apps/ca.c:1985: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, +oo] by call to `EVP_DecodeBlock`.
Showing all 7 steps of the trace


apps/ca.c:1930:8: Call
1928.   	 * STACK format).
1929.   	 */
1930.   	parms=CONF_load(NULL,infile,&errline);
               ^
1931.   	if (parms == NULL)
1932.   		{

crypto/conf/conf.c:277:4: Assignment
  275.   			if (psection == NULL) psection=section;
  276.   			v->name=(char *)Malloc(strlen(pname)+1);
  277.   			v->value=NULL;
            ^
  278.   			if (v->name == NULL)
  279.   				{

apps/ca.c:1985:9: Call
1983.   					goto err;
1984.   					}
1985.   				j = EVP_DecodeBlock(spki_der, (unsigned char *)cv->value,
                ^
1986.   					strlen(cv->value));
1987.   				if (j <= 0)

crypto/evp/encode.c:329:1: <Length trace>
327.   	}
328.   
329. > int EVP_DecodeBlock(unsigned char *t, unsigned char *f, int n)
330.   	{
331.   	int i,ret=0,a,b,c,d;

crypto/evp/encode.c:329:1: Parameter `*f`
  327.   	}
  328.   
  329. > int EVP_DecodeBlock(unsigned char *t, unsigned char *f, int n)
  330.   	{
  331.   	int i,ret=0,a,b,c,d;

crypto/evp/encode.c:350:5: Assignment
  348.   	for (i=0; i<n; i+=4)
  349.   		{
  350.   		a=conv_ascii2bin(*(f++));
             ^
  351.   		b=conv_ascii2bin(*(f++));
  352.   		c=conv_ascii2bin(*(f++));

crypto/evp/encode.c:351:5: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `EVP_DecodeBlock` 
  349.   		{
  350.   		a=conv_ascii2bin(*(f++));
  351.   		b=conv_ascii2bin(*(f++));
             ^
  352.   		c=conv_ascii2bin(*(f++));
  353.   		d=conv_ascii2bin(*(f++));

int EVP_DecodeBlock(unsigned char *t, unsigned char *f, int n)
	{
	int i,ret=0,a,b,c,d;
	unsigned long l;
	while ((conv_ascii2bin(*f) == B64_WS) && (n > 0))
		{
		f++;
		n--;
		}
	while ((n > 3) && (B64_NOT_BASE64(conv_ascii2bin(f[n-1]))))
		n--;
	if (n%4 != 0) return(-1);
	for (i=0; i<n; i+=4)
		{
		a=conv_ascii2bin(*(f++));
		b=conv_ascii2bin(*(f++));
		c=conv_ascii2bin(*(f++));
		d=conv_ascii2bin(*(f++));
		if (	(a & 0x80) || (b & 0x80) ||
			(c & 0x80) || (d & 0x80))
			return(-1);
		l=(	(((unsigned long)a)<<18L)|
			(((unsigned long)b)<<12L)|
			(((unsigned long)c)<< 6L)|
			(((unsigned long)d)     ));
		*(t++)=(unsigned char)(l>>16L)&0xff;
		*(t++)=(unsigned char)(l>> 8L)&0xff;
		*(t++)=(unsigned char)(l     )&0xff;
		ret+=3;
		}
	return(ret);
	}
['LHASH *CONF_load(LHASH *h, char *file, long *line)\n\t{\n\tLHASH *ret=NULL;\n\tFILE *in=NULL;\n#define BUFSIZE\t512\n\tchar btmp[16];\n\tint bufnum=0,i,ii;\n\tBUF_MEM *buff=NULL;\n\tchar *s,*p,*end;\n\tint again,n;\n\tlong eline=0;\n\tCONF_VALUE *v=NULL,*vv,*tv;\n\tCONF_VALUE *sv=NULL;\n\tchar *section=NULL,*buf;\n\tSTACK *section_sk=NULL,*ts;\n\tchar *start,*psection,*pname;\n\tif ((buff=BUF_MEM_new()) == NULL)\n\t\t{\n\t\tCONFerr(CONF_F_CONF_LOAD,ERR_R_BUF_LIB);\n\t\tgoto err;\n\t\t}\n#ifdef VMS\n\tin=fopen(file,"r");\n#else\n\tin=fopen(file,"rb");\n#endif\n\tif (in == NULL)\n\t\t{\n\t\tSYSerr(SYS_F_FOPEN,get_last_sys_error());\n\t\tERR_set_error_data(BUF_strdup(file),\n\t\t\tERR_TXT_MALLOCED|ERR_TXT_STRING);\n\t\tCONFerr(CONF_F_CONF_LOAD,ERR_R_SYS_LIB);\n\t\tgoto err;\n\t\t}\n\tsection=(char *)Malloc(10);\n\tif (section == NULL)\n\t\t{\n\t\tCONFerr(CONF_F_CONF_LOAD,ERR_R_MALLOC_FAILURE);\n\t\tgoto err;\n\t\t}\n\tstrcpy(section,"default");\n\tif (h == NULL)\n\t\t{\n\t\tif ((ret=lh_new(hash,cmp)) == NULL)\n\t\t\t{\n\t\t\tCONFerr(CONF_F_CONF_LOAD,ERR_R_MALLOC_FAILURE);\n\t\t\tgoto err;\n\t\t\t}\n\t\t}\n\telse\n\t\tret=h;\n\tsv=new_section(ret,section);\n\tif (sv == NULL)\n\t\t{\n\t\tCONFerr(CONF_F_CONF_LOAD,CONF_R_UNABLE_TO_CREATE_NEW_SECTION);\n\t\tgoto err;\n\t\t}\n\tsection_sk=(STACK *)sv->value;\n\tbufnum=0;\n\tfor (;;)\n\t\t{\n\t\tagain=0;\n\t\tif (!BUF_MEM_grow(buff,bufnum+BUFSIZE))\n\t\t\t{\n\t\t\tCONFerr(CONF_F_CONF_LOAD,ERR_R_BUF_LIB);\n\t\t\tgoto err;\n\t\t\t}\n\t\tp= &(buff->data[bufnum]);\n\t\t*p=\'\\0\';\n\t\tfgets(p,BUFSIZE-1,in);\n\t\tp[BUFSIZE-1]=\'\\0\';\n\t\tii=i=strlen(p);\n\t\tif (i == 0) break;\n\t\twhile (i > 0)\n\t\t\t{\n\t\t\tif ((p[i-1] != \'\\r\') && (p[i-1] != \'\\n\'))\n\t\t\t\tbreak;\n\t\t\telse\n\t\t\t\ti--;\n\t\t\t}\n\t\tif (i == ii)\n\t\t\tagain=1;\n\t\telse\n\t\t\t{\n\t\t\tp[i]=\'\\0\';\n\t\t\teline++;\n\t\t\t}\n\t\tbufnum+=i;\n\t\tv=NULL;\n\t\tif (bufnum >= 1)\n\t\t\t{\n\t\t\tp= &(buff->data[bufnum-1]);\n\t\t\tif (\tIS_ESC(p[0]) &&\n\t\t\t\t((bufnum <= 1) || !IS_ESC(p[-1])))\n\t\t\t\t{\n\t\t\t\tbufnum--;\n\t\t\t\tagain=1;\n\t\t\t\t}\n\t\t\t}\n\t\tif (again) continue;\n\t\tbufnum=0;\n\t\tbuf=buff->data;\n\t\tclear_comments(buf);\n\t\tn=strlen(buf);\n\t\ts=eat_ws(buf);\n\t\tif (IS_EOF(*s)) continue;\n\t\tif (*s == \'[\')\n\t\t\t{\n\t\t\tchar *ss;\n\t\t\ts++;\n\t\t\tstart=eat_ws(s);\n\t\t\tss=start;\nagain:\n\t\t\tend=eat_alpha_numeric(ss);\n\t\t\tp=eat_ws(end);\n\t\t\tif (*p != \']\')\n\t\t\t\t{\n\t\t\t\tif (*p != \'\\0\')\n\t\t\t\t\t{\n\t\t\t\t\tss=p;\n\t\t\t\t\tgoto again;\n\t\t\t\t\t}\n\t\t\t\tCONFerr(CONF_F_CONF_LOAD,CONF_R_MISSING_CLOSE_SQUARE_BRACKET);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\t*end=\'\\0\';\n\t\t\tif (!str_copy(ret,NULL,&section,start)) goto err;\n\t\t\tif ((sv=get_section(ret,section)) == NULL)\n\t\t\t\tsv=new_section(ret,section);\n\t\t\tif (sv == NULL)\n\t\t\t\t{\n\t\t\t\tCONFerr(CONF_F_CONF_LOAD,CONF_R_UNABLE_TO_CREATE_NEW_SECTION);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tsection_sk=(STACK *)sv->value;\n\t\t\tcontinue;\n\t\t\t}\n\t\telse\n\t\t\t{\n\t\t\tpname=s;\n\t\t\tpsection=NULL;\n\t\t\tend=eat_alpha_numeric(s);\n\t\t\tif ((end[0] == \':\') && (end[1] == \':\'))\n\t\t\t\t{\n\t\t\t\t*end=\'\\0\';\n\t\t\t\tend+=2;\n\t\t\t\tpsection=pname;\n\t\t\t\tpname=end;\n\t\t\t\tend=eat_alpha_numeric(end);\n\t\t\t\t}\n\t\t\tp=eat_ws(end);\n\t\t\tif (*p != \'=\')\n\t\t\t\t{\n\t\t\t\tCONFerr(CONF_F_CONF_LOAD,CONF_R_MISSING_EQUAL_SIGN);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\t*end=\'\\0\';\n\t\t\tp++;\n\t\t\tstart=eat_ws(p);\n\t\t\twhile (!IS_EOF(*p))\n\t\t\t\tp++;\n\t\t\tp--;\n\t\t\twhile ((p != start) && (IS_WS(*p)))\n\t\t\t\tp--;\n\t\t\tp++;\n\t\t\t*p=\'\\0\';\n\t\t\tif ((v=(CONF_VALUE *)Malloc(sizeof(CONF_VALUE))) == NULL)\n\t\t\t\t{\n\t\t\t\tCONFerr(CONF_F_CONF_LOAD,ERR_R_MALLOC_FAILURE);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tif (psection == NULL) psection=section;\n\t\t\tv->name=(char *)Malloc(strlen(pname)+1);\n\t\t\tv->value=NULL;\n\t\t\tif (v->name == NULL)\n\t\t\t\t{\n\t\t\t\tCONFerr(CONF_F_CONF_LOAD,ERR_R_MALLOC_FAILURE);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tstrcpy(v->name,pname);\n\t\t\tif (!str_copy(ret,psection,&(v->value),start)) goto err;\n\t\t\tif (strcmp(psection,section) != 0)\n\t\t\t\t{\n\t\t\t\tif ((tv=get_section(ret,psection))\n\t\t\t\t\t== NULL)\n\t\t\t\t\ttv=new_section(ret,psection);\n\t\t\t\tif (tv == NULL)\n\t\t\t\t\t{\n\t\t\t\t\tCONFerr(CONF_F_CONF_LOAD,CONF_R_UNABLE_TO_CREATE_NEW_SECTION);\n\t\t\t\t\tgoto err;\n\t\t\t\t\t}\n\t\t\t\tts=(STACK *)tv->value;\n\t\t\t\t}\n\t\t\telse\n\t\t\t\t{\n\t\t\t\ttv=sv;\n\t\t\t\tts=section_sk;\n\t\t\t\t}\n\t\t\tv->section=tv->section;\n\t\t\tif (!sk_push(ts,(char *)v))\n\t\t\t\t{\n\t\t\t\tCONFerr(CONF_F_CONF_LOAD,ERR_R_MALLOC_FAILURE);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tvv=(CONF_VALUE *)lh_insert(ret,(char *)v);\n\t\t\tif (vv != NULL)\n\t\t\t\t{\n\t\t\t\tsk_delete_ptr(ts,(char *)vv);\n\t\t\t\tFree(vv->name);\n\t\t\t\tFree(vv->value);\n\t\t\t\tFree(vv);\n\t\t\t\t}\n\t\t\tv=NULL;\n\t\t\t}\n\t\t}\n\tif (buff != NULL) BUF_MEM_free(buff);\n\tif (section != NULL) Free(section);\n\tif (in != NULL) fclose(in);\n\treturn(ret);\nerr:\n\tif (buff != NULL) BUF_MEM_free(buff);\n\tif (section != NULL) Free(section);\n\tif (line != NULL) *line=eline;\n\tsprintf(btmp,"%ld",eline);\n\tERR_add_error_data(2,"line ",btmp);\n\tif (in != NULL) fclose(in);\n\tif ((h != ret) && (ret != NULL)) CONF_free(ret);\n\tif (v != NULL)\n\t\t{\n\t\tif (v->name != NULL) Free(v->name);\n\t\tif (v->value != NULL) Free(v->value);\n\t\tif (v != NULL) Free(v);\n\t\t}\n\treturn(NULL);\n\t}', 'int EVP_DecodeBlock(unsigned char *t, unsigned char *f, int n)\n\t{\n\tint i,ret=0,a,b,c,d;\n\tunsigned long l;\n\twhile ((conv_ascii2bin(*f) == B64_WS) && (n > 0))\n\t\t{\n\t\tf++;\n\t\tn--;\n\t\t}\n\twhile ((n > 3) && (B64_NOT_BASE64(conv_ascii2bin(f[n-1]))))\n\t\tn--;\n\tif (n%4 != 0) return(-1);\n\tfor (i=0; i<n; i+=4)\n\t\t{\n\t\ta=conv_ascii2bin(*(f++));\n\t\tb=conv_ascii2bin(*(f++));\n\t\tc=conv_ascii2bin(*(f++));\n\t\td=conv_ascii2bin(*(f++));\n\t\tif (\t(a & 0x80) || (b & 0x80) ||\n\t\t\t(c & 0x80) || (d & 0x80))\n\t\t\treturn(-1);\n\t\tl=(\t(((unsigned long)a)<<18L)|\n\t\t\t(((unsigned long)b)<<12L)|\n\t\t\t(((unsigned long)c)<< 6L)|\n\t\t\t(((unsigned long)d)     ));\n\t\t*(t++)=(unsigned char)(l>>16L)&0xff;\n\t\t*(t++)=(unsigned char)(l>> 8L)&0xff;\n\t\t*(t++)=(unsigned char)(l     )&0xff;\n\t\tret+=3;\n\t\t}\n\treturn(ret);\n\t}']