crypto/x509/x509_lu.c:623: error: BUFFER_OVERRUN_L3
  Offset: [11, +oo] (⇐ [10, +oo] + 1) Size: [8, +oo] by call to `x509_check_cert_time`.
Showing all 14 steps of the trace


crypto/x509/x509_lu.c:608:10: Call
606.       *issuer = NULL;
607.       xn = X509_get_issuer_name(x);
608.       ok = X509_STORE_get_by_subject(ctx, X509_LU_X509, xn, &obj);
                ^
609.       if (ok != X509_LU_X509) {
610.           if (ok == X509_LU_RETRY) {

crypto/x509/x509_lu.c:296:11: Call
  294.   
  295.       CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
  296.       tmp = X509_OBJECT_retrieve_by_subject(ctx->objs, type, name);
                   ^
  297.       CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
  298.   

crypto/x509/x509_lu.c:472:11: Call
    470.   {
    471.       int idx;
    472.       idx = X509_OBJECT_idx_by_subject(h, type, name);
                     ^
    473.       if (idx == -1)
    474.           return NULL;

crypto/x509/x509_lu.c:465:12: Call
      463.                                  X509_NAME *name)
      464.   {
      465.       return x509_object_idx_cnt(h, type, name, NULL);
                        ^
      466.   }
      467.   

crypto/x509/x509_lu.c:454:17: Call
        452.           for (tidx = idx + 1; tidx < sk_X509_OBJECT_num(h); tidx++) {
        453.               tobj = sk_X509_OBJECT_value(h, tidx);
        454.               if (x509_object_cmp(&tobj, &pstmp))
                               ^
        455.                   break;
        456.               (*pnmatch)++;

crypto/x509/x509_lu.c:158:1: Parameter `(*a)->data.x509->cert_info.subject->data`
          156.   }
          157.   
          158. > static int x509_object_cmp(const X509_OBJECT *const *a,
          159.                              const X509_OBJECT *const *b)
          160.   {

crypto/x509/x509_lu.c:623:13: Call
621.       /* If certificate matches all OK */
622.       if (ctx->check_issued(ctx, x, obj.data.x509)) {
623.           if (x509_check_cert_time(ctx, obj.data.x509, 1)) {
                   ^
624.               *issuer = obj.data.x509;
625.               return 1;

crypto/x509/x509_vfy.c:1488:1: Parameter `*x->cert_info.validity.notBefore->data`
  1486.   }
  1487.   
  1488. > int x509_check_cert_time(X509_STORE_CTX *ctx, X509 *x, int quiet)
  1489.   {
  1490.       time_t *ptime;

crypto/x509/x509_vfy.c:1500:9: Call
  1498.           ptime = NULL;
  1499.   
  1500.       i = X509_cmp_time(X509_get_notBefore(x), ptime);
                  ^
  1501.       if (i == 0) {
  1502.           if (quiet)

crypto/x509/x509_vfy.c:1644:1: <Length trace>
1642.   }
1643.   
1644. > int X509_cmp_time(const ASN1_TIME *ctm, time_t *cmp_time)
1645.   {
1646.       char *str;

crypto/x509/x509_vfy.c:1644:1: Parameter `*ctm->data`
    1642.   }
    1643.   
    1644. > int X509_cmp_time(const ASN1_TIME *ctm, time_t *cmp_time)
    1645.   {
    1646.       char *str;

crypto/x509/x509_vfy.c:1654:5: Assignment
    1652.       p = buff1;
    1653.       remaining = ctm->length;
    1654.       str = (char *)ctm->data;
                ^
    1655.       /*
    1656.        * Note that the following (historical) code allows much more slack in the

crypto/x509/x509_vfy.c:1669:9: Assignment
    1667.           memcpy(p, str, 10);
    1668.           p += 10;
    1669.           str += 10;
                    ^
    1670.           remaining -= 10;
    1671.       } else {

crypto/x509/x509_vfy.c:1725:13: Array access: Offset: [11, +oo] (⇐ [10, +oo] + 1) Size: [8, +oo] by call to `x509_check_cert_time` 
    1723.           if (remaining != 5)
    1724.               return 0;
    1725.           if (str[1] < '0' || str[1] > '9' || str[2] < '0' || str[2] > '9' ||
                        ^
    1726.               str[3] < '0' || str[3] > '9' || str[4] < '0' || str[4] > '9')
    1727.               return 0;

int X509_cmp_time(const ASN1_TIME *ctm, time_t *cmp_time)
{
    char *str;
    ASN1_TIME atm;
    long offset;
    char buff1[24], buff2[24], *p;
    int i, j, remaining;
    p = buff1;
    remaining = ctm->length;
    str = (char *)ctm->data;
    if (ctm->type == V_ASN1_UTCTIME) {
        int min_length = sizeof("YYMMDDHHMMZ") - 1;
        int max_length = sizeof("YYMMDDHHMMSS+hhmm") - 1;
        if (remaining < min_length || remaining > max_length)
            return 0;
        memcpy(p, str, 10);
        p += 10;
        str += 10;
        remaining -= 10;
    } else {
        int min_length = sizeof("YYYYMMDDHHMMZ") - 1;
        int max_length = sizeof("YYYYMMDDHHMMSS.fff+hhmm") - 1;
        if (remaining < min_length || remaining > max_length)
            return 0;
        memcpy(p, str, 12);
        p += 12;
        str += 12;
        remaining -= 12;
    }
    if ((*str == 'Z') || (*str == '-') || (*str == '+')) {
        *(p++) = '0';
        *(p++) = '0';
    } else {
        if (remaining < 2)
            return 0;
        *(p++) = *(str++);
        *(p++) = *(str++);
        remaining -= 2;
        if (remaining && *str == '.') {
            str++;
            remaining--;
            for (i = 0; i < 3 && remaining; i++, str++, remaining--) {
                if (*str < '0' || *str > '9')
                    break;
            }
        }
    }
    *(p++) = 'Z';
    *(p++) = '\0';
    if (!remaining)
        return 0;
    if (*str == 'Z') {
        if (remaining != 1)
            return 0;
        offset = 0;
    } else {
        if ((*str != '+') && (*str != '-'))
            return 0;
        if (remaining != 5)
            return 0;
        if (str[1] < '0' || str[1] > '9' || str[2] < '0' || str[2] > '9' ||
            str[3] < '0' || str[3] > '9' || str[4] < '0' || str[4] > '9')
            return 0;
        offset = ((str[1] - '0') * 10 + (str[2] - '0')) * 60;
        offset += (str[3] - '0') * 10 + (str[4] - '0');
        if (*str == '-')
            offset = -offset;
    }
    atm.type = ctm->type;
    atm.flags = 0;
    atm.length = sizeof(buff2);
    atm.data = (unsigned char *)buff2;
    if (X509_time_adj(&atm, offset * 60, cmp_time) == NULL)
        return 0;
    if (ctm->type == V_ASN1_UTCTIME) {
        i = (buff1[0] - '0') * 10 + (buff1[1] - '0');
        if (i < 50)
            i += 100;
        j = (buff2[0] - '0') * 10 + (buff2[1] - '0');
        if (j < 50)
            j += 100;
        if (i < j)
            return -1;
        if (i > j)
            return 1;
    }
    i = strcmp(buff1, buff2);
    if (i == 0)
        return -1;
    else
        return i;
}
['int X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)\n{\n    X509_NAME *xn;\n    X509_OBJECT obj, *pobj;\n    int i, ok, idx, ret;\n    *issuer = NULL;\n    xn = X509_get_issuer_name(x);\n    ok = X509_STORE_get_by_subject(ctx, X509_LU_X509, xn, &obj);\n    if (ok != X509_LU_X509) {\n        if (ok == X509_LU_RETRY) {\n            X509_OBJECT_free_contents(&obj);\n            X509err(X509_F_X509_STORE_CTX_GET1_ISSUER, X509_R_SHOULD_RETRY);\n            return -1;\n        } else if (ok != X509_LU_FAIL) {\n            X509_OBJECT_free_contents(&obj);\n            return -1;\n        }\n        return 0;\n    }\n    if (ctx->check_issued(ctx, x, obj.data.x509)) {\n        if (x509_check_cert_time(ctx, obj.data.x509, 1)) {\n            *issuer = obj.data.x509;\n            return 1;\n        }\n    }\n    X509_OBJECT_free_contents(&obj);\n    ret = 0;\n    CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);\n    idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);\n    if (idx != -1) {\n        for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++) {\n            pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);\n            if (pobj->type != X509_LU_X509)\n                break;\n            if (X509_NAME_cmp(xn, X509_get_subject_name(pobj->data.x509)))\n                break;\n            if (ctx->check_issued(ctx, x, pobj->data.x509)) {\n                *issuer = pobj->data.x509;\n                ret = 1;\n                if (x509_check_cert_time(ctx, *issuer, 1))\n                    break;\n            }\n        }\n    }\n    CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);\n    if (*issuer)\n        X509_up_ref(*issuer);\n    return ret;\n}', 'int X509_STORE_get_by_subject(X509_STORE_CTX *vs, X509_LOOKUP_TYPE type,\n                              X509_NAME *name, X509_OBJECT *ret)\n{\n    X509_STORE *ctx = vs->ctx;\n    X509_LOOKUP *lu;\n    X509_OBJECT stmp, *tmp;\n    int i, j;\n    CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);\n    tmp = X509_OBJECT_retrieve_by_subject(ctx->objs, type, name);\n    CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);\n    if (tmp == NULL || type == X509_LU_CRL) {\n        for (i = vs->current_method;\n             i < sk_X509_LOOKUP_num(ctx->get_cert_methods); i++) {\n            lu = sk_X509_LOOKUP_value(ctx->get_cert_methods, i);\n            j = X509_LOOKUP_by_subject(lu, type, name, &stmp);\n            if (j < 0) {\n                vs->current_method = j;\n                return j;\n            } else if (j) {\n                tmp = &stmp;\n                break;\n            }\n        }\n        vs->current_method = 0;\n        if (tmp == NULL)\n            return 0;\n    }\n    ret->type = tmp->type;\n    ret->data.ptr = tmp->data.ptr;\n    X509_OBJECT_up_ref_count(ret);\n    return 1;\n}', 'X509_OBJECT *X509_OBJECT_retrieve_by_subject(STACK_OF(X509_OBJECT) *h,\n                                             int type, X509_NAME *name)\n{\n    int idx;\n    idx = X509_OBJECT_idx_by_subject(h, type, name);\n    if (idx == -1)\n        return NULL;\n    return sk_X509_OBJECT_value(h, idx);\n}', 'int X509_OBJECT_idx_by_subject(STACK_OF(X509_OBJECT) *h, int type,\n                               X509_NAME *name)\n{\n    return x509_object_idx_cnt(h, type, name, NULL);\n}', 'static int x509_object_idx_cnt(STACK_OF(X509_OBJECT) *h, int type,\n                               X509_NAME *name, int *pnmatch)\n{\n    X509_OBJECT stmp;\n    X509 x509_s;\n    X509_CRL crl_s;\n    int idx;\n    stmp.type = type;\n    switch (type) {\n    case X509_LU_X509:\n        stmp.data.x509 = &x509_s;\n        x509_s.cert_info.subject = name;\n        break;\n    case X509_LU_CRL:\n        stmp.data.crl = &crl_s;\n        crl_s.crl.issuer = name;\n        break;\n    default:\n        return -1;\n    }\n    idx = sk_X509_OBJECT_find(h, &stmp);\n    if (idx >= 0 && pnmatch) {\n        int tidx;\n        const X509_OBJECT *tobj, *pstmp;\n        *pnmatch = 1;\n        pstmp = &stmp;\n        for (tidx = idx + 1; tidx < sk_X509_OBJECT_num(h); tidx++) {\n            tobj = sk_X509_OBJECT_value(h, tidx);\n            if (x509_object_cmp(&tobj, &pstmp))\n                break;\n            (*pnmatch)++;\n        }\n    }\n    return idx;\n}', 'static int x509_object_cmp(const X509_OBJECT *const *a,\n                           const X509_OBJECT *const *b)\n{\n    int ret;\n    ret = ((*a)->type - (*b)->type);\n    if (ret)\n        return ret;\n    switch ((*a)->type) {\n    case X509_LU_X509:\n        ret = X509_subject_name_cmp((*a)->data.x509, (*b)->data.x509);\n        break;\n    case X509_LU_CRL:\n        ret = X509_CRL_cmp((*a)->data.crl, (*b)->data.crl);\n        break;\n    default:\n        return 0;\n    }\n    return ret;\n}', 'int x509_check_cert_time(X509_STORE_CTX *ctx, X509 *x, int quiet)\n{\n    time_t *ptime;\n    int i;\n    if (ctx->param->flags & X509_V_FLAG_USE_CHECK_TIME)\n        ptime = &ctx->param->check_time;\n    else if (ctx->param->flags & X509_V_FLAG_NO_CHECK_TIME)\n        return 1;\n    else\n        ptime = NULL;\n    i = X509_cmp_time(X509_get_notBefore(x), ptime);\n    if (i == 0) {\n        if (quiet)\n            return 0;\n        ctx->error = X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD;\n        ctx->current_cert = x;\n        if (!ctx->verify_cb(0, ctx))\n            return 0;\n    }\n    if (i > 0) {\n        if (quiet)\n            return 0;\n        ctx->error = X509_V_ERR_CERT_NOT_YET_VALID;\n        ctx->current_cert = x;\n        if (!ctx->verify_cb(0, ctx))\n            return 0;\n    }\n    i = X509_cmp_time(X509_get_notAfter(x), ptime);\n    if (i == 0) {\n        if (quiet)\n            return 0;\n        ctx->error = X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD;\n        ctx->current_cert = x;\n        if (!ctx->verify_cb(0, ctx))\n            return 0;\n    }\n    if (i < 0) {\n        if (quiet)\n            return 0;\n        ctx->error = X509_V_ERR_CERT_HAS_EXPIRED;\n        ctx->current_cert = x;\n        if (!ctx->verify_cb(0, ctx))\n            return 0;\n    }\n    return 1;\n}', 'int X509_cmp_time(const ASN1_TIME *ctm, time_t *cmp_time)\n{\n    char *str;\n    ASN1_TIME atm;\n    long offset;\n    char buff1[24], buff2[24], *p;\n    int i, j, remaining;\n    p = buff1;\n    remaining = ctm->length;\n    str = (char *)ctm->data;\n    if (ctm->type == V_ASN1_UTCTIME) {\n        int min_length = sizeof("YYMMDDHHMMZ") - 1;\n        int max_length = sizeof("YYMMDDHHMMSS+hhmm") - 1;\n        if (remaining < min_length || remaining > max_length)\n            return 0;\n        memcpy(p, str, 10);\n        p += 10;\n        str += 10;\n        remaining -= 10;\n    } else {\n        int min_length = sizeof("YYYYMMDDHHMMZ") - 1;\n        int max_length = sizeof("YYYYMMDDHHMMSS.fff+hhmm") - 1;\n        if (remaining < min_length || remaining > max_length)\n            return 0;\n        memcpy(p, str, 12);\n        p += 12;\n        str += 12;\n        remaining -= 12;\n    }\n    if ((*str == \'Z\') || (*str == \'-\') || (*str == \'+\')) {\n        *(p++) = \'0\';\n        *(p++) = \'0\';\n    } else {\n        if (remaining < 2)\n            return 0;\n        *(p++) = *(str++);\n        *(p++) = *(str++);\n        remaining -= 2;\n        if (remaining && *str == \'.\') {\n            str++;\n            remaining--;\n            for (i = 0; i < 3 && remaining; i++, str++, remaining--) {\n                if (*str < \'0\' || *str > \'9\')\n                    break;\n            }\n        }\n    }\n    *(p++) = \'Z\';\n    *(p++) = \'\\0\';\n    if (!remaining)\n        return 0;\n    if (*str == \'Z\') {\n        if (remaining != 1)\n            return 0;\n        offset = 0;\n    } else {\n        if ((*str != \'+\') && (*str != \'-\'))\n            return 0;\n        if (remaining != 5)\n            return 0;\n        if (str[1] < \'0\' || str[1] > \'9\' || str[2] < \'0\' || str[2] > \'9\' ||\n            str[3] < \'0\' || str[3] > \'9\' || str[4] < \'0\' || str[4] > \'9\')\n            return 0;\n        offset = ((str[1] - \'0\') * 10 + (str[2] - \'0\')) * 60;\n        offset += (str[3] - \'0\') * 10 + (str[4] - \'0\');\n        if (*str == \'-\')\n            offset = -offset;\n    }\n    atm.type = ctm->type;\n    atm.flags = 0;\n    atm.length = sizeof(buff2);\n    atm.data = (unsigned char *)buff2;\n    if (X509_time_adj(&atm, offset * 60, cmp_time) == NULL)\n        return 0;\n    if (ctm->type == V_ASN1_UTCTIME) {\n        i = (buff1[0] - \'0\') * 10 + (buff1[1] - \'0\');\n        if (i < 50)\n            i += 100;\n        j = (buff2[0] - \'0\') * 10 + (buff2[1] - \'0\');\n        if (j < 50)\n            j += 100;\n        if (i < j)\n            return -1;\n        if (i > j)\n            return 1;\n    }\n    i = strcmp(buff1, buff2);\n    if (i == 0)\n        return -1;\n    else\n        return i;\n}']