crypto/asn1/t_pkey.c:306: error: BUFFER_OVERRUN_L3
  Offset: 1 Size: [0, +oo] by call to `print`.
Showing all 9 steps of the trace


crypto/asn1/t_pkey.c:295:4: Call
293.   	int reason=ERR_R_BUF_LIB,i,ret=0;
294.   
295.   	i=BN_num_bytes(x->p);
          ^
296.   	m=(unsigned char *)Malloc((unsigned int)i+10);
297.   	if (m == NULL)

crypto/bn/bn_lib.c:245:19: Assignment
  243.   	bn_check_top(a);
  244.   
  245.   	if (a->top == 0) return(0);
                           ^
  246.   	l=a->d[a->top-1];
  247.   	i=(a->top-1)*BN_BITS2;

crypto/asn1/t_pkey.c:295:2: Assignment
293.   	int reason=ERR_R_BUF_LIB,i,ret=0;
294.   
295.   	i=BN_num_bytes(x->p);
        ^
296.   	m=(unsigned char *)Malloc((unsigned int)i+10);
297.   	if (m == NULL)

crypto/asn1/t_pkey.c:296:21: Array declaration
294.   
295.   	i=BN_num_bytes(x->p);
296.   	m=(unsigned char *)Malloc((unsigned int)i+10);
                           ^
297.   	if (m == NULL)
298.   		{

crypto/asn1/t_pkey.c:296:2: Assignment
294.   
295.   	i=BN_num_bytes(x->p);
296.   	m=(unsigned char *)Malloc((unsigned int)i+10);
        ^
297.   	if (m == NULL)
298.   		{

crypto/asn1/t_pkey.c:306:7: Call
304.   		BN_num_bits(x->p)) <= 0)
305.   		goto err;
306.   	if (!print(bp,"prime:",x->p,m,4)) goto err;
             ^
307.   	if (!print(bp,"generator:",x->g,m,4)) goto err;
308.   	if (x->length != 0)

crypto/asn1/t_pkey.c:221:1: <Length trace>
219.   #endif /* !NO_DSA */
220.   
221. > static int print(BIO *bp, const char *number, BIGNUM *num, unsigned char *buf,
222.   	     int off)
223.   	{

crypto/asn1/t_pkey.c:221:1: Parameter `*buf`
  219.   #endif /* !NO_DSA */
  220.   
  221. > static int print(BIO *bp, const char *number, BIGNUM *num, unsigned char *buf,
  222.   	     int off)
  223.   	{

crypto/asn1/t_pkey.c:251:7: Array access: Offset: 1 Size: [0, +oo] by call to `print` 
  249.   		n=BN_bn2bin(num,&buf[1]);
  250.   	
  251.   		if (buf[1] & 0x80)
               ^
  252.   			n++;
  253.   		else	buf++;

static int print(BIO *bp, const char *number, BIGNUM *num, unsigned char *buf,
	     int off)
	{
	int n,i;
	char str[128];
	const char *neg;
	if (num == NULL) return(1);
	neg=(num->neg)?"-":"";
	if (off)
		{
		if (off > 128) off=128;
		memset(str,' ',off);
		if (BIO_write(bp,str,off) <= 0) return(0);
		}
	if (BN_num_bytes(num) <= BN_BYTES)
		{
		if (BIO_printf(bp,"%s %s%lu (%s0x%lx)\n",number,neg,
			(unsigned long)num->d[0],neg,(unsigned long)num->d[0])
			<= 0) return(0);
		}
	else
		{
		buf[0]=0;
		if (BIO_printf(bp,"%s%s",number,
			(neg[0] == '-')?" (Negative)":"") <= 0)
			return(0);
		n=BN_bn2bin(num,&buf[1]);
		if (buf[1] & 0x80)
			n++;
		else	buf++;
		for (i=0; i<n; i++)
			{
			if ((i%15) == 0)
				{
				str[0]='\n';
				memset(&(str[1]),' ',off+4);
				if (BIO_write(bp,str,off+1+4) <= 0) return(0);
				}
			if (BIO_printf(bp,"%02x%s",buf[i],((i+1) == n)?"":":")
				<= 0) return(0);
			}
		if (BIO_write(bp,"\n",1) <= 0) return(0);
		}
	return(1);
	}
['int DHparams_print(BIO *bp, DH *x)\n\t{\n\tunsigned char *m=NULL;\n\tint reason=ERR_R_BUF_LIB,i,ret=0;\n\ti=BN_num_bytes(x->p);\n\tm=(unsigned char *)Malloc((unsigned int)i+10);\n\tif (m == NULL)\n\t\t{\n\t\treason=ERR_R_MALLOC_FAILURE;\n\t\tgoto err;\n\t\t}\n\tif (BIO_printf(bp,"Diffie-Hellman-Parameters: (%d bit)\\n",\n\t\tBN_num_bits(x->p)) <= 0)\n\t\tgoto err;\n\tif (!print(bp,"prime:",x->p,m,4)) goto err;\n\tif (!print(bp,"generator:",x->g,m,4)) goto err;\n\tif (x->length != 0)\n\t\t{\n\t\tif (BIO_printf(bp,"    recomented-private-length: %d bits\\n",\n\t\t\t(int)x->length) <= 0) goto err;\n\t\t}\n\tret=1;\n\tif (0)\n\t\t{\nerr:\n\t\tDHerr(DH_F_DHPARAMS_PRINT,reason);\n\t\t}\n\tif (m != NULL) Free((char *)m);\n\treturn(ret);\n\t}', 'int BN_num_bits(BIGNUM *a)\n\t{\n\tBN_ULONG l;\n\tint i;\n\tbn_check_top(a);\n\tif (a->top == 0) return(0);\n\tl=a->d[a->top-1];\n\ti=(a->top-1)*BN_BITS2;\n\tif (l == 0)\n\t\t{\n#if !defined(NO_STDIO) && !defined(WIN16)\n\t\tfprintf(stderr,"BAD TOP VALUE\\n");\n#endif\n\t\tabort();\n\t\t}\n\treturn(i+BN_num_bits_word(l));\n\t}', 'static int print(BIO *bp, const char *number, BIGNUM *num, unsigned char *buf,\n\t     int off)\n\t{\n\tint n,i;\n\tchar str[128];\n\tconst char *neg;\n\tif (num == NULL) return(1);\n\tneg=(num->neg)?"-":"";\n\tif (off)\n\t\t{\n\t\tif (off > 128) off=128;\n\t\tmemset(str,\' \',off);\n\t\tif (BIO_write(bp,str,off) <= 0) return(0);\n\t\t}\n\tif (BN_num_bytes(num) <= BN_BYTES)\n\t\t{\n\t\tif (BIO_printf(bp,"%s %s%lu (%s0x%lx)\\n",number,neg,\n\t\t\t(unsigned long)num->d[0],neg,(unsigned long)num->d[0])\n\t\t\t<= 0) return(0);\n\t\t}\n\telse\n\t\t{\n\t\tbuf[0]=0;\n\t\tif (BIO_printf(bp,"%s%s",number,\n\t\t\t(neg[0] == \'-\')?" (Negative)":"") <= 0)\n\t\t\treturn(0);\n\t\tn=BN_bn2bin(num,&buf[1]);\n\t\tif (buf[1] & 0x80)\n\t\t\tn++;\n\t\telse\tbuf++;\n\t\tfor (i=0; i<n; i++)\n\t\t\t{\n\t\t\tif ((i%15) == 0)\n\t\t\t\t{\n\t\t\t\tstr[0]=\'\\n\';\n\t\t\t\tmemset(&(str[1]),\' \',off+4);\n\t\t\t\tif (BIO_write(bp,str,off+1+4) <= 0) return(0);\n\t\t\t\t}\n\t\t\tif (BIO_printf(bp,"%02x%s",buf[i],((i+1) == n)?"":":")\n\t\t\t\t<= 0) return(0);\n\t\t\t}\n\t\tif (BIO_write(bp,"\\n",1) <= 0) return(0);\n\t\t}\n\treturn(1);\n\t}']