crypto/pkcs7/pk7_doit.c:743: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] (⇐ [2, +oo] + [0, +oo]) Size: [0, +oo] by call to `i2d_ASN1_SET_OF_X509_ATTRIBUTE`.
Showing all 26 steps of the trace


crypto/pkcs7/pk7_doit.c:739:5: Call
737.   		 * This is done by using the IS_SEQUENCE flag.
738.   		 */
739.   		i=i2d_ASN1_SET_OF_X509_ATTRIBUTE(sk,NULL,i2d_X509_ATTRIBUTE,
           ^
740.   			V_ASN1_SET,V_ASN1_UNIVERSAL, IS_SEQUENCE);
741.   		pp=Malloc(i);

crypto/x509/x509_vfy.c:639:1: Call
  637.   
  638.   IMPLEMENT_STACK_OF(X509_ATTRIBUTE)
  639. > IMPLEMENT_ASN1_SET_OF(X509_ATTRIBUTE)

crypto/asn1/a_set.c:96:17: Assignment
    94.           int totSize;
    95.   
    96.   	if (a == NULL) return(0);
                          ^
    97.   	for (i=sk_num(a)-1; i>=0; i--)
    98.   		ret+=func(sk_value(a,i),NULL);

crypto/x509/x509_vfy.c:639:1: Assignment
  637.   
  638.   IMPLEMENT_STACK_OF(X509_ATTRIBUTE)
  639. > IMPLEMENT_ASN1_SET_OF(X509_ATTRIBUTE)

crypto/pkcs7/pk7_doit.c:739:3: Assignment
737.   		 * This is done by using the IS_SEQUENCE flag.
738.   		 */
739.   		i=i2d_ASN1_SET_OF_X509_ATTRIBUTE(sk,NULL,i2d_X509_ATTRIBUTE,
         ^
740.   			V_ASN1_SET,V_ASN1_UNIVERSAL, IS_SEQUENCE);
741.   		pp=Malloc(i);

crypto/pkcs7/pk7_doit.c:741:6: Array declaration
739.   		i=i2d_ASN1_SET_OF_X509_ATTRIBUTE(sk,NULL,i2d_X509_ATTRIBUTE,
740.   			V_ASN1_SET,V_ASN1_UNIVERSAL, IS_SEQUENCE);
741.   		pp=Malloc(i);
            ^
742.   		p=pp;
743.   		i2d_ASN1_SET_OF_X509_ATTRIBUTE(sk,&p,i2d_X509_ATTRIBUTE,

crypto/pkcs7/pk7_doit.c:741:3: Assignment
739.   		i=i2d_ASN1_SET_OF_X509_ATTRIBUTE(sk,NULL,i2d_X509_ATTRIBUTE,
740.   			V_ASN1_SET,V_ASN1_UNIVERSAL, IS_SEQUENCE);
741.   		pp=Malloc(i);
         ^
742.   		p=pp;
743.   		i2d_ASN1_SET_OF_X509_ATTRIBUTE(sk,&p,i2d_X509_ATTRIBUTE,

crypto/pkcs7/pk7_doit.c:742:3: Assignment
740.   			V_ASN1_SET,V_ASN1_UNIVERSAL, IS_SEQUENCE);
741.   		pp=Malloc(i);
742.   		p=pp;
         ^
743.   		i2d_ASN1_SET_OF_X509_ATTRIBUTE(sk,&p,i2d_X509_ATTRIBUTE,
744.   			V_ASN1_SET,V_ASN1_UNIVERSAL, IS_SEQUENCE);

crypto/pkcs7/pk7_doit.c:743:3: Call
741.   		pp=Malloc(i);
742.   		p=pp;
743.   		i2d_ASN1_SET_OF_X509_ATTRIBUTE(sk,&p,i2d_X509_ATTRIBUTE,
         ^
744.   			V_ASN1_SET,V_ASN1_UNIVERSAL, IS_SEQUENCE);
745.   		EVP_VerifyUpdate(&mdc_tmp,pp,i);

crypto/x509/x509_vfy.c:639:1: Parameter `**pp`
  637.   
  638.   IMPLEMENT_STACK_OF(X509_ATTRIBUTE)
  639. > IMPLEMENT_ASN1_SET_OF(X509_ATTRIBUTE)

crypto/x509/x509_vfy.c:639:1: Call
  637.   
  638.   IMPLEMENT_STACK_OF(X509_ATTRIBUTE)
  639. > IMPLEMENT_ASN1_SET_OF(X509_ATTRIBUTE)

crypto/asn1/a_set.c:86:1: Parameter `**pp`
    84.   
    85.   /* int is_set:  if TRUE, then sort the contents (i.e. it isn't a SEQUENCE)    */
    86. > int i2d_ASN1_SET(STACK *a, unsigned char **pp, int (*func)(), int ex_tag,
    87.   	     int ex_class, int is_set)
    88.   	{

crypto/asn1/a_set.c:102:2: Assignment
    100.   	if (pp == NULL) return(r);
    101.   
    102.   	p= *pp;
            ^
    103.   	ASN1_put_object(&p,1,ret,ex_tag,ex_class);
    104.   

crypto/asn1/a_set.c:103:2: Call
    101.   
    102.   	p= *pp;
    103.   	ASN1_put_object(&p,1,ret,ex_tag,ex_class);
            ^
    104.   
    105.   /* Modified by gp@nsj.co.jp */

crypto/asn1/asn1_lib.c:180:1: Parameter `**pp`
      178.   /* class 0 is constructed
      179.    * constructed == 2 for indefinitle length constructed */
      180. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
      181.   	     int xclass)
      182.   	{

crypto/asn1/asn1_lib.c:183:2: Assignment
      181.   	     int xclass)
      182.   	{
      183.   	unsigned char *p= *pp;
              ^
      184.   	int i;
      185.   

crypto/asn1/asn1_lib.c:189:5: Assignment
      187.   	i|=(xclass&V_ASN1_PRIVATE);
      188.   	if (tag < 31)
      189.   		*(p++)=i|(tag&V_ASN1_PRIMITIVE_TAG);
                 ^
      190.   	else
      191.   		{

crypto/asn1/asn1_lib.c:203:3: Call
      201.   		*(p++)=0x80; /* der_put_length would output 0 instead */
      202.   	else
      203.   		asn1_put_length(&p,length);
               ^
      204.   	*pp=p;
      205.   	}

crypto/asn1/asn1_lib.c:216:8: <Offset trace>
214.   		{
215.   		l=length;
216.   		for (i=0; l > 0; i++)
              ^
217.   			l>>=8;
218.   		*(p++)=i|0x80;

crypto/asn1/asn1_lib.c:216:8: Assignment
        214.   		{
        215.   		l=length;
        216.   		for (i=0; l > 0; i++)
                      ^
        217.   			l>>=8;
        218.   		*(p++)=i|0x80;

crypto/asn1/asn1_lib.c:220:10: Assignment
        218.   		*(p++)=i|0x80;
        219.   		l=i;
        220.   		while (i-- > 0)
                        ^
        221.   			{
        222.   			p[i]=length&0xff;

crypto/asn1/asn1_lib.c:207:1: <Length trace>
205.   	}
206.   
207. > static void asn1_put_length(unsigned char **pp, int length)
208.   	{
209.   	unsigned char *p= *pp;

crypto/asn1/asn1_lib.c:207:1: Parameter `**pp`
        205.   	}
        206.   
        207. > static void asn1_put_length(unsigned char **pp, int length)
        208.   	{
        209.   	unsigned char *p= *pp;

crypto/asn1/asn1_lib.c:209:2: Assignment
        207.   static void asn1_put_length(unsigned char **pp, int length)
        208.   	{
        209.   	unsigned char *p= *pp;
                ^
        210.   	int i,l;
        211.   	if (length <= 127)

crypto/asn1/asn1_lib.c:218:5: Assignment
        216.   		for (i=0; l > 0; i++)
        217.   			l>>=8;
        218.   		*(p++)=i|0x80;
                   ^
        219.   		l=i;
        220.   		while (i-- > 0)

crypto/asn1/asn1_lib.c:222:4: Array access: Offset: [2, +oo] (⇐ [2, +oo] + [0, +oo]) Size: [0, +oo] by call to `i2d_ASN1_SET_OF_X509_ATTRIBUTE` 
        220.   		while (i-- > 0)
        221.   			{
        222.   			p[i]=length&0xff;
                  ^
        223.   			length>>=8;
        224.   			}

static void asn1_put_length(unsigned char **pp, int length)
	{
	unsigned char *p= *pp;
	int i,l;
	if (length <= 127)
		*(p++)=(unsigned char)length;
	else
		{
		l=length;
		for (i=0; l > 0; i++)
			l>>=8;
		*(p++)=i|0x80;
		l=i;
		while (i-- > 0)
			{
			p[i]=length&0xff;
			length>>=8;
			}
		p+=l;
		}
	*pp=p;
	}
['int PKCS7_dataVerify(X509_STORE *cert_store, X509_STORE_CTX *ctx, BIO *bio,\n\t     PKCS7 *p7, PKCS7_SIGNER_INFO *si)\n\t{\n\tASN1_OCTET_STRING *os;\n\tEVP_MD_CTX mdc_tmp,*mdc;\n\tunsigned char *pp,*p;\n\tPKCS7_ISSUER_AND_SERIAL *ias;\n\tint ret=0,i;\n\tint md_type;\n\tSTACK_OF(X509_ATTRIBUTE) *sk;\n\tSTACK_OF(X509) *cert;\n\tBIO *btmp;\n\tX509 *x509;\n\tEVP_PKEY *pkey;\n\tif (PKCS7_type_is_signed(p7))\n\t\t{\n\t\tcert=p7->d.sign->cert;\n\t\t}\n\telse if (PKCS7_type_is_signedAndEnveloped(p7))\n\t\t{\n\t\tcert=p7->d.signed_and_enveloped->cert;\n\t\t}\n\telse\n\t\t{\n\t\tPKCS7err(PKCS7_F_PKCS7_DATAVERIFY,PKCS7_R_WRONG_PKCS7_TYPE);\n\t\tgoto err;\n\t\t}\n\tias=si->issuer_and_serial;\n\tx509=X509_find_by_issuer_and_serial(cert,ias->issuer,ias->serial);\n\tif (x509 == NULL)\n\t\t{\n\t\tPKCS7err(PKCS7_F_PKCS7_DATAVERIFY,PKCS7_R_UNABLE_TO_FIND_CERTIFICATE);\n\t\tgoto err;\n\t\t}\n\tX509_STORE_CTX_init(ctx,cert_store,x509,cert);\n\ti=X509_verify_cert(ctx);\n\tif (i <= 0)\n\t\t{\n\t\tPKCS7err(PKCS7_F_PKCS7_DATAVERIFY,ERR_R_X509_LIB);\n\t\tgoto err;\n\t\t}\n\tX509_STORE_CTX_cleanup(ctx);\n\tmd_type=OBJ_obj2nid(si->digest_alg->algorithm);\n\tbtmp=bio;\n\tfor (;;)\n\t\t{\n\t\tif ((btmp == NULL) ||\n\t\t\t((btmp=BIO_find_type(btmp,BIO_TYPE_MD)) == NULL))\n\t\t\t{\n\t\t\tPKCS7err(PKCS7_F_PKCS7_DATAVERIFY,PKCS7_R_UNABLE_TO_FIND_MESSAGE_DIGEST);\n\t\t\tgoto err;\n\t\t\t}\n\t\tBIO_get_md_ctx(btmp,&mdc);\n\t\tif (mdc == NULL)\n\t\t\t{\n\t\t\tPKCS7err(PKCS7_F_PKCS7_DATAVERIFY,PKCS7_R_INTERNAL_ERROR);\n\t\t\tgoto err;\n\t\t\t}\n\t\tif (EVP_MD_type(EVP_MD_CTX_type(mdc)) == md_type)\n\t\t\tbreak;\n\t\tbtmp=btmp->next_bio;\n\t\t}\n\tmemcpy(&mdc_tmp,mdc,sizeof(mdc_tmp));\n\tsk=si->auth_attr;\n\tif ((sk != NULL) && (sk_X509_ATTRIBUTE_num(sk) != 0))\n\t\t{\n\t\tunsigned char md_dat[EVP_MAX_MD_SIZE];\n                unsigned int md_len;\n\t\tASN1_OCTET_STRING *message_digest;\n\t\tEVP_DigestFinal(&mdc_tmp,md_dat,&md_len);\n\t\tmessage_digest=PKCS7_digest_from_attributes(sk);\n\t\tif (!message_digest)\n\t\t\t{\n\t\t\tPKCS7err(PKCS7_F_PKCS7_DATAVERIFY,PKCS7_R_UNABLE_TO_FIND_MESSAGE_DIGEST);\n\t\t\tgoto err;\n\t\t\t}\n\t\tif ((message_digest->length != (int)md_len) ||\n\t\t\t(memcmp(message_digest->data,md_dat,md_len)))\n\t\t\t{\n#if 0\n{\nint ii;\nfor (ii=0; ii<message_digest->length; ii++)\n\tprintf("%02X",message_digest->data[ii]); printf(" sent\\n");\nfor (ii=0; ii<md_len; ii++) printf("%02X",md_dat[ii]); printf(" calc\\n");\n}\n#endif\n\t\t\tPKCS7err(PKCS7_F_PKCS7_DATAVERIFY,PKCS7_R_DIGEST_FAILURE);\n\t\t\tret= -1;\n\t\t\tgoto err;\n\t\t\t}\n\t\tEVP_VerifyInit(&mdc_tmp,EVP_get_digestbynid(md_type));\n\t\ti=i2d_ASN1_SET_OF_X509_ATTRIBUTE(sk,NULL,i2d_X509_ATTRIBUTE,\n\t\t\tV_ASN1_SET,V_ASN1_UNIVERSAL, IS_SEQUENCE);\n\t\tpp=Malloc(i);\n\t\tp=pp;\n\t\ti2d_ASN1_SET_OF_X509_ATTRIBUTE(sk,&p,i2d_X509_ATTRIBUTE,\n\t\t\tV_ASN1_SET,V_ASN1_UNIVERSAL, IS_SEQUENCE);\n\t\tEVP_VerifyUpdate(&mdc_tmp,pp,i);\n\t\tFree(pp);\n\t\t}\n\tos=si->enc_digest;\n\tpkey = X509_get_pubkey(x509);\n\tif(pkey->type == EVP_PKEY_DSA) mdc_tmp.digest=EVP_dss1();\n\ti=EVP_VerifyFinal(&mdc_tmp,os->data,os->length, pkey);\n\tEVP_PKEY_free(pkey);\n\tif (i <= 0)\n\t\t{\n\t\tPKCS7err(PKCS7_F_PKCS7_DATAVERIFY,PKCS7_R_SIGNATURE_FAILURE);\n\t\tret= -1;\n\t\tgoto err;\n\t\t}\n\telse\n\t\tret=1;\nerr:\n\treturn(ret);\n\t}', 'IMPLEMENT_ASN1_SET_OF(X509_ATTRIBUTE)', 'int i2d_ASN1_SET(STACK *a, unsigned char **pp, int (*func)(), int ex_tag,\n\t     int ex_class, int is_set)\n\t{\n\tint ret=0,r;\n\tint i;\n\tunsigned char *p;\n        unsigned char *pStart, *pTempMem;\n        MYBLOB *rgSetBlob;\n        int totSize;\n\tif (a == NULL) return(0);\n\tfor (i=sk_num(a)-1; i>=0; i--)\n\t\tret+=func(sk_value(a,i),NULL);\n\tr=ASN1_object_size(1,ret,ex_tag);\n\tif (pp == NULL) return(r);\n\tp= *pp;\n\tASN1_put_object(&p,1,ret,ex_tag,ex_class);\n\tif(!is_set || (sk_num(a) < 2))\n\t\t{\n\t\tfor (i=0; i<sk_num(a); i++)\n                \tfunc(sk_value(a,i),&p);\n\t\t*pp=p;\n\t\treturn(r);\n\t\t}\n        pStart  = p;\n        rgSetBlob = (MYBLOB *)Malloc( sk_num(a) * sizeof(MYBLOB));\n        for (i=0; i<sk_num(a); i++)\n\t        {\n                rgSetBlob[i].pbData = p;\n                func(sk_value(a,i),&p);\n                rgSetBlob[i].cbData = p - rgSetBlob[i].pbData;\n\t\t}\n        *pp=p;\n        totSize = p - pStart;\n        qsort( rgSetBlob, sk_num(a), sizeof(MYBLOB), SetBlobCmp);\n        pTempMem = Malloc(totSize);\n        p = pTempMem;\n        for(i=0; i<sk_num(a); ++i)\n\t\t{\n                memcpy(p, rgSetBlob[i].pbData, rgSetBlob[i].cbData);\n                p += rgSetBlob[i].cbData;\n\t\t}\n        memcpy(pStart, pTempMem, totSize);\n        Free(pTempMem);\n        Free(rgSetBlob);\n        return(r);\n        }', 'void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,\n\t     int xclass)\n\t{\n\tunsigned char *p= *pp;\n\tint i;\n\ti=(constructed)?V_ASN1_CONSTRUCTED:0;\n\ti|=(xclass&V_ASN1_PRIVATE);\n\tif (tag < 31)\n\t\t*(p++)=i|(tag&V_ASN1_PRIMITIVE_TAG);\n\telse\n\t\t{\n\t\t*(p++)=i|V_ASN1_PRIMITIVE_TAG;\n\t\twhile (tag > 0x7f)\n\t\t\t{\n\t\t\t*(p++)=(tag&0x7f)|0x80;\n\t\t\ttag>>=7;\n\t\t\t}\n\t\t*(p++)=(tag&0x7f);\n\t\t}\n\tif ((constructed == 2) && (length == 0))\n\t\t*(p++)=0x80;\n\telse\n\t\tasn1_put_length(&p,length);\n\t*pp=p;\n\t}', 'static void asn1_put_length(unsigned char **pp, int length)\n\t{\n\tunsigned char *p= *pp;\n\tint i,l;\n\tif (length <= 127)\n\t\t*(p++)=(unsigned char)length;\n\telse\n\t\t{\n\t\tl=length;\n\t\tfor (i=0; l > 0; i++)\n\t\t\tl>>=8;\n\t\t*(p++)=i|0x80;\n\t\tl=i;\n\t\twhile (i-- > 0)\n\t\t\t{\n\t\t\tp[i]=length&0xff;\n\t\t\tlength>>=8;\n\t\t\t}\n\t\tp+=l;\n\t\t}\n\t*pp=p;\n\t}']