crypto/x509/x509_obj.c:105: error: BUFFER_OVERRUN_L1
  Offset added: 80 Size: 32 by call to `i2t_ASN1_OBJECT`.
Showing all 6 steps of the trace


crypto/x509/x509_obj.c:105:4: Call
103.   		if ((n == NID_undef) || ((s=OBJ_nid2sn(n)) == NULL))
104.   			{
105.   			i2t_ASN1_OBJECT(tmp_buf,sizeof(tmp_buf),ne->object);
          ^
106.   			s=tmp_buf;
107.   			}

crypto/asn1/a_object.c:178:1: <Offset trace>
176.   	}
177.   
178. > int i2t_ASN1_OBJECT(char *buf, int buf_len, ASN1_OBJECT *a)
179.   	{
180.   	int i,idx=0,n=0,len,nid;

crypto/asn1/a_object.c:178:1: Parameter `buf_len`
  176.   	}
  177.   
  178. > int i2t_ASN1_OBJECT(char *buf, int buf_len, ASN1_OBJECT *a)
  179.   	{
  180.   	int i,idx=0,n=0,len,nid;

crypto/asn1/a_object.c:178:1: <Length trace>
176.   	}
177.   
178. > int i2t_ASN1_OBJECT(char *buf, int buf_len, ASN1_OBJECT *a)
179.   	{
180.   	int i,idx=0,n=0,len,nid;

crypto/asn1/a_object.c:178:1: Array declaration
  176.   	}
  177.   
  178. > int i2t_ASN1_OBJECT(char *buf, int buf_len, ASN1_OBJECT *a)
  179.   	{
  180.   	int i,idx=0,n=0,len,nid;

crypto/asn1/a_object.c:216:3: Array access: Offset added: 80 Size: 32 by call to `i2t_ASN1_OBJECT` 
  214.   		sprintf(tbuf,"%d.%ld",i,l);
  215.   		i=strlen(tbuf);
  216.   		strncpy(buf,tbuf,buf_len);
           ^
  217.   		buf_len-=i;
  218.   		buf+=i;

int i2t_ASN1_OBJECT(char *buf, int buf_len, ASN1_OBJECT *a)
	{
	int i,idx=0,n=0,len,nid;
	unsigned long l;
	unsigned char *p;
	const char *s;
	char tbuf[32];
	if (buf_len <= 0) return(0);
	if ((a == NULL) || (a->data == NULL))
		{
		buf[0]='\0';
		return(0);
		}
	nid=OBJ_obj2nid(a);
	if (nid == NID_undef)
		{
		len=a->length;
		p=a->data;
		idx=0;
		l=0;
		while (idx < a->length)
			{
			l|=(p[idx]&0x7f);
			if (!(p[idx] & 0x80)) break;
			l<<=7L;
			idx++;
			}
		idx++;
		i=(int)(l/40);
		if (i > 2) i=2;
		l-=(long)(i*40);
		sprintf(tbuf,"%d.%ld",i,l);
		i=strlen(tbuf);
		strncpy(buf,tbuf,buf_len);
		buf_len-=i;
		buf+=i;
		n+=i;
		l=0;
		for (; idx<len; idx++)
			{
			l|=p[idx]&0x7f;
			if (!(p[idx] & 0x80))
				{
				sprintf(tbuf,".%ld",l);
				i=strlen(tbuf);
				if (buf_len > 0)
					strncpy(buf,tbuf,buf_len);
				buf_len-=i;
				buf+=i;
				n+=i;
				l=0;
				}
			l<<=7L;
			}
		}
	else
		{
		s=OBJ_nid2ln(nid);
		if (s == NULL)
			s=OBJ_nid2sn(nid);
		strncpy(buf,s,buf_len);
		n=strlen(s);
		}
	buf[buf_len-1]='\0';
	return(n);
	}
['char *X509_NAME_oneline(X509_NAME *a, char *buf, int len)\n\t{\n\tX509_NAME_ENTRY *ne;\n\tunsigned int i;\n\tint n,lold,l,l1,l2,num,j,type;\n\tconst char *s;\n\tchar *p;\n\tunsigned char *q;\n\tBUF_MEM *b=NULL;\n\tstatic char hex[17]="0123456789ABCDEF";\n\tint gs_doit[4];\n\tchar tmp_buf[80];\n\tif (buf == NULL)\n\t\t{\n\t\tif ((b=BUF_MEM_new()) == NULL) goto err;\n\t\tif (!BUF_MEM_grow(b,200)) goto err;\n\t\tb->data[0]=\'\\0\';\n\t\tlen=200;\n\t\t}\n\tif (a == NULL)\n\t    {\n\t    if(b)\n\t\t{\n\t\tbuf=b->data;\n\t\tFree(b);\n\t\t}\n\t    strncpy(buf,"NO X509_NAME",len);\n\t    return buf;\n\t    }\n\tlen--;\n\tl=0;\n\tfor (i=0; (int)i<sk_num(a->entries); i++)\n\t\t{\n\t\tne=(X509_NAME_ENTRY *)sk_value(a->entries,i);\n\t\tn=OBJ_obj2nid(ne->object);\n\t\tif ((n == NID_undef) || ((s=OBJ_nid2sn(n)) == NULL))\n\t\t\t{\n\t\t\ti2t_ASN1_OBJECT(tmp_buf,sizeof(tmp_buf),ne->object);\n\t\t\ts=tmp_buf;\n\t\t\t}\n\t\tl1=strlen(s);\n\t\ttype=ne->value->type;\n\t\tnum=ne->value->length;\n\t\tq=ne->value->data;\n\t\tif ((type == V_ASN1_GENERALSTRING) && ((num%4) == 0))\n\t\t\t{\n\t\t\tgs_doit[0]=gs_doit[1]=gs_doit[2]=gs_doit[3]=0;\n\t\t\tfor (j=0; j<num; j++)\n\t\t\t\tif (q[j] != 0) gs_doit[j&3]=1;\n\t\t\tif (gs_doit[0]|gs_doit[1]|gs_doit[2])\n\t\t\t\tgs_doit[0]=gs_doit[1]=gs_doit[2]=gs_doit[3]=1;\n\t\t\telse\n\t\t\t\t{\n\t\t\t\tgs_doit[0]=gs_doit[1]=gs_doit[2]=0;\n\t\t\t\tgs_doit[3]=1;\n\t\t\t\t}\n\t\t\t}\n\t\telse\n\t\t\tgs_doit[0]=gs_doit[1]=gs_doit[2]=gs_doit[3]=1;\n\t\tfor (l2=j=0; j<num; j++)\n\t\t\t{\n\t\t\tif (!gs_doit[j&3]) continue;\n\t\t\tl2++;\n\t\t\tif ((q[j] < \' \') || (q[j] > \'~\')) l2+=3;\n\t\t\t}\n\t\tlold=l;\n\t\tl+=1+l1+1+l2;\n\t\tif (b != NULL)\n\t\t\t{\n\t\t\tif (!BUF_MEM_grow(b,l+1)) goto err;\n\t\t\tp= &(b->data[lold]);\n\t\t\t}\n\t\telse if (l > len)\n\t\t\t{\n\t\t\tbreak;\n\t\t\t}\n\t\telse\n\t\t\tp= &(buf[lold]);\n\t\t*(p++)=\'/\';\n\t\tmemcpy(p,s,(unsigned int)l1); p+=l1;\n\t\t*(p++)=\'=\';\n\t\tq=ne->value->data;\n\t\tfor (j=0; j<num; j++)\n\t\t\t{\n\t\t\tif (!gs_doit[j&3]) continue;\n\t\t\tn=q[j];\n\t\t\tif ((n < \' \') || (n > \'~\'))\n\t\t\t\t{\n\t\t\t\t*(p++)=\'\\\\\';\n\t\t\t\t*(p++)=\'x\';\n\t\t\t\t*(p++)=hex[(n>>4)&0x0f];\n\t\t\t\t*(p++)=hex[n&0x0f];\n\t\t\t\t}\n\t\t\telse\n\t\t\t\t*(p++)=n;\n\t\t\t}\n\t\t*p=\'\\0\';\n\t\t}\n\tif (b != NULL)\n\t\t{\n\t\tp=b->data;\n\t\tFree(b);\n\t\t}\n\telse\n\t\tp=buf;\n\treturn(p);\nerr:\n\tX509err(X509_F_X509_NAME_ONELINE,ERR_R_MALLOC_FAILURE);\n\tif (b != NULL) BUF_MEM_free(b);\n\treturn(NULL);\n\t}', 'int i2t_ASN1_OBJECT(char *buf, int buf_len, ASN1_OBJECT *a)\n\t{\n\tint i,idx=0,n=0,len,nid;\n\tunsigned long l;\n\tunsigned char *p;\n\tconst char *s;\n\tchar tbuf[32];\n\tif (buf_len <= 0) return(0);\n\tif ((a == NULL) || (a->data == NULL))\n\t\t{\n\t\tbuf[0]=\'\\0\';\n\t\treturn(0);\n\t\t}\n\tnid=OBJ_obj2nid(a);\n\tif (nid == NID_undef)\n\t\t{\n\t\tlen=a->length;\n\t\tp=a->data;\n\t\tidx=0;\n\t\tl=0;\n\t\twhile (idx < a->length)\n\t\t\t{\n\t\t\tl|=(p[idx]&0x7f);\n\t\t\tif (!(p[idx] & 0x80)) break;\n\t\t\tl<<=7L;\n\t\t\tidx++;\n\t\t\t}\n\t\tidx++;\n\t\ti=(int)(l/40);\n\t\tif (i > 2) i=2;\n\t\tl-=(long)(i*40);\n\t\tsprintf(tbuf,"%d.%ld",i,l);\n\t\ti=strlen(tbuf);\n\t\tstrncpy(buf,tbuf,buf_len);\n\t\tbuf_len-=i;\n\t\tbuf+=i;\n\t\tn+=i;\n\t\tl=0;\n\t\tfor (; idx<len; idx++)\n\t\t\t{\n\t\t\tl|=p[idx]&0x7f;\n\t\t\tif (!(p[idx] & 0x80))\n\t\t\t\t{\n\t\t\t\tsprintf(tbuf,".%ld",l);\n\t\t\t\ti=strlen(tbuf);\n\t\t\t\tif (buf_len > 0)\n\t\t\t\t\tstrncpy(buf,tbuf,buf_len);\n\t\t\t\tbuf_len-=i;\n\t\t\t\tbuf+=i;\n\t\t\t\tn+=i;\n\t\t\t\tl=0;\n\t\t\t\t}\n\t\t\tl<<=7L;\n\t\t\t}\n\t\t}\n\telse\n\t\t{\n\t\ts=OBJ_nid2ln(nid);\n\t\tif (s == NULL)\n\t\t\ts=OBJ_nid2sn(nid);\n\t\tstrncpy(buf,s,buf_len);\n\t\tn=strlen(s);\n\t\t}\n\tbuf[buf_len-1]=\'\\0\';\n\treturn(n);\n\t}']