i_DSAPrivateKey;\n\t\t\tif (xi->x_pkey != NULL)\n\t\t\t\t{\n\t\t\t\tif (!sk_X509_INFO_push(ret,xi)) goto err;\n\t\t\t\tif ((xi=X509_INFO_new()) == NULL) goto err;\n\t\t\t\tgoto start;\n\t\t\t\t}\n\t\t\txi->enc_data=NULL;\n\t\t\txi->enc_len=0;\n\t\t\txi->x_pkey=X509_PKEY_new();\n\t\t\tif ((xi->x_pkey->dec_pkey=EVP_PKEY_new()) == NULL)\n\t\t\t\tgoto err;\n\t\t\txi->x_pkey->dec_pkey->type=EVP_PKEY_DSA;\n\t\t\tpp=(char **)&(xi->x_pkey->dec_pkey->pkey.dsa);\n\t\t\tif ((int)strlen(header) > 10)\n\t\t\t\traw=1;\n\t\t\t}\n\t\telse\n#endif\n\t\t\t{\n\t\t\td2i=NULL;\n\t\t\tpp=NULL;\n\t\t\t}\n\t\tif (d2i != NULL)\n\t\t\t{\n\t\t\tif (!raw)\n\t\t\t\t{\n\t\t\t\tEVP_CIPHER_INFO cipher;\n\t\t\t\tif (!PEM_get_EVP_CIPHER_INFO(header,&cipher))\n\t\t\t\t\tgoto err;\n\t\t\t\tif (!PEM_do_header(&cipher,data,&len,cb,u))\n\t\t\t\t\tgoto err;\n\t\t\t\tp=data;\n\t\t\t\tif (d2i(pp,&p,len) == NULL)\n\t\t\t\t\t{\n\t\t\t\t\tPEMerr(PEM_F_PEM_X509_INFO_READ_BIO,ERR_R_ASN1_LIB);\n\t\t\t\t\tgoto err;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\telse\n\t\t\t\t{\n\t\t\t\tif (!PEM_get_EVP_CIPHER_INFO(header,\n\t\t\t\t\t&xi->enc_cipher)) goto err;\n\t\t\t\txi->enc_data=(char *)data;\n\t\t\t\txi->enc_len=(int)len;\n\t\t\t\tdata=NULL;\n\t\t\t\t}\n\t\t\t}\n\t\telse\t{\n\t\t\t}\n\t\tif (name != NULL) Free(name);\n\t\tif (header != NULL) Free(header);\n\t\tif (data != NULL) Free(data);\n\t\tname=NULL;\n\t\theader=NULL;\n\t\tdata=NULL;\n\t\t}\n\tif ((xi->x509 != NULL) || (xi->crl != NULL) ||\n\t\t(xi->x_pkey != NULL) || (xi->enc_data != NULL))\n\t\t{\n\t\tif (!sk_X509_INFO_push(ret,xi)) goto err;\n\t\txi=NULL;\n\t\t}\n\tok=1;\nerr:\n\tif (xi != NULL) X509_INFO_free(xi);\n\tif (!ok)\n\t\t{\n\t\tfor (i=0; ((int)i)<sk_X509_INFO_num(ret); i++)\n\t\t\t{\n\t\t\txi=sk_X509_INFO_value(ret,i);\n\t\t\tX509_INFO_free(xi);\n\t\t\t}\n\t\tif (ret != sk) sk_X509_INFO_free(ret);\n\t\tret=NULL;\n\t\t}\n\tif (name != NULL) Free(name);\n\tif (header != NULL) Free(header);\n\tif (data != NULL) Free(data);\n\treturn(ret);\n\t}', 'int PEM_read_bio(BIO *bp, char **name, char **header, unsigned char **data,\n\t     long *len)\n\t{\n\tEVP_ENCODE_CTX ctx;\n\tint end=0,i,k,bl=0,hl=0,nohead=0;\n\tchar buf[256];\n\tBUF_MEM *nameB;\n\tBUF_MEM *headerB;\n\tBUF_MEM *dataB,*tmpB;\n\tnameB=BUF_MEM_new();\n\theaderB=BUF_MEM_new();\n\tdataB=BUF_MEM_new();\n\tif ((nameB == NULL) || (headerB == NULL) || (dataB == NULL))\n\t\t{\n\t\tPEMerr(PEM_F_PEM_READ_BIO,ERR_R_MALLOC_FAILURE);\n\t\treturn(0);\n\t\t}\n\tbuf[254]=\'\\0\';\n\tfor (;;)\n\t\t{\n\t\ti=BIO_gets(bp,buf,254);\n\t\tif (i <= 0)\n\t\t\t{\n\t\t\tPEMerr(PEM_F_PEM_READ_BIO,PEM_R_NO_START_LINE);\n\t\t\tgoto err;\n\t\t\t}\n\t\twhile ((i >= 0) && (buf[i] <= \' \')) i--;\n\t\tbuf[++i]=\'\\n\'; buf[++i]=\'\\0\';\n\t\tif (strncmp(buf,"-----BEGIN ",11) == 0)\n\t\t\t{\n\t\t\ti=strlen(&(buf[11]));\n\t\t\tif (strncmp(&(buf[11+i-6]),"-----\\n",6) != 0)\n\t\t\t\tcontinue;\n\t\t\tif (!BUF_MEM_grow(nameB,i+9))\n\t\t\t\t{\n\t\t\t\tPEMerr(PEM_F_PEM_READ_BIO,ERR_R_MALLOC_FAILURE);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tmemcpy(nameB->data,&(buf[11]),i-6);\n\t\t\tnameB->data[i-6]=\'\\0\';\n\t\t\tbreak;\n\t\t\t}\n\t\t}\n\thl=0;\n\tif (!BUF_MEM_grow(headerB,256))\n\t\t{ PEMerr(PEM_F_PEM_READ_BIO,ERR_R_MALLOC_FAILURE); goto err; }\n\theaderB->data[0]=\'\\0\';\n\tfor (;;)\n\t\t{\n\t\ti=BIO_gets(bp,buf,254);\n\t\tif (i <= 0) break;\n\t\twhile ((i >= 0) && (buf[i] <= \' \')) i--;\n\t\tbuf[++i]=\'\\n\'; buf[++i]=\'\\0\';\n\t\tif (buf[0] == \'\\n\') break;\n\t\tif (!BUF_MEM_grow(headerB,hl+i+9))\n\t\t\t{ PEMerr(PEM_F_PEM_READ_BIO,ERR_R_MALLOC_FAILURE); goto err; }\n\t\tif (strncmp(buf,"-----END ",9) == 0)\n\t\t\t{\n\t\t\tnohead=1;\n\t\t\tbreak;\n\t\t\t}\n\t\tmemcpy(&(headerB->data[hl]),buf,i);\n\t\theaderB->data[hl+i]=\'\\0\';\n\t\thl+=i;\n\t\t}\n\tbl=0;\n\tif (!BUF_MEM_grow(dataB,1024))\n\t\t{ PEMerr(PEM_F_PEM_READ_BIO,ERR_R_MALLOC_FAILURE); goto err; }\n\tdataB->data[0]=\'\\0\';\n\tif (!nohead)\n\t\t{\n\t\tfor (;;)\n\t\t\t{\n\t\t\ti=BIO_gets(bp,buf,254);\n\t\t\tif (i <= 0) break;\n\t\t\twhile ((i >= 0) && (buf[i] <= \' \')) i--;\n\t\t\tbuf[++i]=\'\\n\'; buf[++i]=\'\\0\';\n\t\t\tif (i != 65) end=1;\n\t\t\tif (strncmp(buf,"-----END ",9) == 0)\n\t\t\t\tbreak;\n\t\t\tif (i > 65) break;\n\t\t\tif (!BUF_MEM_grow(dataB,i+bl+9))\n\t\t\t\t{\n\t\t\t\tPEMerr(PEM_F_PEM_READ_BIO,ERR_R_MALLOC_FAILURE);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tmemcpy(&(dataB->data[bl]),buf,i);\n\t\t\tdataB->data[bl+i]=\'\\0\';\n\t\t\tbl+=i;\n\t\t\tif (end)\n\t\t\t\t{\n\t\t\t\tbuf[0]=\'\\0\';\n\t\t\t\ti=BIO_gets(bp,buf,254);\n\t\t\t\tif (i <= 0) break;\n\t\t\t\twhile ((i >= 0) && (buf[i] <= \' \')) i--;\n\t\t\t\tbuf[++i]=\'\\n\'; buf[++i]=\'\\0\';\n\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\telse\n\t\t{\n\t\ttmpB=headerB;\n\t\theaderB=dataB;\n\t\tdataB=tmpB;\n\t\tbl=hl;\n\t\t}\n\ti=strlen(nameB->data);\n\tif (\t(strncmp(buf,"-----END ",9) != 0) ||\n\t\t(strncmp(nameB->data,&(buf[9]),i) != 0) ||\n\t\t(strncmp(&(buf[9+i]),"-----\\n",6) != 0))\n\t\t{\n\t\tPEMerr(PEM_F_PEM_READ_BIO,PEM_R_BAD_END_LINE);\n\t\tgoto err;\n\t\t}\n\tEVP_DecodeInit(&ctx);\n\ti=EVP_DecodeUpdate(&ctx,\n\t\t(unsigned char *)dataB->data,&bl,\n\t\t(unsigned char *)dataB->data,bl);\n\tif (i < 0)\n\t\t{\n\t\tPEMerr(PEM_F_PEM_READ_BIO,PEM_R_BAD_BASE64_DECODE);\n\t\tgoto err;\n\t\t}\n\ti=EVP_DecodeFinal(&ctx,(unsigned char *)&(dataB->data[bl]),&k);\n\tif (i < 0)\n\t\t{\n\t\tPEMerr(PEM_F_PEM_READ_BIO,PEM_R_BAD_BASE64_DECODE);\n\t\tgoto err;\n\t\t}\n\tbl+=k;\n\tif (bl == 0) goto err;\n\t*name=nameB->data;\n\t*header=headerB->data;\n\t*data=(unsigned char *)dataB->data;\n\t*len=bl;\n\tFree(nameB);\n\tFree(headerB);\n\tFree(dataB);\n\treturn(1);\nerr:\n\tBUF_MEM_free(nameB);\n\tBUF_MEM_free(headerB);\n\tBUF_MEM_free(dataB);\n\treturn(0);\n\t}', 'int PEM_get_EVP_CIPHER_INFO(char *header, EVP_CIPHER_INFO *cipher)\n\t{\n\tint o;\n\tconst EVP_CIPHER *enc=NULL;\n\tchar *p,c;\n\tcipher->cipher=NULL;\n\tif ((header == NULL) || (*header == \'\\0\') || (*header == \'\\n\'))\n\t\treturn(1);\n\tif (strncmp(header,"Proc-Type: ",11) != 0)\n\t\t{ PEMerr(PEM_F_PEM_GET_EVP_CIPHER_INFO,PEM_R_NOT_PROC_TYPE); return(0); }\n\theader+=11;\n\tif (*header != \'4\') return(0); header++;\n\tif (*header != \',\') return(0); header++;\n\tif (strncmp(header,"ENCRYPTED",9) != 0)\n\t\t{ PEMerr(PEM_F_PEM_GET_EVP_CIPHER_INFO,PEM_R_NOT_ENCRYPTED); return(0); }\n\tfor (; (*header != \'\\n\') && (*header != \'\\0\'); header++)\n\t\t;\n\tif (*header == \'\\0\')\n\t\t{ PEMerr(PEM_F_PEM_GET_EVP_CIPHER_INFO,PEM_R_SHORT_HEADER); return(0); }\n\theader++;\n\tif (strncmp(header,"DEK-Info: ",10) != 0)\n\t\t{ PEMerr(PEM_F_PEM_GET_EVP_CIPHER_INFO,PEM_R_NOT_DEK_INFO); return(0); }\n\theader+=10;\n\tp=header;\n\tfor (;;)\n\t\t{\n\t\tc= *header;\n#ifndef CHARSET_EBCDIC\n\t\tif (!(\t((c >= \'A\') && (c <= \'Z\')) || (c == \'-\') ||\n\t\t\t((c >= \'0\') && (c <= \'9\'))))\n\t\t\tbreak;\n#else\n\t\tif (!(\tisupper(c) || (c == \'-\') ||\n\t\t\tisdigit(c)))\n\t\t\tbreak;\n#endif\n\t\theader++;\n\t\t}\n\t*header=\'\\0\';\n\to=OBJ_sn2nid(p);\n\tcipher->cipher=enc=EVP_get_cipherbyname(p);\n\t*header=c;\n\theader++;\n\tif (enc == NULL)\n\t\t{\n\t\tPEMerr(PEM_F_PEM_GET_EVP_CIPHER_INFO,PEM_R_UNSUPPORTED_ENCRYPTION);\n\t\treturn(0);\n\t\t}\n\tif (!load_iv((unsigned char **)&header,&(cipher->iv[0]),8)) return(0);\n\treturn(1);\n\t}']