crypto/pkcs7/pk7_doit.c:586: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, +oo] by call to `i2d_ASN1_SET`.
Showing all 15 steps of the trace


crypto/pkcs7/pk7_doit.c:582:7: Call
580.   				/* Now sign the mess */
581.   				EVP_SignInit(&ctx_tmp,md_tmp);
582.   				x=i2d_ASN1_SET(sk,NULL,i2d_X509_ATTRIBUTE,
             ^
583.   					V_ASN1_SET,V_ASN1_UNIVERSAL, IS_SET);
584.   				pp=(unsigned char *)Malloc(x);

crypto/asn1/a_set.c:98:17: Assignment
  96.           int totSize;
  97.   
  98.   	if (a == NULL) return(0);
                         ^
  99.   	for (i=sk_num(a)-1; i>=0; i--)
  100.   		ret+=func(sk_value(a,i),NULL);

crypto/pkcs7/pk7_doit.c:582:5: Assignment
580.   				/* Now sign the mess */
581.   				EVP_SignInit(&ctx_tmp,md_tmp);
582.   				x=i2d_ASN1_SET(sk,NULL,i2d_X509_ATTRIBUTE,
           ^
583.   					V_ASN1_SET,V_ASN1_UNIVERSAL, IS_SET);
584.   				pp=(unsigned char *)Malloc(x);

crypto/pkcs7/pk7_doit.c:584:25: Array declaration
582.   				x=i2d_ASN1_SET(sk,NULL,i2d_X509_ATTRIBUTE,
583.   					V_ASN1_SET,V_ASN1_UNIVERSAL, IS_SET);
584.   				pp=(unsigned char *)Malloc(x);
                               ^
585.   				p=pp;
586.   				i2d_ASN1_SET(sk,&p,i2d_X509_ATTRIBUTE,

crypto/pkcs7/pk7_doit.c:584:5: Assignment
582.   				x=i2d_ASN1_SET(sk,NULL,i2d_X509_ATTRIBUTE,
583.   					V_ASN1_SET,V_ASN1_UNIVERSAL, IS_SET);
584.   				pp=(unsigned char *)Malloc(x);
           ^
585.   				p=pp;
586.   				i2d_ASN1_SET(sk,&p,i2d_X509_ATTRIBUTE,

crypto/pkcs7/pk7_doit.c:585:5: Assignment
583.   					V_ASN1_SET,V_ASN1_UNIVERSAL, IS_SET);
584.   				pp=(unsigned char *)Malloc(x);
585.   				p=pp;
           ^
586.   				i2d_ASN1_SET(sk,&p,i2d_X509_ATTRIBUTE,
587.   					V_ASN1_SET,V_ASN1_UNIVERSAL, IS_SET);

crypto/pkcs7/pk7_doit.c:586:5: Call
584.   				pp=(unsigned char *)Malloc(x);
585.   				p=pp;
586.   				i2d_ASN1_SET(sk,&p,i2d_X509_ATTRIBUTE,
           ^
587.   					V_ASN1_SET,V_ASN1_UNIVERSAL, IS_SET);
588.   				EVP_SignUpdate(&ctx_tmp,pp,x);

crypto/asn1/a_set.c:88:1: Parameter `**pp`
  86.   
  87.   /* int is_set:  if TRUE, then sort the contents (i.e. it isn't a SEQUENCE)    */
  88. > int i2d_ASN1_SET(STACK *a, unsigned char **pp, int (*func)(), int ex_tag,
  89.   	     int ex_class, int is_set)
  90.   	{

crypto/asn1/a_set.c:104:2: Assignment
  102.   	if (pp == NULL) return(r);
  103.   
  104.   	p= *pp;
          ^
  105.   	ASN1_put_object(&p,1,ret,ex_tag,ex_class);
  106.   

crypto/asn1/a_set.c:105:2: Call
  103.   
  104.   	p= *pp;
  105.   	ASN1_put_object(&p,1,ret,ex_tag,ex_class);
          ^
  106.   
  107.   /* Modified by gp@nsj.co.jp */

crypto/asn1/asn1_lib.c:186:1: <Length trace>
184.   /* class 0 is constructed
185.    * constructed == 2 for indefinitle length constructed */
186. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
187.   	     int xclass)
188.   	{

crypto/asn1/asn1_lib.c:186:1: Parameter `**pp`
    184.   /* class 0 is constructed
    185.    * constructed == 2 for indefinitle length constructed */
    186. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
    187.   	     int xclass)
    188.   	{

crypto/asn1/asn1_lib.c:189:2: Assignment
    187.   	     int xclass)
    188.   	{
    189.   	unsigned char *p= *pp;
            ^
    190.   	int i;
    191.   

crypto/asn1/asn1_lib.c:198:5: Assignment
    196.   	else
    197.   		{
    198.   		*(p++)=i|V_ASN1_PRIMATIVE_TAG;
               ^
    199.   		while (tag > 0x7f)
    200.   			{

crypto/asn1/asn1_lib.c:204:3: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `i2d_ASN1_SET` 
    202.   			tag>>=7;
    203.   			}
    204.   		*(p++)=(tag&0x7f);
             ^
    205.   		}
    206.   	if ((constructed == 2) && (length == 0))

void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
	     int xclass)
	{
	unsigned char *p= *pp;
	int i;
	i=(constructed)?V_ASN1_CONSTRUCTED:0;
	i|=(xclass&V_ASN1_PRIVATE);
	if (tag < 31)
		*(p++)=i|(tag&V_ASN1_PRIMATIVE_TAG);
	else
		{
		*(p++)=i|V_ASN1_PRIMATIVE_TAG;
		while (tag > 0x7f)
			{
			*(p++)=(tag&0x7f)|0x80;
			tag>>=7;
			}
		*(p++)=(tag&0x7f);
		}
	if ((constructed == 2) && (length == 0))
		*(p++)=0x80;
	else
		asn1_put_length(&p,length);
	*pp=p;
	}
['int PKCS7_dataFinal(PKCS7 *p7, BIO *bio)\n\t{\n\tint ret=0;\n\tint i,j;\n\tBIO *btmp;\n\tBUF_MEM *buf_mem=NULL;\n\tBUF_MEM *buf=NULL;\n\tPKCS7_SIGNER_INFO *si;\n\tEVP_MD_CTX *mdc,ctx_tmp;\n\tSTACK *sk,*si_sk=NULL;\n\tunsigned char *p,*pp=NULL;\n\tint x;\n\tASN1_OCTET_STRING *os=NULL;\n\ti=OBJ_obj2nid(p7->type);\n\tp7->state=PKCS7_S_HEADER;\n\tswitch (i)\n\t\t{\n\tcase NID_pkcs7_signedAndEnveloped:\n\t\tsi_sk=p7->d.signed_and_enveloped->signer_info;\n\t\tos=ASN1_OCTET_STRING_new();\n\t\tp7->d.signed_and_enveloped->enc_data->enc_data=os;\n\t\tbreak;\n\tcase NID_pkcs7_enveloped:\n\t\tos=ASN1_OCTET_STRING_new();\n\t\tp7->d.enveloped->enc_data->enc_data=os;\n\t\tbreak;\n\tcase NID_pkcs7_signed:\n\t\tsi_sk=p7->d.sign->signer_info;\n\t\tos=p7->d.sign->contents->d.data;\n\t\tif(p7->detached) {\n\t\t\tASN1_OCTET_STRING_free(os);\n\t\t\tp7->d.sign->contents->d.data = NULL;\n\t\t}\n\t\tbreak;\n\t\t}\n\tif (si_sk != NULL)\n\t\t{\n\t\tif ((buf=BUF_MEM_new()) == NULL)\n\t\t\t{\n\t\t\tPKCS7err(PKCS7_F_PKCS7_DATASIGN,ERR_R_BIO_LIB);\n\t\t\tgoto err;\n\t\t\t}\n\t\tfor (i=0; i<sk_num(si_sk); i++)\n\t\t\t{\n\t\t\tsi=(PKCS7_SIGNER_INFO *)\n\t\t\t\tsk_value(si_sk,i);\n\t\t\tif (si->pkey == NULL) continue;\n\t\t\tj=OBJ_obj2nid(si->digest_alg->algorithm);\n\t\t\tbtmp=bio;\n\t\t\tfor (;;)\n\t\t\t\t{\n\t\t\t\tif ((btmp=BIO_find_type(btmp,BIO_TYPE_MD))\n\t\t\t\t\t== NULL)\n\t\t\t\t\t{\n\t\t\t\t\tPKCS7err(PKCS7_F_PKCS7_DATASIGN,PKCS7_R_UNABLE_TO_FIND_MESSAGE_DIGEST);\n\t\t\t\t\tgoto err;\n\t\t\t\t\t}\n\t\t\t\tBIO_get_md_ctx(btmp,&mdc);\n\t\t\t\tif (mdc == NULL)\n\t\t\t\t\t{\n\t\t\t\t\tPKCS7err(PKCS7_F_PKCS7_DATASIGN,PKCS7_R_INTERNAL_ERROR);\n\t\t\t\t\tgoto err;\n\t\t\t\t\t}\n\t\t\t\tif (EVP_MD_type(EVP_MD_CTX_type(mdc)) == j)\n\t\t\t\t\tbreak;\n\t\t\t\telse\n\t\t\t\t\tbtmp=btmp->next_bio;\n\t\t\t\t}\n\t\t\tmemcpy(&ctx_tmp,mdc,sizeof(ctx_tmp));\n\t\t\tif (!BUF_MEM_grow(buf,EVP_PKEY_size(si->pkey)))\n\t\t\t\t{\n\t\t\t\tPKCS7err(PKCS7_F_PKCS7_DATASIGN,ERR_R_BIO_LIB);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tsk=si->auth_attr;\n\t\t\tif ((sk != NULL) && (sk_num(sk) != 0))\n\t\t\t\t{\n\t\t\t\tunsigned char md_data[EVP_MAX_MD_SIZE];\n\t\t\t\tunsigned int md_len;\n\t\t\t\tASN1_OCTET_STRING *digest;\n\t\t\t\tASN1_UTCTIME *sign_time;\n\t\t\t\tconst EVP_MD *md_tmp;\n\t\t\t\tsign_time=X509_gmtime_adj(NULL,0);\n\t\t\t\tPKCS7_add_signed_attribute(si,\n\t\t\t\t\tNID_pkcs9_signingTime,\n\t\t\t\t\tV_ASN1_UTCTIME,(char *)sign_time);\n\t\t\t\tmd_tmp=EVP_MD_CTX_type(&ctx_tmp);\n\t\t\t\tEVP_DigestFinal(&ctx_tmp,md_data,&md_len);\n\t\t\t\tdigest=ASN1_OCTET_STRING_new();\n\t\t\t\tASN1_OCTET_STRING_set(digest,md_data,md_len);\n\t\t\t\tPKCS7_add_signed_attribute(si,NID_pkcs9_messageDigest,\n\t\t\t\t\tV_ASN1_OCTET_STRING,(char *)digest);\n\t\t\t\tEVP_SignInit(&ctx_tmp,md_tmp);\n\t\t\t\tx=i2d_ASN1_SET(sk,NULL,i2d_X509_ATTRIBUTE,\n\t\t\t\t\tV_ASN1_SET,V_ASN1_UNIVERSAL, IS_SET);\n\t\t\t\tpp=(unsigned char *)Malloc(x);\n\t\t\t\tp=pp;\n\t\t\t\ti2d_ASN1_SET(sk,&p,i2d_X509_ATTRIBUTE,\n\t\t\t\t\tV_ASN1_SET,V_ASN1_UNIVERSAL, IS_SET);\n\t\t\t\tEVP_SignUpdate(&ctx_tmp,pp,x);\n\t\t\t\tFree(pp);\n\t\t\t\tpp=NULL;\n\t\t\t\t}\n\t\t\tif (si->pkey->type == EVP_PKEY_DSA)\n\t\t\t\tctx_tmp.digest=EVP_dss1();\n\t\t\tif (!EVP_SignFinal(&ctx_tmp,(unsigned char *)buf->data,\n\t\t\t\t(unsigned int *)&buf->length,si->pkey))\n\t\t\t\t{\n\t\t\t\tPKCS7err(PKCS7_F_PKCS7_DATASIGN,ERR_R_EVP_LIB);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tif (!ASN1_STRING_set(si->enc_digest,\n\t\t\t\t(unsigned char *)buf->data,buf->length))\n\t\t\t\t{\n\t\t\t\tPKCS7err(PKCS7_F_PKCS7_DATASIGN,ERR_R_ASN1_LIB);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\tif (!p7->detached)\n\t\t{\n\t\tbtmp=BIO_find_type(bio,BIO_TYPE_MEM);\n\t\tif (btmp == NULL)\n\t\t\t{\n\t\t\tPKCS7err(PKCS7_F_PKCS7_DATASIGN,PKCS7_R_UNABLE_TO_FIND_MEM_BIO);\n\t\t\tgoto err;\n\t\t\t}\n\t\tBIO_get_mem_ptr(btmp,&buf_mem);\n\t\tASN1_OCTET_STRING_set(os,\n\t\t\t(unsigned char *)buf_mem->data,buf_mem->length);\n\t\t}\n\tif (pp != NULL) Free(pp);\n\tpp=NULL;\n\tret=1;\nerr:\n\tif (buf != NULL) BUF_MEM_free(buf);\n\treturn(ret);\n\t}', 'int i2d_ASN1_SET(STACK *a, unsigned char **pp, int (*func)(), int ex_tag,\n\t     int ex_class, int is_set)\n\t{\n\tint ret=0,r;\n\tint i;\n\tunsigned char *p;\n        unsigned char *pStart, *pTempMem;\n        MYBLOB *rgSetBlob;\n        int totSize;\n\tif (a == NULL) return(0);\n\tfor (i=sk_num(a)-1; i>=0; i--)\n\t\tret+=func(sk_value(a,i),NULL);\n\tr=ASN1_object_size(1,ret,ex_tag);\n\tif (pp == NULL) return(r);\n\tp= *pp;\n\tASN1_put_object(&p,1,ret,ex_tag,ex_class);\n\tif(!is_set || (sk_num(a) < 2))\n\t\t{\n\t\tfor (i=0; i<sk_num(a); i++)\n                \tfunc(sk_value(a,i),&p);\n\t\t*pp=p;\n\t\treturn(r);\n\t\t}\n        pStart  = p;\n        rgSetBlob = (MYBLOB *)Malloc( sk_num(a) * sizeof(MYBLOB));\n        for (i=0; i<sk_num(a); i++)\n\t        {\n                rgSetBlob[i].pbData = p;\n                func(sk_value(a,i),&p);\n                rgSetBlob[i].cbData = p - rgSetBlob[i].pbData;\n\t\t}\n        *pp=p;\n        totSize = p - pStart;\n        qsort( rgSetBlob, sk_num(a), sizeof(MYBLOB), SetBlobCmp);\n        pTempMem = Malloc(totSize);\n        p = pTempMem;\n        for(i=0; i<sk_num(a); ++i)\n\t\t{\n                memcpy(p, rgSetBlob[i].pbData, rgSetBlob[i].cbData);\n                p += rgSetBlob[i].cbData;\n\t\t}\n        memcpy(pStart, pTempMem, totSize);\n        Free(pTempMem);\n        Free(rgSetBlob);\n        return(r);\n        }', 'void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,\n\t     int xclass)\n\t{\n\tunsigned char *p= *pp;\n\tint i;\n\ti=(constructed)?V_ASN1_CONSTRUCTED:0;\n\ti|=(xclass&V_ASN1_PRIVATE);\n\tif (tag < 31)\n\t\t*(p++)=i|(tag&V_ASN1_PRIMATIVE_TAG);\n\telse\n\t\t{\n\t\t*(p++)=i|V_ASN1_PRIMATIVE_TAG;\n\t\twhile (tag > 0x7f)\n\t\t\t{\n\t\t\t*(p++)=(tag&0x7f)|0x80;\n\t\t\ttag>>=7;\n\t\t\t}\n\t\t*(p++)=(tag&0x7f);\n\t\t}\n\tif ((constructed == 2) && (length == 0))\n\t\t*(p++)=0x80;\n\telse\n\t\tasn1_put_length(&p,length);\n\t*pp=p;\n\t}']