crypto/x509/x509_vfy.c:472: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, +oo] by call to `X509_get_pubkey`.
Showing all 21 steps of the trace


crypto/x509/x509_vfy.c:472:8: Call
470.   	for (i=0; i<sk_num(chain); i++)
471.   		{
472.   		ktmp=X509_get_pubkey((X509 *)sk_value(chain,i));
              ^
473.   		if (ktmp == NULL)
474.   			{

crypto/x509/x509_cmp.c:241:9: Call
  239.   	if ((x == NULL) || (x->cert_info == NULL))
  240.   		return(NULL);
  241.   	return(X509_PUBKEY_get(x->cert_info->key));
                 ^
  242.   	}
  243.   

crypto/asn1/x_pubkey.c:239:9: Call
    237.   			p=a->parameter->value.sequence->data;
    238.   			j=a->parameter->value.sequence->length;
    239.   			if (!d2i_DSAparams(&ret->pkey.dsa,&p,(long)j))
                   ^
    240.   				goto err;
    241.   			}

crypto/asn1/d2i_dsap.c:75:2: Call
      73.   	M_ASN1_D2I_Init();
      74.   	M_ASN1_D2I_start_sequence();
      75.   	M_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);
             ^
      76.   	if ((ret->p=BN_bin2bn(bs->data,bs->length,ret->p)) == NULL) goto err_bn;
      77.   	M_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);

crypto/asn1/a_int.c:114:1: Parameter `*(*a)->data`
        112.   	}
        113.   
        114. > ASN1_INTEGER *d2i_ASN1_INTEGER(ASN1_INTEGER **a, unsigned char **pp,
        115.   	     long length)
        116.   	{

crypto/x509/x509_vfy.c:472:8: Call
470.   	for (i=0; i<sk_num(chain); i++)
471.   		{
472.   		ktmp=X509_get_pubkey((X509 *)sk_value(chain,i));
              ^
473.   		if (ktmp == NULL)
474.   			{

crypto/x509/x509_cmp.c:237:1: Parameter `*x->cert_info->key->algor->parameter->value.sequence->data`
  235.   	}
  236.   
  237. > EVP_PKEY *X509_get_pubkey(X509 *x)
  238.   	{
  239.   	if ((x == NULL) || (x->cert_info == NULL))

crypto/x509/x509_cmp.c:241:9: Call
  239.   	if ((x == NULL) || (x->cert_info == NULL))
  240.   		return(NULL);
  241.   	return(X509_PUBKEY_get(x->cert_info->key));
                 ^
  242.   	}
  243.   

crypto/asn1/x_pubkey.c:200:1: Parameter `*key->algor->parameter->value.sequence->data`
    198.   	}
    199.   
    200. > EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)
    201.   	{
    202.   	EVP_PKEY *ret=NULL;

crypto/asn1/x_pubkey.c:237:4: Assignment
    235.   			{
    236.   			ret->pkey.dsa->write_params=0;
    237.   			p=a->parameter->value.sequence->data;
              ^
    238.   			j=a->parameter->value.sequence->length;
    239.   			if (!d2i_DSAparams(&ret->pkey.dsa,&p,(long)j))

crypto/asn1/x_pubkey.c:239:9: Call
    237.   			p=a->parameter->value.sequence->data;
    238.   			j=a->parameter->value.sequence->length;
    239.   			if (!d2i_DSAparams(&ret->pkey.dsa,&p,(long)j))
                   ^
    240.   				goto err;
    241.   			}

crypto/asn1/d2i_dsap.c:67:1: Parameter `**pp`
      65.   #include <openssl/asn1_mac.h>
      66.   
      67. > DSA *d2i_DSAparams(DSA **a, unsigned char **pp, long length)
      68.   	{
      69.   	int i=ERR_R_NESTED_ASN1_ERROR;

crypto/asn1/d2i_dsap.c:73:2: Assignment
      71.   	M_ASN1_D2I_vars(a,DSA *,DSA_new);
      72.   
      73.   	M_ASN1_D2I_Init();
             ^
      74.   	M_ASN1_D2I_start_sequence();
      75.   	M_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);

crypto/asn1/d2i_dsap.c:74:2: Call
      72.   
      73.   	M_ASN1_D2I_Init();
      74.   	M_ASN1_D2I_start_sequence();
             ^
      75.   	M_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);
      76.   	if ((ret->p=BN_bin2bn(bs->data,bs->length,ret->p)) == NULL) goto err_bn;

crypto/asn1/asn1_lib.c:277:1: Parameter `*c->p`
        275.   	}
        276.   
        277. > int asn1_GetSequence(ASN1_CTX *c, long *length)
        278.   	{
        279.   	unsigned char *q;

crypto/asn1/asn1_lib.c:282:9: Call
        280.   
        281.   	q=c->p;
        282.   	c->inf=ASN1_get_object(&(c->p),&(c->slen),&(c->tag),&(c->xclass),
                       ^
        283.   		*length);
        284.   	if (c->inf & 0x80)

crypto/asn1/asn1_lib.c:83:1: <Length trace>
81.   
82.   
83. > int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
84.   	     long omax)
85.   	{

crypto/asn1/asn1_lib.c:83:1: Parameter `**pp`
          81.   
          82.   
          83. > int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
          84.   	     long omax)
          85.   	{

crypto/asn1/asn1_lib.c:88:2: Assignment
          86.   	int i,ret;
          87.   	long l;
          88.   	unsigned char *p= *pp;
                 ^
          89.   	int tag,xclass,inf;
          90.   	long max=omax;

crypto/asn1/asn1_lib.c:98:3: Assignment
          96.   	if (i == V_ASN1_PRIMATIVE_TAG)
          97.   		{		/* high-tag */
          98.   		p++;
                   ^
          99.   		if (--max == 0) goto err;
          100.   		l=0;

crypto/asn1/asn1_lib.c:101:10: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `X509_get_pubkey` 
          99.   		if (--max == 0) goto err;
          100.   		l=0;
          101.   		while (*p&0x80)
                          ^
          102.   			{
          103.   			l<<=7L;

int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
	     long omax)
	{
	int i,ret;
	long l;
	unsigned char *p= *pp;
	int tag,xclass,inf;
	long max=omax;
	if (!max) goto err;
	ret=(*p&V_ASN1_CONSTRUCTED);
	xclass=(*p&V_ASN1_PRIVATE);
	i= *p&V_ASN1_PRIMATIVE_TAG;
	if (i == V_ASN1_PRIMATIVE_TAG)
		{
		p++;
		if (--max == 0) goto err;
		l=0;
		while (*p&0x80)
			{
			l<<=7L;
			l|= *(p++)&0x7f;
			if (--max == 0) goto err;
			}
		l<<=7L;
		l|= *(p++)&0x7f;
		tag=(int)l;
		}
	else
		{
		tag=i;
		p++;
		if (--max == 0) goto err;
		}
	*ptag=tag;
	*pclass=xclass;
	if (!asn1_get_length(&p,&inf,plength,(int)max)) goto err;
#if 0
	fprintf(stderr,"p=%d + *plength=%ld > omax=%ld + *pp=%d  (%d > %d)\n",
		(int)p,*plength,omax,(int)*pp,(int)(p+ *plength),
		(int)(omax+ *pp));
#endif
#if 0
	if ((p+ *plength) > (omax+ *pp))
		{
		ASN1err(ASN1_F_ASN1_GET_OBJECT,ASN1_R_TOO_LONG);
		ret|=0x80;
		}
#endif
	*pp=p;
	return(ret|inf);
err:
	ASN1err(ASN1_F_ASN1_GET_OBJECT,ASN1_R_HEADER_TOO_LONG);
	return(0x80);
	}
['int X509_get_pubkey_parameters(EVP_PKEY *pkey, STACK *chain)\n\t{\n\tEVP_PKEY *ktmp=NULL,*ktmp2;\n\tint i,j;\n\tif ((pkey != NULL) && !EVP_PKEY_missing_parameters(pkey)) return(1);\n\tfor (i=0; i<sk_num(chain); i++)\n\t\t{\n\t\tktmp=X509_get_pubkey((X509 *)sk_value(chain,i));\n\t\tif (ktmp == NULL)\n\t\t\t{\n\t\t\tX509err(X509_F_X509_GET_PUBKEY_PARAMETERS,X509_R_UNABLE_TO_GET_CERTS_PUBLIC_KEY);\n\t\t\treturn(0);\n\t\t\t}\n\t\tif (!EVP_PKEY_missing_parameters(ktmp))\n\t\t\tbreak;\n\t\telse\n\t\t\t{\n\t\t\tEVP_PKEY_free(ktmp);\n\t\t\tktmp=NULL;\n\t\t\t}\n\t\t}\n\tif (ktmp == NULL)\n\t\t{\n\t\tX509err(X509_F_X509_GET_PUBKEY_PARAMETERS,X509_R_UNABLE_TO_FIND_PARAMETERS_IN_CHAIN);\n\t\treturn(0);\n\t\t}\n\tfor (j=i-1; j >= 0; j--)\n\t\t{\n\t\tktmp2=X509_get_pubkey((X509 *)sk_value(chain,j));\n\t\tEVP_PKEY_copy_parameters(ktmp2,ktmp);\n\t\tEVP_PKEY_free(ktmp2);\n\t\t}\n\tif (pkey != NULL) EVP_PKEY_copy_parameters(pkey,ktmp);\n\tEVP_PKEY_free(ktmp);\n\treturn(1);\n\t}', 'EVP_PKEY *X509_get_pubkey(X509 *x)\n\t{\n\tif ((x == NULL) || (x->cert_info == NULL))\n\t\treturn(NULL);\n\treturn(X509_PUBKEY_get(x->cert_info->key));\n\t}', 'EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)\n\t{\n\tEVP_PKEY *ret=NULL;\n\tlong j;\n\tint type;\n\tunsigned char *p;\n#ifndef NO_DSA\n\tX509_ALGOR *a;\n#endif\n\tif (key == NULL) goto err;\n\tif (key->pkey != NULL)\n\t    {\n\t    CRYPTO_add(&key->pkey->references,1,CRYPTO_LOCK_EVP_PKEY);\n\t    return(key->pkey);\n\t    }\n\tif (key->public_key == NULL) goto err;\n\ttype=OBJ_obj2nid(key->algor->algorithm);\n\tp=key->public_key->data;\n        j=key->public_key->length;\n        if ((ret=d2i_PublicKey(type,NULL,&p,(long)j)) == NULL)\n\t\t{\n\t\tX509err(X509_F_X509_PUBKEY_GET,X509_R_ERR_ASN1_LIB);\n\t\tgoto err;\n\t\t}\n\tret->save_parameters=0;\n#ifndef NO_DSA\n\ta=key->algor;\n\tif (ret->type == EVP_PKEY_DSA)\n\t\t{\n\t\tif (a->parameter->type == V_ASN1_SEQUENCE)\n\t\t\t{\n\t\t\tret->pkey.dsa->write_params=0;\n\t\t\tp=a->parameter->value.sequence->data;\n\t\t\tj=a->parameter->value.sequence->length;\n\t\t\tif (!d2i_DSAparams(&ret->pkey.dsa,&p,(long)j))\n\t\t\t\tgoto err;\n\t\t\t}\n\t\tret->save_parameters=1;\n\t\t}\n#endif\n\tkey->pkey=ret;\n\tCRYPTO_add(&ret->references,1,CRYPTO_LOCK_EVP_PKEY);\n\treturn(ret);\nerr:\n\tif (ret != NULL)\n\t\tEVP_PKEY_free(ret);\n\treturn(NULL);\n\t}', 'DSA *d2i_DSAparams(DSA **a, unsigned char **pp, long length)\n\t{\n\tint i=ERR_R_NESTED_ASN1_ERROR;\n\tASN1_INTEGER *bs=NULL;\n\tM_ASN1_D2I_vars(a,DSA *,DSA_new);\n\tM_ASN1_D2I_Init();\n\tM_ASN1_D2I_start_sequence();\n\tM_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);\n\tif ((ret->p=BN_bin2bn(bs->data,bs->length,ret->p)) == NULL) goto err_bn;\n\tM_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);\n\tif ((ret->q=BN_bin2bn(bs->data,bs->length,ret->q)) == NULL) goto err_bn;\n\tM_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);\n\tif ((ret->g=BN_bin2bn(bs->data,bs->length,ret->g)) == NULL) goto err_bn;\n\tASN1_BIT_STRING_free(bs);\n\tM_ASN1_D2I_Finish_2(a);\nerr_bn:\n\ti=ERR_R_BN_LIB;\nerr:\n\tASN1err(ASN1_F_D2I_DSAPARAMS,i);\n\tif ((ret != NULL) && ((a == NULL) || (*a != ret))) DSA_free(ret);\n\tif (bs != NULL) ASN1_BIT_STRING_free(bs);\n\treturn(NULL);\n\t}', 'ASN1_INTEGER *d2i_ASN1_INTEGER(ASN1_INTEGER **a, unsigned char **pp,\n\t     long length)\n\t{\n\tASN1_INTEGER *ret=NULL;\n\tunsigned char *p,*to,*s;\n\tlong len;\n\tint inf,tag,xclass;\n\tint i;\n\tif ((a == NULL) || ((*a) == NULL))\n\t\t{\n\t\tif ((ret=ASN1_INTEGER_new()) == NULL) return(NULL);\n\t\tret->type=V_ASN1_INTEGER;\n\t\t}\n\telse\n\t\tret=(*a);\n\tp= *pp;\n\tinf=ASN1_get_object(&p,&len,&tag,&xclass,length);\n\tif (inf & 0x80)\n\t\t{\n\t\ti=ASN1_R_BAD_OBJECT_HEADER;\n\t\tgoto err;\n\t\t}\n\tif (tag != V_ASN1_INTEGER)\n\t\t{\n\t\ti=ASN1_R_EXPECTING_AN_INTEGER;\n\t\tgoto err;\n\t\t}\n\ts=(unsigned char *)Malloc((int)len+1);\n\tif (s == NULL)\n\t\t{\n\t\ti=ERR_R_MALLOC_FAILURE;\n\t\tgoto err;\n\t\t}\n\tto=s;\n\tif (*p & 0x80)\n\t\t{\n\t\tret->type=V_ASN1_NEG_INTEGER;\n\t\tif (*p == 0xff)\n\t\t\t{\n\t\t\tp++;\n\t\t\tlen--;\n\t\t\t}\n\t\tfor (i=(int)len; i>0; i--)\n\t\t\t*(to++)= (*(p++)^0xFF)+1;\n\t\t}\n\telse\n\t\t{\n\t\tret->type=V_ASN1_INTEGER;\n\t\tif ((*p == 0) && (len != 1))\n\t\t\t{\n\t\t\tp++;\n\t\t\tlen--;\n\t\t\t}\n\t\tmemcpy(s,p,(int)len);\n\t\tp+=len;\n\t\t}\n\tif (ret->data != NULL) Free((char *)ret->data);\n\tret->data=s;\n\tret->length=(int)len;\n\tif (a != NULL) (*a)=ret;\n\t*pp=p;\n\treturn(ret);\nerr:\n\tASN1err(ASN1_F_D2I_ASN1_INTEGER,i);\n\tif ((ret != NULL) && ((a == NULL) || (*a != ret)))\n\t\tASN1_INTEGER_free(ret);\n\treturn(NULL);\n\t}', 'int asn1_GetSequence(ASN1_CTX *c, long *length)\n\t{\n\tunsigned char *q;\n\tq=c->p;\n\tc->inf=ASN1_get_object(&(c->p),&(c->slen),&(c->tag),&(c->xclass),\n\t\t*length);\n\tif (c->inf & 0x80)\n\t\t{\n\t\tc->error=ERR_R_BAD_GET_ASN1_OBJECT_CALL;\n\t\treturn(0);\n\t\t}\n\tif (c->tag != V_ASN1_SEQUENCE)\n\t\t{\n\t\tc->error=ERR_R_EXPECTING_AN_ASN1_SEQUENCE;\n\t\treturn(0);\n\t\t}\n\t(*length)-=(c->p-q);\n\tif (c->max && (*length < 0))\n\t\t{\n\t\tc->error=ERR_R_ASN1_LENGTH_MISMATCH;\n\t\treturn(0);\n\t\t}\n\tif (c->inf == (1|V_ASN1_CONSTRUCTED))\n\t\tc->slen= *length+ *(c->pp)-c->p;\n\tc->eos=0;\n\treturn(1);\n\t}', 'int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,\n\t     long omax)\n\t{\n\tint i,ret;\n\tlong l;\n\tunsigned char *p= *pp;\n\tint tag,xclass,inf;\n\tlong max=omax;\n\tif (!max) goto err;\n\tret=(*p&V_ASN1_CONSTRUCTED);\n\txclass=(*p&V_ASN1_PRIVATE);\n\ti= *p&V_ASN1_PRIMATIVE_TAG;\n\tif (i == V_ASN1_PRIMATIVE_TAG)\n\t\t{\n\t\tp++;\n\t\tif (--max == 0) goto err;\n\t\tl=0;\n\t\twhile (*p&0x80)\n\t\t\t{\n\t\t\tl<<=7L;\n\t\t\tl|= *(p++)&0x7f;\n\t\t\tif (--max == 0) goto err;\n\t\t\t}\n\t\tl<<=7L;\n\t\tl|= *(p++)&0x7f;\n\t\ttag=(int)l;\n\t\t}\n\telse\n\t\t{\n\t\ttag=i;\n\t\tp++;\n\t\tif (--max == 0) goto err;\n\t\t}\n\t*ptag=tag;\n\t*pclass=xclass;\n\tif (!asn1_get_length(&p,&inf,plength,(int)max)) goto err;\n#if 0\n\tfprintf(stderr,"p=%d + *plength=%ld > omax=%ld + *pp=%d  (%d > %d)\\n",\n\t\t(int)p,*plength,omax,(int)*pp,(int)(p+ *plength),\n\t\t(int)(omax+ *pp));\n#endif\n#if 0\n\tif ((p+ *plength) > (omax+ *pp))\n\t\t{\n\t\tASN1err(ASN1_F_ASN1_GET_OBJECT,ASN1_R_TOO_LONG);\n\t\tret|=0x80;\n\t\t}\n#endif\n\t*pp=p;\n\treturn(ret|inf);\nerr:\n\tASN1err(ASN1_F_ASN1_GET_OBJECT,ASN1_R_HEADER_TOO_LONG);\n\treturn(0x80);\n\t}']