apps/ca.c:1404: error: BUFFER_OVERRUN_L3
  Offset: [-529, +oo] Size: 12 by call to `X509_print`.
Showing all 16 steps of the trace


apps/ca.c:1401:16: Call
1399.       int ok = -1, i;
1400.   
1401.       if ((req = load_cert(infile, FORMAT_PEM, NULL, e, infile)) == NULL)
                       ^
1402.           goto end;
1403.       if (verbose)

apps/apps.c:684:9: Call
  682.   
  683.       if (format == FORMAT_HTTP) {
  684.           load_cert_crl_http(file, &x, NULL);
                 ^
  685.           return x;
  686.       }

apps/apps.c:630:1: Parameter `**pcrl`
    628.   }
    629.   
    630. > int load_cert_crl_http(const char *url, X509 **pcert, X509_CRL **pcrl)
    631.   {
    632.       char *host = NULL, *port = NULL, *path = NULL;

apps/ca.c:1404:9: Call
1402.           goto end;
1403.       if (verbose)
1404.           X509_print(bio_err, req);
                ^
1405.   
1406.       BIO_printf(bio_err, "Check that the request matches the signature\n");

crypto/asn1/t_x509.c:100:1: Parameter `*x->cert_info.validity.notAfter->data`
  98.   #endif
  99.   
  100. > int X509_print(BIO *bp, X509 *x)
  101.   {
  102.       return X509_print_ex(bp, x, XN_FLAG_COMPAT, X509_FLAG_COMPAT);

crypto/asn1/t_x509.c:102:12: Call
  100.   int X509_print(BIO *bp, X509 *x)
  101.   {
  102.       return X509_print_ex(bp, x, XN_FLAG_COMPAT, X509_FLAG_COMPAT);
                    ^
  103.   }
  104.   

crypto/asn1/t_x509.c:105:1: Parameter `*x->cert_info.validity.notAfter->data`
    103.   }
    104.   
    105. > int X509_print_ex(BIO *bp, X509 *x, unsigned long nmflags,
    106.                     unsigned long cflag)
    107.   {

crypto/asn1/t_x509.c:195:14: Call
    193.           if (BIO_write(bp, "\n            Not After : ", 25) <= 0)
    194.               goto err;
    195.           if (!ASN1_TIME_print(bp, X509_get_notAfter(x)))
                        ^
    196.               goto err;
    197.           if (BIO_write(bp, "\n", 1) <= 0)

crypto/asn1/t_x509.c:388:1: Parameter `*tm->data`
      386.   }
      387.   
      388. > int ASN1_TIME_print(BIO *bp, const ASN1_TIME *tm)
      389.   {
      390.       if (tm->type == V_ASN1_UTCTIME)

crypto/asn1/t_x509.c:393:16: Call
      391.           return ASN1_UTCTIME_print(bp, tm);
      392.       if (tm->type == V_ASN1_GENERALIZEDTIME)
      393.           return ASN1_GENERALIZEDTIME_print(bp, tm);
                            ^
      394.       BIO_write(bp, "Bad time value", 14);
      395.       return (0);

crypto/asn1/t_x509.c:403:1: <Offset trace>
401.   };
402.   
403. > int ASN1_GENERALIZEDTIME_print(BIO *bp, const ASN1_GENERALIZEDTIME *tm)
404.   {
405.       char *v;

crypto/asn1/t_x509.c:403:1: Parameter `*tm->data`
        401.   };
        402.   
        403. > int ASN1_GENERALIZEDTIME_print(BIO *bp, const ASN1_GENERALIZEDTIME *tm)
        404.   {
        405.       char *v;

crypto/asn1/t_x509.c:424:5: Assignment
        422.       y = (v[0] - '0') * 1000 + (v[1] - '0') * 100
        423.           + (v[2] - '0') * 10 + (v[3] - '0');
        424.       M = (v[4] - '0') * 10 + (v[5] - '0');
                   ^
        425.       if ((M > 12) || (M < 1))
        426.           goto err;

crypto/asn1/t_x509.c:398:1: <Length trace>
396.   }
397.   
398. > static const char *mon[12] = {
399.       "Jan", "Feb", "Mar", "Apr", "May", "Jun",
400.       "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"

crypto/asn1/t_x509.c:398:1: Array declaration
        396.   }
        397.   
        398. > static const char *mon[12] = {
        399.       "Jan", "Feb", "Mar", "Apr", "May", "Jun",
        400.       "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"

crypto/asn1/t_x509.c:445:20: Array access: Offset: [-529, +oo] Size: 12 by call to `X509_print` 
        443.   
        444.       if (BIO_printf(bp, "%s %2d %02d:%02d:%02d%.*s %d%s",
        445.                      mon[M - 1], d, h, m, s, f_len, f, y,
                                  ^
        446.                      (gmt) ? " GMT" : "") <= 0)
        447.           return (0);

int ASN1_GENERALIZEDTIME_print(BIO *bp, const ASN1_GENERALIZEDTIME *tm)
{
    char *v;
    int gmt = 0;
    int i;
    int y = 0, M = 0, d = 0, h = 0, m = 0, s = 0;
    char *f = NULL;
    int f_len = 0;
    i = tm->length;
    v = (char *)tm->data;
    if (i < 12)
        goto err;
    if (v[i - 1] == 'Z')
        gmt = 1;
    for (i = 0; i < 12; i++)
        if ((v[i] > '9') || (v[i] < '0'))
            goto err;
    y = (v[0] - '0') * 1000 + (v[1] - '0') * 100
        + (v[2] - '0') * 10 + (v[3] - '0');
    M = (v[4] - '0') * 10 + (v[5] - '0');
    if ((M > 12) || (M < 1))
        goto err;
    d = (v[6] - '0') * 10 + (v[7] - '0');
    h = (v[8] - '0') * 10 + (v[9] - '0');
    m = (v[10] - '0') * 10 + (v[11] - '0');
    if (tm->length >= 14 &&
        (v[12] >= '0') && (v[12] <= '9') &&
        (v[13] >= '0') && (v[13] <= '9')) {
        s = (v[12] - '0') * 10 + (v[13] - '0');
        if (tm->length >= 15 && v[14] == '.') {
            int l = tm->length;
            f = &v[14];
            f_len = 1;
            while (14 + f_len < l && f[f_len] >= '0' && f[f_len] <= '9')
                ++f_len;
        }
    }
    if (BIO_printf(bp, "%s %2d %02d:%02d:%02d%.*s %d%s",
                   mon[M - 1], d, h, m, s, f_len, f, y,
                   (gmt) ? " GMT" : "") <= 0)
        return (0);
    else
        return (1);
 err:
    BIO_write(bp, "Bad time value", 14);
    return (0);
}
['static int certify_cert(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,\n                        const EVP_MD *dgst, STACK_OF(OPENSSL_STRING) *sigopts,\n                        STACK_OF(CONF_VALUE) *policy, CA_DB *db,\n                        BIGNUM *serial, char *subj, unsigned long chtype,\n                        int multirdn, int email_dn, char *startdate,\n                        char *enddate, long days, int batch, char *ext_sect,\n                        CONF *lconf, int verbose, unsigned long certopt,\n                        unsigned long nameopt, int default_op, int ext_copy,\n                        ENGINE *e)\n{\n    X509 *req = NULL;\n    X509_REQ *rreq = NULL;\n    EVP_PKEY *pktmp = NULL;\n    int ok = -1, i;\n    if ((req = load_cert(infile, FORMAT_PEM, NULL, e, infile)) == NULL)\n        goto end;\n    if (verbose)\n        X509_print(bio_err, req);\n    BIO_printf(bio_err, "Check that the request matches the signature\\n");\n    if ((pktmp = X509_get_pubkey(req)) == NULL) {\n        BIO_printf(bio_err, "error unpacking public key\\n");\n        goto end;\n    }\n    i = X509_verify(req, pktmp);\n    EVP_PKEY_free(pktmp);\n    if (i < 0) {\n        ok = 0;\n        BIO_printf(bio_err, "Signature verification problems....\\n");\n        goto end;\n    }\n    if (i == 0) {\n        ok = 0;\n        BIO_printf(bio_err, "Signature did not match the certificate\\n");\n        goto end;\n    } else\n        BIO_printf(bio_err, "Signature ok\\n");\n    if ((rreq = X509_to_X509_REQ(req, NULL, EVP_md5())) == NULL)\n        goto end;\n    ok = do_body(xret, pkey, x509, dgst, sigopts, policy, db, serial, subj,\n                 chtype, multirdn, email_dn, startdate, enddate, days, batch,\n                 verbose, rreq, ext_sect, lconf, certopt, nameopt, default_op,\n                 ext_copy, 0);\n end:\n    X509_REQ_free(rreq);\n    X509_free(req);\n    return (ok);\n}', 'X509 *load_cert(const char *file, int format,\n                const char *pass, ENGINE *e, const char *cert_descrip)\n{\n    X509 *x = NULL;\n    BIO *cert;\n    if (format == FORMAT_HTTP) {\n        load_cert_crl_http(file, &x, NULL);\n        return x;\n    }\n    if (file == NULL) {\n        unbuffer(stdin);\n        cert = dup_bio_in(format);\n    } else\n        cert = bio_open_default(file, \'r\', format);\n    if (cert == NULL)\n        goto end;\n    if (format == FORMAT_ASN1)\n        x = d2i_X509_bio(cert, NULL);\n    else if (format == FORMAT_PEM)\n        x = PEM_read_bio_X509_AUX(cert, NULL,\n                                  (pem_password_cb *)password_callback, NULL);\n    else if (format == FORMAT_PKCS12) {\n        if (!load_pkcs12(cert, cert_descrip, NULL, NULL, NULL, &x, NULL))\n            goto end;\n    } else {\n        BIO_printf(bio_err, "bad input format specified for %s\\n", cert_descrip);\n        goto end;\n    }\n end:\n    if (x == NULL) {\n        BIO_printf(bio_err, "unable to load certificate\\n");\n        ERR_print_errors(bio_err);\n    }\n    BIO_free(cert);\n    return (x);\n}', 'int load_cert_crl_http(const char *url, X509 **pcert, X509_CRL **pcrl)\n{\n    char *host = NULL, *port = NULL, *path = NULL;\n    BIO *bio = NULL;\n    OCSP_REQ_CTX *rctx = NULL;\n    int use_ssl, rv = 0;\n    if (!OCSP_parse_url(url, &host, &port, &path, &use_ssl))\n        goto err;\n    if (use_ssl) {\n        BIO_puts(bio_err, "https not supported\\n");\n        goto err;\n    }\n    bio = BIO_new_connect(host);\n    if (!bio || !BIO_set_conn_port(bio, port))\n        goto err;\n    rctx = OCSP_REQ_CTX_new(bio, 1024);\n    if (!rctx)\n        goto err;\n    if (!OCSP_REQ_CTX_http(rctx, "GET", path))\n        goto err;\n    if (!OCSP_REQ_CTX_add1_header(rctx, "Host", host))\n        goto err;\n    if (pcert) {\n        do {\n            rv = X509_http_nbio(rctx, pcert);\n        } while (rv == -1);\n    } else {\n        do {\n            rv = X509_CRL_http_nbio(rctx, pcrl);\n        } while (rv == -1);\n    }\n err:\n    OPENSSL_free(host);\n    OPENSSL_free(path);\n    OPENSSL_free(port);\n    if (bio)\n        BIO_free_all(bio);\n    OCSP_REQ_CTX_free(rctx);\n    if (rv != 1) {\n        BIO_printf(bio_err, "Error loading %s from %s\\n",\n                   pcert ? "certificate" : "CRL", url);\n        ERR_print_errors(bio_err);\n    }\n    return rv;\n}', 'int X509_print(BIO *bp, X509 *x)\n{\n    return X509_print_ex(bp, x, XN_FLAG_COMPAT, X509_FLAG_COMPAT);\n}', 'int X509_print_ex(BIO *bp, X509 *x, unsigned long nmflags,\n                  unsigned long cflag)\n{\n    long l;\n    int ret = 0, i;\n    char *m = NULL, mlch = \' \';\n    int nmindent = 0;\n    X509_CINF *ci;\n    ASN1_INTEGER *bs;\n    EVP_PKEY *pkey = NULL;\n    const char *neg;\n    if ((nmflags & XN_FLAG_SEP_MASK) == XN_FLAG_SEP_MULTILINE) {\n        mlch = \'\\n\';\n        nmindent = 12;\n    }\n    if (nmflags == X509_FLAG_COMPAT)\n        nmindent = 16;\n    ci = &x->cert_info;\n    if (!(cflag & X509_FLAG_NO_HEADER)) {\n        if (BIO_write(bp, "Certificate:\\n", 13) <= 0)\n            goto err;\n        if (BIO_write(bp, "    Data:\\n", 10) <= 0)\n            goto err;\n    }\n    if (!(cflag & X509_FLAG_NO_VERSION)) {\n        l = X509_get_version(x);\n        if (BIO_printf(bp, "%8sVersion: %lu (0x%lx)\\n", "", l + 1, l) <= 0)\n            goto err;\n    }\n    if (!(cflag & X509_FLAG_NO_SERIAL)) {\n        if (BIO_write(bp, "        Serial Number:", 22) <= 0)\n            goto err;\n        bs = X509_get_serialNumber(x);\n        if (bs->length <= (int)sizeof(long)) {\n                ERR_set_mark();\n                l = ASN1_INTEGER_get(bs);\n                ERR_pop_to_mark();\n        } else {\n            l = -1;\n        }\n        if (l != -1) {\n            if (bs->type == V_ASN1_NEG_INTEGER) {\n                l = -l;\n                neg = "-";\n            } else\n                neg = "";\n            if (BIO_printf(bp, " %s%lu (%s0x%lx)\\n", neg, l, neg, l) <= 0)\n                goto err;\n        } else {\n            neg = (bs->type == V_ASN1_NEG_INTEGER) ? " (Negative)" : "";\n            if (BIO_printf(bp, "\\n%12s%s", "", neg) <= 0)\n                goto err;\n            for (i = 0; i < bs->length; i++) {\n                if (BIO_printf(bp, "%02x%c", bs->data[i],\n                               ((i + 1 == bs->length) ? \'\\n\' : \':\')) <= 0)\n                    goto err;\n            }\n        }\n    }\n    if (!(cflag & X509_FLAG_NO_SIGNAME)) {\n        if (X509_signature_print(bp, ci->signature, NULL) <= 0)\n            goto err;\n    }\n    if (!(cflag & X509_FLAG_NO_ISSUER)) {\n        if (BIO_printf(bp, "        Issuer:%c", mlch) <= 0)\n            goto err;\n        if (X509_NAME_print_ex(bp, X509_get_issuer_name(x), nmindent, nmflags)\n            < 0)\n            goto err;\n        if (BIO_write(bp, "\\n", 1) <= 0)\n            goto err;\n    }\n    if (!(cflag & X509_FLAG_NO_VALIDITY)) {\n        if (BIO_write(bp, "        Validity\\n", 17) <= 0)\n            goto err;\n        if (BIO_write(bp, "            Not Before: ", 24) <= 0)\n            goto err;\n        if (!ASN1_TIME_print(bp, X509_get_notBefore(x)))\n            goto err;\n        if (BIO_write(bp, "\\n            Not After : ", 25) <= 0)\n            goto err;\n        if (!ASN1_TIME_print(bp, X509_get_notAfter(x)))\n            goto err;\n        if (BIO_write(bp, "\\n", 1) <= 0)\n            goto err;\n    }\n    if (!(cflag & X509_FLAG_NO_SUBJECT)) {\n        if (BIO_printf(bp, "        Subject:%c", mlch) <= 0)\n            goto err;\n        if (X509_NAME_print_ex\n            (bp, X509_get_subject_name(x), nmindent, nmflags) < 0)\n            goto err;\n        if (BIO_write(bp, "\\n", 1) <= 0)\n            goto err;\n    }\n    if (!(cflag & X509_FLAG_NO_PUBKEY)) {\n        if (BIO_write(bp, "        Subject Public Key Info:\\n", 33) <= 0)\n            goto err;\n        if (BIO_printf(bp, "%12sPublic Key Algorithm: ", "") <= 0)\n            goto err;\n        if (i2a_ASN1_OBJECT(bp, ci->key->algor->algorithm) <= 0)\n            goto err;\n        if (BIO_puts(bp, "\\n") <= 0)\n            goto err;\n        pkey = X509_get_pubkey(x);\n        if (pkey == NULL) {\n            BIO_printf(bp, "%12sUnable to load Public Key\\n", "");\n            ERR_print_errors(bp);\n        } else {\n            EVP_PKEY_print_public(bp, pkey, 16, NULL);\n            EVP_PKEY_free(pkey);\n        }\n    }\n    if (!(cflag & X509_FLAG_NO_IDS)) {\n        if (ci->issuerUID) {\n            if (BIO_printf(bp, "%8sIssuer Unique ID: ", "") <= 0)\n                goto err;\n            if (!X509_signature_dump(bp, ci->issuerUID, 12))\n                goto err;\n        }\n        if (ci->subjectUID) {\n            if (BIO_printf(bp, "%8sSubject Unique ID: ", "") <= 0)\n                goto err;\n            if (!X509_signature_dump(bp, ci->subjectUID, 12))\n                goto err;\n        }\n    }\n    if (!(cflag & X509_FLAG_NO_EXTENSIONS))\n        X509V3_extensions_print(bp, "X509v3 extensions",\n                                ci->extensions, cflag, 8);\n    if (!(cflag & X509_FLAG_NO_SIGDUMP)) {\n        if (X509_signature_print(bp, x->sig_alg, x->signature) <= 0)\n            goto err;\n    }\n    if (!(cflag & X509_FLAG_NO_AUX)) {\n        if (!X509_CERT_AUX_print(bp, x->aux, 0))\n            goto err;\n    }\n    ret = 1;\n err:\n    OPENSSL_free(m);\n    return (ret);\n}', 'int ASN1_TIME_print(BIO *bp, const ASN1_TIME *tm)\n{\n    if (tm->type == V_ASN1_UTCTIME)\n        return ASN1_UTCTIME_print(bp, tm);\n    if (tm->type == V_ASN1_GENERALIZEDTIME)\n        return ASN1_GENERALIZEDTIME_print(bp, tm);\n    BIO_write(bp, "Bad time value", 14);\n    return (0);\n}', 'int ASN1_GENERALIZEDTIME_print(BIO *bp, const ASN1_GENERALIZEDTIME *tm)\n{\n    char *v;\n    int gmt = 0;\n    int i;\n    int y = 0, M = 0, d = 0, h = 0, m = 0, s = 0;\n    char *f = NULL;\n    int f_len = 0;\n    i = tm->length;\n    v = (char *)tm->data;\n    if (i < 12)\n        goto err;\n    if (v[i - 1] == \'Z\')\n        gmt = 1;\n    for (i = 0; i < 12; i++)\n        if ((v[i] > \'9\') || (v[i] < \'0\'))\n            goto err;\n    y = (v[0] - \'0\') * 1000 + (v[1] - \'0\') * 100\n        + (v[2] - \'0\') * 10 + (v[3] - \'0\');\n    M = (v[4] - \'0\') * 10 + (v[5] - \'0\');\n    if ((M > 12) || (M < 1))\n        goto err;\n    d = (v[6] - \'0\') * 10 + (v[7] - \'0\');\n    h = (v[8] - \'0\') * 10 + (v[9] - \'0\');\n    m = (v[10] - \'0\') * 10 + (v[11] - \'0\');\n    if (tm->length >= 14 &&\n        (v[12] >= \'0\') && (v[12] <= \'9\') &&\n        (v[13] >= \'0\') && (v[13] <= \'9\')) {\n        s = (v[12] - \'0\') * 10 + (v[13] - \'0\');\n        if (tm->length >= 15 && v[14] == \'.\') {\n            int l = tm->length;\n            f = &v[14];\n            f_len = 1;\n            while (14 + f_len < l && f[f_len] >= \'0\' && f[f_len] <= \'9\')\n                ++f_len;\n        }\n    }\n    if (BIO_printf(bp, "%s %2d %02d:%02d:%02d%.*s %d%s",\n                   mon[M - 1], d, h, m, s, f_len, f, y,\n                   (gmt) ? " GMT" : "") <= 0)\n        return (0);\n    else\n        return (1);\n err:\n    BIO_write(bp, "Bad time value", 14);\n    return (0);\n}']