crypto/pem/pem_lib.c:594: error: BUFFER_OVERRUN_L1
  Offset added: -5 Size: [0, +oo].
Showing all 7 steps of the trace


crypto/pem/pem_lib.c:550:1: <Offset trace>
548.   #endif
549.   
550. > int PEM_read_bio(BIO *bp, char **name, char **header, unsigned char **data,
551.   	     long *len)
552.   	{

crypto/pem/pem_lib.c:550:1: Array declaration
548.   #endif
549.   
550. > int PEM_read_bio(BIO *bp, char **name, char **header, unsigned char **data,
551.   	     long *len)
552.   	{

crypto/pem/pem_lib.c:585:4: Assignment
583.   		if (strncmp(buf,"-----BEGIN ",11) == 0)
584.   			{
585.   			i=strlen(&(buf[11]));
          ^
586.   
587.   			if (strncmp(&(buf[11+i-6]),"-----\n",6) != 0)

crypto/pem/pem_lib.c:589:9: <Length trace>
587.   			if (strncmp(&(buf[11+i-6]),"-----\n",6) != 0)
588.   				continue;
589.   			if (!BUF_MEM_grow(nameB,i+9))
               ^
590.   				{
591.   				PEMerr(PEM_F_PEM_READ_BIO,ERR_R_MALLOC_FAILURE);

crypto/pem/pem_lib.c:589:9: Call
587.   			if (strncmp(&(buf[11+i-6]),"-----\n",6) != 0)
588.   				continue;
589.   			if (!BUF_MEM_grow(nameB,i+9))
               ^
590.   				{
591.   				PEMerr(PEM_F_PEM_READ_BIO,ERR_R_MALLOC_FAILURE);

crypto/buffer/buffer.c:92:1: Parameter `*str->data`
  90.   	}
  91.   
  92. > int BUF_MEM_grow(BUF_MEM *str, int len)
  93.   	{
  94.   	char *ret;

crypto/pem/pem_lib.c:594:4: Array access: Offset added: -5 Size: [0, +oo]
592.   				goto err;
593.   				}
594.   			strncpy(nameB->data,&(buf[11]),(unsigned int)i-6);
          ^
595.   			nameB->data[i-6]='\0';
596.   			break;

int PEM_read_bio(BIO *bp, char **name, char **header, unsigned char **data,
	     long *len)
	{
	EVP_ENCODE_CTX ctx;
	int end=0,i,k,bl=0,hl=0,nohead=0;
	char buf[256];
	BUF_MEM *nameB;
	BUF_MEM *headerB;
	BUF_MEM *dataB,*tmpB;
	nameB=BUF_MEM_new();
	headerB=BUF_MEM_new();
	dataB=BUF_MEM_new();
	if ((nameB == NULL) || (headerB == NULL) || (dataB == NULL))
		{
		PEMerr(PEM_F_PEM_READ_BIO,ERR_R_MALLOC_FAILURE);
		return(0);
		}
	buf[254]='\0';
	for (;;)
		{
		i=BIO_gets(bp,buf,254);
		if (i <= 0)
			{
			PEMerr(PEM_F_PEM_READ_BIO,PEM_R_NO_START_LINE);
			goto err;
			}
		while ((i >= 0) && (buf[i] <= ' ')) i--;
		buf[++i]='\n'; buf[++i]='\0';
		if (strncmp(buf,"-----BEGIN ",11) == 0)
			{
			i=strlen(&(buf[11]));
			if (strncmp(&(buf[11+i-6]),"-----\n",6) != 0)
				continue;
			if (!BUF_MEM_grow(nameB,i+9))
				{
				PEMerr(PEM_F_PEM_READ_BIO,ERR_R_MALLOC_FAILURE);
				goto err;
				}
			strncpy(nameB->data,&(buf[11]),(unsigned int)i-6);
			nameB->data[i-6]='\0';
			break;
			}
		}
	hl=0;
	if (!BUF_MEM_grow(headerB,256))
		{ PEMerr(PEM_F_PEM_READ_BIO,ERR_R_MALLOC_FAILURE); goto err; }
	headerB->data[0]='\0';
	for (;;)
		{
		i=BIO_gets(bp,buf,254);
		if (i <= 0) break;
		while ((i >= 0) && (buf[i] <= ' ')) i--;
		buf[++i]='\n'; buf[++i]='\0';
		if (buf[0] == '\n') break;
		if (!BUF_MEM_grow(headerB,hl+i+9))
			{ PEMerr(PEM_F_PEM_READ_BIO,ERR_R_MALLOC_FAILURE); goto err; }
		if (strncmp(buf,"-----END ",9) == 0)
			{
			nohead=1;
			break;
			}
		strncpy(&(headerB->data[hl]),buf,(unsigned int)i);
		headerB->data[hl+i]='\0';
		hl+=i;
		}
	bl=0;
	if (!BUF_MEM_grow(dataB,1024))
		{ PEMerr(PEM_F_PEM_READ_BIO,ERR_R_MALLOC_FAILURE); goto err; }
	dataB->data[0]='\0';
	if (!nohead)
		{
		for (;;)
			{
			i=BIO_gets(bp,buf,254);
			if (i <= 0) break;
			while ((i >= 0) && (buf[i] <= ' ')) i--;
			buf[++i]='\n'; buf[++i]='\0';
			if (i != 65) end=1;
			if (strncmp(buf,"-----END ",9) == 0)
				break;
			if (i > 65) break;
			if (!BUF_MEM_grow(dataB,i+bl+9))
				{
				PEMerr(PEM_F_PEM_READ_BIO,ERR_R_MALLOC_FAILURE);
				goto err;
				}
			strncpy(&(dataB->data[bl]),buf,(unsigned int)i);
			dataB->data[bl+i]='\0';
			bl+=i;
			if (end)
				{
				buf[0]='\0';
				i=BIO_gets(bp,buf,254);
				if (i <= 0) break;
				while ((i >= 0) && (buf[i] <= ' ')) i--;
				buf[++i]='\n'; buf[++i]='\0';
				break;
				}
			}
		}
	else
		{
		tmpB=headerB;
		headerB=dataB;
		dataB=tmpB;
		bl=hl;
		}
	i=strlen(nameB->data);
	if (	(strncmp(buf,"-----END ",9) != 0) ||
		(strncmp(nameB->data,&(buf[9]),(unsigned int)i) != 0) ||
		(strncmp(&(buf[9+i]),"-----\n",6) != 0))
		{
		PEMerr(PEM_F_PEM_READ_BIO,PEM_R_BAD_END_LINE);
		goto err;
		}
	EVP_DecodeInit(&ctx);
	i=EVP_DecodeUpdate(&ctx,
		(unsigned char *)dataB->data,&bl,
		(unsigned char *)dataB->data,bl);
	if (i < 0)
		{
		PEMerr(PEM_F_PEM_READ_BIO,PEM_R_BAD_BASE64_DECODE);
		goto err;
		}
	i=EVP_DecodeFinal(&ctx,(unsigned char *)&(dataB->data[bl]),&k);
	if (i < 0)
		{
		PEMerr(PEM_F_PEM_READ_BIO,PEM_R_BAD_BASE64_DECODE);
		goto err;
		}
	bl+=k;
	if (bl == 0) goto err;
	*name=nameB->data;
	*header=headerB->data;
	*data=(unsigned char *)dataB->data;
	*len=bl;
	Free(nameB);
	Free(headerB);
	Free(dataB);
	return(1);
err:
	BUF_MEM_free(nameB);
	BUF_MEM_free(headerB);
	BUF_MEM_free(dataB);
	return(0);
	}
['int PEM_read_bio(BIO *bp, char **name, char **header, unsigned char **data,\n\t     long *len)\n\t{\n\tEVP_ENCODE_CTX ctx;\n\tint end=0,i,k,bl=0,hl=0,nohead=0;\n\tchar buf[256];\n\tBUF_MEM *nameB;\n\tBUF_MEM *headerB;\n\tBUF_MEM *dataB,*tmpB;\n\tnameB=BUF_MEM_new();\n\theaderB=BUF_MEM_new();\n\tdataB=BUF_MEM_new();\n\tif ((nameB == NULL) || (headerB == NULL) || (dataB == NULL))\n\t\t{\n\t\tPEMerr(PEM_F_PEM_READ_BIO,ERR_R_MALLOC_FAILURE);\n\t\treturn(0);\n\t\t}\n\tbuf[254]=\'\\0\';\n\tfor (;;)\n\t\t{\n\t\ti=BIO_gets(bp,buf,254);\n\t\tif (i <= 0)\n\t\t\t{\n\t\t\tPEMerr(PEM_F_PEM_READ_BIO,PEM_R_NO_START_LINE);\n\t\t\tgoto err;\n\t\t\t}\n\t\twhile ((i >= 0) && (buf[i] <= \' \')) i--;\n\t\tbuf[++i]=\'\\n\'; buf[++i]=\'\\0\';\n\t\tif (strncmp(buf,"-----BEGIN ",11) == 0)\n\t\t\t{\n\t\t\ti=strlen(&(buf[11]));\n\t\t\tif (strncmp(&(buf[11+i-6]),"-----\\n",6) != 0)\n\t\t\t\tcontinue;\n\t\t\tif (!BUF_MEM_grow(nameB,i+9))\n\t\t\t\t{\n\t\t\t\tPEMerr(PEM_F_PEM_READ_BIO,ERR_R_MALLOC_FAILURE);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tstrncpy(nameB->data,&(buf[11]),(unsigned int)i-6);\n\t\t\tnameB->data[i-6]=\'\\0\';\n\t\t\tbreak;\n\t\t\t}\n\t\t}\n\thl=0;\n\tif (!BUF_MEM_grow(headerB,256))\n\t\t{ PEMerr(PEM_F_PEM_READ_BIO,ERR_R_MALLOC_FAILURE); goto err; }\n\theaderB->data[0]=\'\\0\';\n\tfor (;;)\n\t\t{\n\t\ti=BIO_gets(bp,buf,254);\n\t\tif (i <= 0) break;\n\t\twhile ((i >= 0) && (buf[i] <= \' \')) i--;\n\t\tbuf[++i]=\'\\n\'; buf[++i]=\'\\0\';\n\t\tif (buf[0] == \'\\n\') break;\n\t\tif (!BUF_MEM_grow(headerB,hl+i+9))\n\t\t\t{ PEMerr(PEM_F_PEM_READ_BIO,ERR_R_MALLOC_FAILURE); goto err; }\n\t\tif (strncmp(buf,"-----END ",9) == 0)\n\t\t\t{\n\t\t\tnohead=1;\n\t\t\tbreak;\n\t\t\t}\n\t\tstrncpy(&(headerB->data[hl]),buf,(unsigned int)i);\n\t\theaderB->data[hl+i]=\'\\0\';\n\t\thl+=i;\n\t\t}\n\tbl=0;\n\tif (!BUF_MEM_grow(dataB,1024))\n\t\t{ PEMerr(PEM_F_PEM_READ_BIO,ERR_R_MALLOC_FAILURE); goto err; }\n\tdataB->data[0]=\'\\0\';\n\tif (!nohead)\n\t\t{\n\t\tfor (;;)\n\t\t\t{\n\t\t\ti=BIO_gets(bp,buf,254);\n\t\t\tif (i <= 0) break;\n\t\t\twhile ((i >= 0) && (buf[i] <= \' \')) i--;\n\t\t\tbuf[++i]=\'\\n\'; buf[++i]=\'\\0\';\n\t\t\tif (i != 65) end=1;\n\t\t\tif (strncmp(buf,"-----END ",9) == 0)\n\t\t\t\tbreak;\n\t\t\tif (i > 65) break;\n\t\t\tif (!BUF_MEM_grow(dataB,i+bl+9))\n\t\t\t\t{\n\t\t\t\tPEMerr(PEM_F_PEM_READ_BIO,ERR_R_MALLOC_FAILURE);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tstrncpy(&(dataB->data[bl]),buf,(unsigned int)i);\n\t\t\tdataB->data[bl+i]=\'\\0\';\n\t\t\tbl+=i;\n\t\t\tif (end)\n\t\t\t\t{\n\t\t\t\tbuf[0]=\'\\0\';\n\t\t\t\ti=BIO_gets(bp,buf,254);\n\t\t\t\tif (i <= 0) break;\n\t\t\t\twhile ((i >= 0) && (buf[i] <= \' \')) i--;\n\t\t\t\tbuf[++i]=\'\\n\'; buf[++i]=\'\\0\';\n\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\telse\n\t\t{\n\t\ttmpB=headerB;\n\t\theaderB=dataB;\n\t\tdataB=tmpB;\n\t\tbl=hl;\n\t\t}\n\ti=strlen(nameB->data);\n\tif (\t(strncmp(buf,"-----END ",9) != 0) ||\n\t\t(strncmp(nameB->data,&(buf[9]),(unsigned int)i) != 0) ||\n\t\t(strncmp(&(buf[9+i]),"-----\\n",6) != 0))\n\t\t{\n\t\tPEMerr(PEM_F_PEM_READ_BIO,PEM_R_BAD_END_LINE);\n\t\tgoto err;\n\t\t}\n\tEVP_DecodeInit(&ctx);\n\ti=EVP_DecodeUpdate(&ctx,\n\t\t(unsigned char *)dataB->data,&bl,\n\t\t(unsigned char *)dataB->data,bl);\n\tif (i < 0)\n\t\t{\n\t\tPEMerr(PEM_F_PEM_READ_BIO,PEM_R_BAD_BASE64_DECODE);\n\t\tgoto err;\n\t\t}\n\ti=EVP_DecodeFinal(&ctx,(unsigned char *)&(dataB->data[bl]),&k);\n\tif (i < 0)\n\t\t{\n\t\tPEMerr(PEM_F_PEM_READ_BIO,PEM_R_BAD_BASE64_DECODE);\n\t\tgoto err;\n\t\t}\n\tbl+=k;\n\tif (bl == 0) goto err;\n\t*name=nameB->data;\n\t*header=headerB->data;\n\t*data=(unsigned char *)dataB->data;\n\t*len=bl;\n\tFree(nameB);\n\tFree(headerB);\n\tFree(dataB);\n\treturn(1);\nerr:\n\tBUF_MEM_free(nameB);\n\tBUF_MEM_free(headerB);\n\tBUF_MEM_free(dataB);\n\treturn(0);\n\t}', 'int BUF_MEM_grow(BUF_MEM *str, int len)\n\t{\n\tchar *ret;\n\tunsigned int n;\n\tif (str->length >= len)\n\t\t{\n\t\tstr->length=len;\n\t\treturn(len);\n\t\t}\n\tif (str->max >= len)\n\t\t{\n\t\tmemset(&(str->data[str->length]),0,len-str->length);\n\t\tstr->length=len;\n\t\treturn(len);\n\t\t}\n\tn=(len+3)/3*4;\n\tif (str->data == NULL)\n\t\tret=(char *)Malloc(n);\n\telse\n\t\tret=(char *)Realloc(str->data,n);\n\tif (ret == NULL)\n\t\t{\n\t\tBUFerr(BUF_F_BUF_MEM_GROW,ERR_R_MALLOC_FAILURE);\n\t\tlen=0;\n\t\t}\n\telse\n\t\t{\n\t\tstr->data=ret;\n\t\tstr->length=len;\n\t\tstr->max=n;\n\t\t}\n\treturn(len);\n\t}']