crypto/evp/evp_pkey.c:181: error: BUFFER_OVERRUN_L1
  Offset added: 80 Size: 32 by call to `i2t_ASN1_OBJECT`.
Showing all 6 steps of the trace


crypto/evp/evp_pkey.c:181:8: Call
179.   		EVPerr(EVP_F_EVP_PKCS82PKEY, EVP_R_UNSUPPORTED_PRIVATE_KEY_ALGORITHM);
180.   		if (!a->algorithm) strcpy (obj_tmp, "NULL");
181.   		else i2t_ASN1_OBJECT(obj_tmp, 80, a->algorithm);
              ^
182.   		ERR_add_error_data(2, "TYPE=", obj_tmp);
183.   		EVP_PKEY_free (pkey);

crypto/asn1/a_object.c:178:1: <Offset trace>
176.   	}
177.   
178. > int i2t_ASN1_OBJECT(char *buf, int buf_len, ASN1_OBJECT *a)
179.   	{
180.   	int i,idx=0,n=0,len,nid;

crypto/asn1/a_object.c:178:1: Parameter `buf_len`
  176.   	}
  177.   
  178. > int i2t_ASN1_OBJECT(char *buf, int buf_len, ASN1_OBJECT *a)
  179.   	{
  180.   	int i,idx=0,n=0,len,nid;

crypto/asn1/a_object.c:178:1: <Length trace>
176.   	}
177.   
178. > int i2t_ASN1_OBJECT(char *buf, int buf_len, ASN1_OBJECT *a)
179.   	{
180.   	int i,idx=0,n=0,len,nid;

crypto/asn1/a_object.c:178:1: Array declaration
  176.   	}
  177.   
  178. > int i2t_ASN1_OBJECT(char *buf, int buf_len, ASN1_OBJECT *a)
  179.   	{
  180.   	int i,idx=0,n=0,len,nid;

crypto/asn1/a_object.c:216:3: Array access: Offset added: 80 Size: 32 by call to `i2t_ASN1_OBJECT` 
  214.   		sprintf(tbuf,"%d.%ld",i,l);
  215.   		i=strlen(tbuf);
  216.   		strncpy(buf,tbuf,buf_len);
           ^
  217.   		buf_len-=i;
  218.   		buf+=i;

int i2t_ASN1_OBJECT(char *buf, int buf_len, ASN1_OBJECT *a)
	{
	int i,idx=0,n=0,len,nid;
	unsigned long l;
	unsigned char *p;
	const char *s;
	char tbuf[32];
	if (buf_len <= 0) return(0);
	if ((a == NULL) || (a->data == NULL))
		{
		buf[0]='\0';
		return(0);
		}
	nid=OBJ_obj2nid(a);
	if (nid == NID_undef)
		{
		len=a->length;
		p=a->data;
		idx=0;
		l=0;
		while (idx < a->length)
			{
			l|=(p[idx]&0x7f);
			if (!(p[idx] & 0x80)) break;
			l<<=7L;
			idx++;
			}
		idx++;
		i=(int)(l/40);
		if (i > 2) i=2;
		l-=(long)(i*40);
		sprintf(tbuf,"%d.%ld",i,l);
		i=strlen(tbuf);
		strncpy(buf,tbuf,buf_len);
		buf_len-=i;
		buf+=i;
		n+=i;
		l=0;
		for (; idx<len; idx++)
			{
			l|=p[idx]&0x7f;
			if (!(p[idx] & 0x80))
				{
				sprintf(tbuf,".%ld",l);
				i=strlen(tbuf);
				if (buf_len > 0)
					strncpy(buf,tbuf,buf_len);
				buf_len-=i;
				buf+=i;
				n+=i;
				l=0;
				}
			l<<=7L;
			}
		}
	else
		{
		s=OBJ_nid2ln(nid);
		if (s == NULL)
			s=OBJ_nid2sn(nid);
		strncpy(buf,s,buf_len);
		n=strlen(s);
		}
	buf[buf_len-1]='\0';
	return(n);
	}
['EVP_PKEY *EVP_PKCS82PKEY (PKCS8_PRIV_KEY_INFO *p8)\n{\n\tEVP_PKEY *pkey;\n\tRSA *rsa;\n\tDSA *dsa;\n\tASN1_INTEGER *dsapriv;\n\tX509_ALGOR *a;\n\tSTACK *ndsa;\n\tBN_CTX *ctx;\n\tunsigned char *p;\n\tint plen, pkeylen;\n\tchar obj_tmp[80];\n\tswitch (p8->broken) {\n\t\tcase PKCS8_OK:\n\t\tp = p8->pkey->value.octet_string->data;\n\t\tpkeylen = p8->pkey->value.octet_string->length;\n\t\tbreak;\n\t\tcase PKCS8_NO_OCTET:\n\t\tp = p8->pkey->value.sequence->data;\n\t\tpkeylen = p8->pkey->value.sequence->length;\n\t\tbreak;\n\t\tdefault:\n\t\tEVPerr(EVP_F_EVP_PKCS82PKEY,EVP_R_PKCS8_UNKNOWN_BROKEN_TYPE);\n\t\treturn NULL;\n\t\tbreak;\n\t}\n\tif (!(pkey = EVP_PKEY_new())) {\n\t\tEVPerr(EVP_F_EVP_PKCS82PKEY,ERR_R_MALLOC_FAILURE);\n\t\treturn NULL;\n\t}\n\ta = p8->pkeyalg;\n\tswitch (OBJ_obj2nid(a->algorithm))\n\t{\n\t\tcase NID_rsaEncryption:\n\t\tif (!(rsa = d2i_RSAPrivateKey (NULL, &p, pkeylen))) {\n\t\t\tEVPerr(EVP_F_EVP_PKCS82PKEY, EVP_R_DECODE_ERROR);\n\t\t\treturn NULL;\n\t\t}\n\t\tEVP_PKEY_assign_RSA (pkey, rsa);\n\t\tbreak;\n\t\tcase NID_dsa:\n\t\tif(*p == (V_ASN1_SEQUENCE|V_ASN1_CONSTRUCTED)) {\n\t\t    if(!(ndsa = ASN1_seq_unpack(p, pkeylen,\n\t\t\t\t\t(char *(*)())d2i_ASN1_INTEGER,\n\t\t\t\t\t\t\t ASN1_STRING_free))) {\n\t\t\tEVPerr(EVP_F_EVP_PKCS82PKEY, EVP_R_DECODE_ERROR);\n\t\t\treturn NULL;\n\t\t    }\n\t\t    if(sk_num(ndsa) != 2 ) {\n\t\t\tEVPerr(EVP_F_EVP_PKCS82PKEY, EVP_R_DECODE_ERROR);\n\t\t\tsk_pop_free(ndsa, ASN1_STRING_free);\n\t\t\treturn NULL;\n\t\t    }\n\t\t    dsapriv = (ASN1_INTEGER *) sk_pop(ndsa);\n\t\t    sk_pop_free(ndsa, ASN1_STRING_free);\n\t\t} else if (!(dsapriv=d2i_ASN1_INTEGER (NULL, &p, pkeylen))) {\n\t\t\tEVPerr(EVP_F_EVP_PKCS82PKEY, EVP_R_DECODE_ERROR);\n\t\t\treturn NULL;\n\t\t}\n\t\tif (a->parameter->type != V_ASN1_SEQUENCE) {\n\t\t\tEVPerr(EVP_F_EVP_PKCS82PKEY, EVP_R_NO_DSA_PARAMETERS);\n\t\t\treturn NULL;\n\t\t}\n\t\tp = a->parameter->value.sequence->data;\n\t\tplen = a->parameter->value.sequence->length;\n\t\tif (!(dsa = d2i_DSAparams (NULL, &p, plen))) {\n\t\t\tEVPerr(EVP_F_EVP_PKCS82PKEY, EVP_R_DECODE_ERROR);\n\t\t\treturn NULL;\n\t\t}\n\t\tif (!(dsa->priv_key = ASN1_INTEGER_to_BN(dsapriv, NULL))) {\n\t\t\tEVPerr(EVP_F_EVP_PKCS82PKEY,EVP_R_BN_DECODE_ERROR);\n\t\t\tDSA_free (dsa);\n\t\t\treturn NULL;\n\t\t}\n\t\tif (!(dsa->pub_key = BN_new())) {\n\t\t\tEVPerr(EVP_F_EVP_PKCS82PKEY,ERR_R_MALLOC_FAILURE);\n\t\t\tDSA_free (dsa);\n\t\t\treturn NULL;\n\t\t}\n\t\tif (!(ctx = BN_CTX_new())) {\n\t\t\tEVPerr(EVP_F_EVP_PKCS82PKEY,ERR_R_MALLOC_FAILURE);\n\t\t\tDSA_free (dsa);\n\t\t\treturn NULL;\n\t\t}\n\t\tif (!BN_mod_exp(dsa->pub_key, dsa->g,\n\t\t\t\t\t\t dsa->priv_key, dsa->p, ctx)) {\n\t\t\tEVPerr(EVP_F_EVP_PKCS82PKEY,EVP_R_BN_PUBKEY_ERROR);\n\t\t\tBN_CTX_free (ctx);\n\t\t\tDSA_free (dsa);\n\t\t\treturn NULL;\n\t\t}\n\t\tEVP_PKEY_assign_DSA (pkey, dsa);\n\t\tBN_CTX_free (ctx);\n\t\tbreak;\n\t\tdefault:\n\t\tEVPerr(EVP_F_EVP_PKCS82PKEY, EVP_R_UNSUPPORTED_PRIVATE_KEY_ALGORITHM);\n\t\tif (!a->algorithm) strcpy (obj_tmp, "NULL");\n\t\telse i2t_ASN1_OBJECT(obj_tmp, 80, a->algorithm);\n\t\tERR_add_error_data(2, "TYPE=", obj_tmp);\n\t\tEVP_PKEY_free (pkey);\n\t\treturn NULL;\n\t}\n\treturn pkey;\n}', 'int i2t_ASN1_OBJECT(char *buf, int buf_len, ASN1_OBJECT *a)\n\t{\n\tint i,idx=0,n=0,len,nid;\n\tunsigned long l;\n\tunsigned char *p;\n\tconst char *s;\n\tchar tbuf[32];\n\tif (buf_len <= 0) return(0);\n\tif ((a == NULL) || (a->data == NULL))\n\t\t{\n\t\tbuf[0]=\'\\0\';\n\t\treturn(0);\n\t\t}\n\tnid=OBJ_obj2nid(a);\n\tif (nid == NID_undef)\n\t\t{\n\t\tlen=a->length;\n\t\tp=a->data;\n\t\tidx=0;\n\t\tl=0;\n\t\twhile (idx < a->length)\n\t\t\t{\n\t\t\tl|=(p[idx]&0x7f);\n\t\t\tif (!(p[idx] & 0x80)) break;\n\t\t\tl<<=7L;\n\t\t\tidx++;\n\t\t\t}\n\t\tidx++;\n\t\ti=(int)(l/40);\n\t\tif (i > 2) i=2;\n\t\tl-=(long)(i*40);\n\t\tsprintf(tbuf,"%d.%ld",i,l);\n\t\ti=strlen(tbuf);\n\t\tstrncpy(buf,tbuf,buf_len);\n\t\tbuf_len-=i;\n\t\tbuf+=i;\n\t\tn+=i;\n\t\tl=0;\n\t\tfor (; idx<len; idx++)\n\t\t\t{\n\t\t\tl|=p[idx]&0x7f;\n\t\t\tif (!(p[idx] & 0x80))\n\t\t\t\t{\n\t\t\t\tsprintf(tbuf,".%ld",l);\n\t\t\t\ti=strlen(tbuf);\n\t\t\t\tif (buf_len > 0)\n\t\t\t\t\tstrncpy(buf,tbuf,buf_len);\n\t\t\t\tbuf_len-=i;\n\t\t\t\tbuf+=i;\n\t\t\t\tn+=i;\n\t\t\t\tl=0;\n\t\t\t\t}\n\t\t\tl<<=7L;\n\t\t\t}\n\t\t}\n\telse\n\t\t{\n\t\ts=OBJ_nid2ln(nid);\n\t\tif (s == NULL)\n\t\t\ts=OBJ_nid2sn(nid);\n\t\tstrncpy(buf,s,buf_len);\n\t\tn=strlen(s);\n\t\t}\n\tbuf[buf_len-1]=\'\\0\';\n\treturn(n);\n\t}']