crypto/pkcs7/example.c:37: error: BUFFER_OVERRUN_L3
  Offset added: [1, +oo] Size: [0, +oo] by call to `OBJ_create`.
Showing all 11 steps of the trace


crypto/pkcs7/example.c:37:4: Call
35.   	if (signed_string_nid == -1)
36.   		signed_string_nid=
37.   			OBJ_create("1.2.3.4.5","OID_example","Our example OID");
         ^
38.   	os=ASN1_OCTET_STRING_new();
39.   	ASN1_OCTET_STRING_set(os,str,strlen(str));

crypto/objects/obj_dat.c:628:1: Parameter `ln->strlen`
  626.   	}
  627.   
  628. > int OBJ_create(char *oid, char *sn, char *ln)
  629.   	{
  630.   	int ok=0;

crypto/objects/obj_dat.c:647:5: Call
  645.   	if (op == NULL) 
  646.   		goto err;
  647.   	ok=OBJ_add_object(op);
             ^
  648.   err:
  649.   	ASN1_OBJECT_free(op);

crypto/objects/obj_dat.c:214:1: Parameter `*obj->ln`
    212.   	}
    213.   
    214. > int OBJ_add_object(ASN1_OBJECT *obj)
    215.   	{
    216.   	ASN1_OBJECT *o;

crypto/objects/obj_dat.c:222:9: Call
    220.   	if (added == NULL)
    221.   		if (!init_added()) return(0);
    222.   	if ((o=OBJ_dup(obj)) == NULL) goto err;
                   ^
    223.   	ao[ADDED_DATA]=NULL;
    224.   	ao[ADDED_SNAME]=NULL;

crypto/objects/obj_lib.c:65:1: <Offset trace>
63.   #include <openssl/buffer.h>
64.   
65. > ASN1_OBJECT *OBJ_dup(ASN1_OBJECT *o)
66.   	{
67.   	ASN1_OBJECT *r;

crypto/objects/obj_lib.c:65:1: Parameter `o->ln->strlen`
      63.   #include <openssl/buffer.h>
      64.   
      65. > ASN1_OBJECT *OBJ_dup(ASN1_OBJECT *o)
      66.   	{
      67.   	ASN1_OBJECT *r;

crypto/objects/obj_lib.c:90:3: Assignment
      88.   	if (o->ln != NULL)
      89.   		{
      90.   		i=strlen(o->ln)+1;
              ^
      91.   		r->ln=ln=Malloc(i);
      92.   		if (r->ln == NULL) goto err;

crypto/objects/obj_lib.c:65:1: <Length trace>
63.   #include <openssl/buffer.h>
64.   
65. > ASN1_OBJECT *OBJ_dup(ASN1_OBJECT *o)
66.   	{
67.   	ASN1_OBJECT *r;

crypto/objects/obj_lib.c:65:1: Parameter `*o->ln`
      63.   #include <openssl/buffer.h>
      64.   
      65. > ASN1_OBJECT *OBJ_dup(ASN1_OBJECT *o)
      66.   	{
      67.   	ASN1_OBJECT *r;

crypto/objects/obj_lib.c:93:3: Array access: Offset added: [1, +oo] Size: [0, +oo] by call to `OBJ_create` 
      91.   		r->ln=ln=Malloc(i);
      92.   		if (r->ln == NULL) goto err;
      93.   		memcpy(ln,o->ln,i);
              ^
      94.   		}
      95.   

ASN1_OBJECT *OBJ_dup(ASN1_OBJECT *o)
	{
	ASN1_OBJECT *r;
	int i;
	char *ln=NULL;
	if (o == NULL) return(NULL);
	if (!(o->flags & ASN1_OBJECT_FLAG_DYNAMIC))
		return(o);
	r=ASN1_OBJECT_new();
	if (r == NULL)
		{
		OBJerr(OBJ_F_OBJ_DUP,ERR_R_ASN1_LIB);
		return(NULL);
		}
	r->data=Malloc(o->length);
	if (r->data == NULL)
		goto err;
	memcpy(r->data,o->data,o->length);
	r->length=o->length;
	r->nid=o->nid;
	r->ln=r->sn=NULL;
	if (o->ln != NULL)
		{
		i=strlen(o->ln)+1;
		r->ln=ln=Malloc(i);
		if (r->ln == NULL) goto err;
		memcpy(ln,o->ln,i);
		}
	if (o->sn != NULL)
		{
		char *s;
		i=strlen(o->sn)+1;
		r->sn=s=Malloc(i);
		if (r->sn == NULL) goto err;
		memcpy(s,o->sn,i);
		}
	r->flags=o->flags|(ASN1_OBJECT_FLAG_DYNAMIC|
		ASN1_OBJECT_FLAG_DYNAMIC_STRINGS|ASN1_OBJECT_FLAG_DYNAMIC_DATA);
	return(r);
err:
	OBJerr(OBJ_F_OBJ_DUP,ERR_R_MALLOC_FAILURE);
	if (r != NULL)
		{
		if (ln != NULL) Free(ln);
		if (r->data != NULL) Free(r->data);
		Free(r);
		}
	return(NULL);
	}
['void add_signed_string(PKCS7_SIGNER_INFO *si, char *str)\n\t{\n\tASN1_OCTET_STRING *os;\n\tif (signed_string_nid == -1)\n\t\tsigned_string_nid=\n\t\t\tOBJ_create("1.2.3.4.5","OID_example","Our example OID");\n\tos=ASN1_OCTET_STRING_new();\n\tASN1_OCTET_STRING_set(os,str,strlen(str));\n\tPKCS7_add_signed_attribute(si,signed_string_nid,\n\t\tV_ASN1_OCTET_STRING,(char *)os);\n\t}', 'int OBJ_create(char *oid, char *sn, char *ln)\n\t{\n\tint ok=0;\n\tASN1_OBJECT *op=NULL;\n\tunsigned char *buf;\n\tint i;\n\ti=a2d_ASN1_OBJECT(NULL,0,oid,-1);\n\tif (i <= 0) return(0);\n\tif ((buf=(unsigned char *)Malloc(i)) == NULL)\n\t\t{\n\t\tOBJerr(OBJ_F_OBJ_CREATE,OBJ_R_MALLOC_FAILURE);\n\t\treturn(0);\n\t\t}\n\ti=a2d_ASN1_OBJECT(buf,i,oid,-1);\n\top=(ASN1_OBJECT *)ASN1_OBJECT_create(OBJ_new_nid(1),buf,i,sn,ln);\n\tif (op == NULL)\n\t\tgoto err;\n\tok=OBJ_add_object(op);\nerr:\n\tASN1_OBJECT_free(op);\n\tFree((char *)buf);\n\treturn(ok);\n\t}', 'int OBJ_add_object(ASN1_OBJECT *obj)\n\t{\n\tASN1_OBJECT *o;\n\tADDED_OBJ *ao[4],*aop;\n\tint i;\n\tif (added == NULL)\n\t\tif (!init_added()) return(0);\n\tif ((o=OBJ_dup(obj)) == NULL) goto err;\n\tao[ADDED_DATA]=NULL;\n\tao[ADDED_SNAME]=NULL;\n\tao[ADDED_LNAME]=NULL;\n\tao[ADDED_NID]=NULL;\n\tao[ADDED_NID]=(ADDED_OBJ *)Malloc(sizeof(ADDED_OBJ));\n\tif ((o->length != 0) && (obj->data != NULL))\n\t\tao[ADDED_DATA]=(ADDED_OBJ *)Malloc(sizeof(ADDED_OBJ));\n\tif (o->sn != NULL)\n\t\tao[ADDED_SNAME]=(ADDED_OBJ *)Malloc(sizeof(ADDED_OBJ));\n\tif (o->ln != NULL)\n\t\tao[ADDED_LNAME]=(ADDED_OBJ *)Malloc(sizeof(ADDED_OBJ));\n\tfor (i=ADDED_DATA; i<=ADDED_NID; i++)\n\t\t{\n\t\tif (ao[i] != NULL)\n\t\t\t{\n\t\t\tao[i]->type=i;\n\t\t\tao[i]->obj=o;\n\t\t\taop=(ADDED_OBJ *)lh_insert(added,(char *)ao[i]);\n\t\t\tif (aop != NULL)\n\t\t\t\tFree(aop);\n\t\t\t}\n\t\t}\n\to->flags&= ~(ASN1_OBJECT_FLAG_DYNAMIC|ASN1_OBJECT_FLAG_DYNAMIC_STRINGS|\n\t\t\tASN1_OBJECT_FLAG_DYNAMIC_DATA);\n\treturn(o->nid);\nerr:\n\tfor (i=ADDED_DATA; i<=ADDED_NID; i++)\n\t\tif (ao[i] != NULL) Free(ao[i]);\n\tif (o != NULL) Free(o);\n\treturn(NID_undef);\n\t}', 'ASN1_OBJECT *OBJ_dup(ASN1_OBJECT *o)\n\t{\n\tASN1_OBJECT *r;\n\tint i;\n\tchar *ln=NULL;\n\tif (o == NULL) return(NULL);\n\tif (!(o->flags & ASN1_OBJECT_FLAG_DYNAMIC))\n\t\treturn(o);\n\tr=ASN1_OBJECT_new();\n\tif (r == NULL)\n\t\t{\n\t\tOBJerr(OBJ_F_OBJ_DUP,ERR_R_ASN1_LIB);\n\t\treturn(NULL);\n\t\t}\n\tr->data=Malloc(o->length);\n\tif (r->data == NULL)\n\t\tgoto err;\n\tmemcpy(r->data,o->data,o->length);\n\tr->length=o->length;\n\tr->nid=o->nid;\n\tr->ln=r->sn=NULL;\n\tif (o->ln != NULL)\n\t\t{\n\t\ti=strlen(o->ln)+1;\n\t\tr->ln=ln=Malloc(i);\n\t\tif (r->ln == NULL) goto err;\n\t\tmemcpy(ln,o->ln,i);\n\t\t}\n\tif (o->sn != NULL)\n\t\t{\n\t\tchar *s;\n\t\ti=strlen(o->sn)+1;\n\t\tr->sn=s=Malloc(i);\n\t\tif (r->sn == NULL) goto err;\n\t\tmemcpy(s,o->sn,i);\n\t\t}\n\tr->flags=o->flags|(ASN1_OBJECT_FLAG_DYNAMIC|\n\t\tASN1_OBJECT_FLAG_DYNAMIC_STRINGS|ASN1_OBJECT_FLAG_DYNAMIC_DATA);\n\treturn(r);\nerr:\n\tOBJerr(OBJ_F_OBJ_DUP,ERR_R_MALLOC_FAILURE);\n\tif (r != NULL)\n\t\t{\n\t\tif (ln != NULL) Free(ln);\n\t\tif (r->data != NULL) Free(r->data);\n\t\tFree(r);\n\t\t}\n\treturn(NULL);\n\t}']