crypto/asn1/tasn_enc.c:293: error: INTEGER_OVERFLOW_L2
  ([2, 2147483646] + [0, 2147483644]):signed32 by call to `ASN1_object_size`.
Showing all 7 steps of the trace


crypto/asn1/tasn_enc.c:283:9: Assignment
281.   
282.           /* Determine total length of items */
283.           skcontlen = 0;
               ^
284.           for (i = 0; i < sk_ASN1_VALUE_num(sk); i++) {
285.               int tmplen;

crypto/asn1/tasn_enc.c:293:17: Call
291.               skcontlen += tmplen;
292.           }
293.           sklen = ASN1_object_size(ndef, skcontlen, sktag);
                       ^
294.           if (sklen == -1)
295.               return -1;

crypto/asn1/asn1_lib.c:207:1: <LHS trace>
205.   }
206.   
207. > int ASN1_object_size(int constructed, int length, int tag)
208.   {
209.       int ret = 1;

crypto/asn1/asn1_lib.c:207:1: Parameter `length`
  205.   }
  206.   
  207. > int ASN1_object_size(int constructed, int length, int tag)
  208.   {
  209.       int ret = 1;

crypto/asn1/asn1_lib.c:207:1: <RHS trace>
205.   }
206.   
207. > int ASN1_object_size(int constructed, int length, int tag)
208.   {
209.       int ret = 1;

crypto/asn1/asn1_lib.c:207:1: Parameter `length`
  205.   }
  206.   
  207. > int ASN1_object_size(int constructed, int length, int tag)
  208.   {
  209.       int ret = 1;

crypto/asn1/asn1_lib.c:232:5: Binary operation: ([2, 2147483646] + [0, 2147483644]):signed32 by call to `ASN1_object_size` 
  230.       if (ret >= INT_MAX - length)
  231.           return -1;
  232.       return ret + length;
             ^
  233.   }
  234.   

int ASN1_object_size(int constructed, int length, int tag)
{
    int ret = 1;
    if (length < 0)
        return -1;
    if (tag >= 31) {
        while (tag > 0) {
            tag >>= 7;
            ret++;
        }
    }
    if (constructed == 2) {
        ret += 3;
    } else {
        ret++;
        if (length > 127) {
            int tmplen = length;
            while (tmplen > 0) {
                tmplen >>= 8;
                ret++;
            }
        }
    }
    if (ret >= INT_MAX - length)
        return -1;
    return ret + length;
}
['static int asn1_template_ex_i2d(ASN1_VALUE **pval, unsigned char **out,\n                                const ASN1_TEMPLATE *tt, int tag, int iclass)\n{\n    int i, ret, flags, ttag, tclass, ndef;\n    ASN1_VALUE *tval;\n    flags = tt->flags;\n    if (flags & ASN1_TFLG_EMBED) {\n        tval = (ASN1_VALUE *)pval;\n        pval = &tval;\n    }\n    if (flags & ASN1_TFLG_TAG_MASK) {\n        if (tag != -1)\n            return -1;\n        ttag = tt->tag;\n        tclass = flags & ASN1_TFLG_TAG_CLASS;\n    } else if (tag != -1) {\n        ttag = tag;\n        tclass = iclass & ASN1_TFLG_TAG_CLASS;\n    } else {\n        ttag = -1;\n        tclass = 0;\n    }\n    iclass &= ~ASN1_TFLG_TAG_CLASS;\n    if ((flags & ASN1_TFLG_NDEF) && (iclass & ASN1_TFLG_NDEF))\n        ndef = 2;\n    else\n        ndef = 1;\n    if (flags & ASN1_TFLG_SK_MASK) {\n        STACK_OF(ASN1_VALUE) *sk = (STACK_OF(ASN1_VALUE) *)*pval;\n        int isset, sktag, skaclass;\n        int skcontlen, sklen;\n        ASN1_VALUE *skitem;\n        if (!*pval)\n            return 0;\n        if (flags & ASN1_TFLG_SET_OF) {\n            isset = 1;\n            if (flags & ASN1_TFLG_SEQUENCE_OF)\n                isset = 2;\n        } else\n            isset = 0;\n        if ((ttag != -1) && !(flags & ASN1_TFLG_EXPTAG)) {\n            sktag = ttag;\n            skaclass = tclass;\n        } else {\n            skaclass = V_ASN1_UNIVERSAL;\n            if (isset)\n                sktag = V_ASN1_SET;\n            else\n                sktag = V_ASN1_SEQUENCE;\n        }\n        skcontlen = 0;\n        for (i = 0; i < sk_ASN1_VALUE_num(sk); i++) {\n            int tmplen;\n            skitem = sk_ASN1_VALUE_value(sk, i);\n            tmplen = ASN1_item_ex_i2d(&skitem, NULL, ASN1_ITEM_ptr(tt->item),\n                                      -1, iclass);\n            if (tmplen == -1 || (skcontlen > INT_MAX - tmplen))\n                return -1;\n            skcontlen += tmplen;\n        }\n        sklen = ASN1_object_size(ndef, skcontlen, sktag);\n        if (sklen == -1)\n            return -1;\n        if (flags & ASN1_TFLG_EXPTAG)\n            ret = ASN1_object_size(ndef, sklen, ttag);\n        else\n            ret = sklen;\n        if (!out || ret == -1)\n            return ret;\n        if (flags & ASN1_TFLG_EXPTAG)\n            ASN1_put_object(out, ndef, sklen, ttag, tclass);\n        ASN1_put_object(out, ndef, skcontlen, sktag, skaclass);\n        asn1_set_seq_out(sk, out, skcontlen, ASN1_ITEM_ptr(tt->item),\n                         isset, iclass);\n        if (ndef == 2) {\n            ASN1_put_eoc(out);\n            if (flags & ASN1_TFLG_EXPTAG)\n                ASN1_put_eoc(out);\n        }\n        return ret;\n    }\n    if (flags & ASN1_TFLG_EXPTAG) {\n        i = ASN1_item_ex_i2d(pval, NULL, ASN1_ITEM_ptr(tt->item), -1, iclass);\n        if (!i)\n            return 0;\n        ret = ASN1_object_size(ndef, i, ttag);\n        if (out && ret != -1) {\n            ASN1_put_object(out, ndef, i, ttag, tclass);\n            ASN1_item_ex_i2d(pval, out, ASN1_ITEM_ptr(tt->item), -1, iclass);\n            if (ndef == 2)\n                ASN1_put_eoc(out);\n        }\n        return ret;\n    }\n    return ASN1_item_ex_i2d(pval, out, ASN1_ITEM_ptr(tt->item),\n                            ttag, tclass | iclass);\n}', 'int ASN1_object_size(int constructed, int length, int tag)\n{\n    int ret = 1;\n    if (length < 0)\n        return -1;\n    if (tag >= 31) {\n        while (tag > 0) {\n            tag >>= 7;\n            ret++;\n        }\n    }\n    if (constructed == 2) {\n        ret += 3;\n    } else {\n        ret++;\n        if (length > 127) {\n            int tmplen = length;\n            while (tmplen > 0) {\n                tmplen >>= 8;\n                ret++;\n            }\n        }\n    }\n    if (ret >= INT_MAX - length)\n        return -1;\n    return ret + length;\n}']