crypto/pkcs12/p12_crt.c:119: error: BUFFER_OVERRUN_L3
  Offset: [0, 3] Size: [0, +oo] by call to `sk_pop_free`.
Showing all 15 steps of the trace


crypto/pkcs12/p12_crt.c:108:15: Call
106.   		for(i = 0; i < sk_num(ca); i++) {
107.   			tcert = (X509 *)sk_value(ca, i);
108.   			if(!(bag = M_PKCS12_x5092certbag(tcert))) return NULL;
                     ^
109.   			if(!sk_push(bags, (char *)bag)) {
110.   				PKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE);

crypto/pkcs12/p12_add.c:79:18: Call
  77.   		return NULL;
  78.   	}
  79.   	if (!(safebag = PKCS12_SAFEBAG_new ())) {
                         ^
  80.   		PKCS12err(PKCS12_F_PKCS12_PACK_SAFEBAG, ERR_R_MALLOC_FAILURE);
  81.   		return NULL;

crypto/pkcs12/p12_sbag.c:154:2: Call
    152.   	ret->type=NULL;
    153.   	ret->value.other=NULL;
    154.   	M_ASN1_New(ret->attrib, sk_new_null);
            ^
    155.   	ret->rest=NULL;
    156.   	return (ret);

crypto/stack/stack.c:124:26: Array declaration
      122.   	if ((ret=(STACK *)Malloc(sizeof(STACK))) == NULL)
      123.   		goto err0;
      124.   	if ((ret->data=(char **)Malloc(sizeof(char *)*MIN_NODES)) == NULL)
                                      ^
      125.   		goto err1;
      126.   	for (i=0; i<MIN_NODES; i++)

crypto/stack/stack.c:124:7: Assignment
      122.   	if ((ret=(STACK *)Malloc(sizeof(STACK))) == NULL)
      123.   		goto err0;
      124.   	if ((ret->data=(char **)Malloc(sizeof(char *)*MIN_NODES)) == NULL)
                   ^
      125.   		goto err1;
      126.   	for (i=0; i<MIN_NODES; i++)

crypto/pkcs12/p12_crt.c:109:8: Call
107.   			tcert = (X509 *)sk_value(ca, i);
108.   			if(!(bag = M_PKCS12_x5092certbag(tcert))) return NULL;
109.   			if(!sk_push(bags, (char *)bag)) {
              ^
110.   				PKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE);
111.   				return NULL;

crypto/stack/stack.c:239:1: Parameter `*st->data`
  237.   	}
  238.   
  239. > int sk_push(STACK *st, char *data)
  240.   	{
  241.   	return(sk_insert(st,data,st->num));

crypto/stack/stack.c:241:9: Call
  239.   int sk_push(STACK *st, char *data)
  240.   	{
  241.   	return(sk_insert(st,data,st->num));
                 ^
  242.   	}
  243.   

crypto/stack/stack.c:139:1: Parameter `*st->data`
    137.   	}
    138.   
    139. > int sk_insert(STACK *st, char *data, int loc)
    140.   	{
    141.   	char **s;

crypto/pkcs12/p12_crt.c:119:2: Call
117.   	authsafe = PKCS12_pack_p7encdata (nid_cert, pass, -1, NULL, 0,
118.   					  iter, bags);
119.   	sk_pop_free(bags, PKCS12_SAFEBAG_free);
        ^
120.   
121.   	if (!authsafe) return NULL;

crypto/stack/stack.c:271:1: <Offset trace>
269.   	}
270.   
271. > void sk_pop_free(STACK *st, void (*func)())
272.   	{
273.   	int i;

crypto/stack/stack.c:271:1: Parameter `st->num`
  269.   	}
  270.   
  271. > void sk_pop_free(STACK *st, void (*func)())
  272.   	{
  273.   	int i;

crypto/stack/stack.c:271:1: <Length trace>
269.   	}
270.   
271. > void sk_pop_free(STACK *st, void (*func)())
272.   	{
273.   	int i;

crypto/stack/stack.c:271:1: Parameter `*st->data`
  269.   	}
  270.   
  271. > void sk_pop_free(STACK *st, void (*func)())
  272.   	{
  273.   	int i;

crypto/stack/stack.c:277:7: Array access: Offset: [0, 3] Size: [0, +oo] by call to `sk_pop_free` 
  275.   	if (st == NULL) return;
  276.   	for (i=0; i<st->num; i++)
  277.   		if (st->data[i] != NULL)
               ^
  278.   			func(st->data[i]);
  279.   	sk_free(st);

void sk_pop_free(STACK *st, void (*func)())
	{
	int i;
	if (st == NULL) return;
	for (i=0; i<st->num; i++)
		if (st->data[i] != NULL)
			func(st->data[i]);
	sk_free(st);
	}
['PKCS12 *PKCS12_create(char *pass, char *name, EVP_PKEY *pkey, X509 *cert,\n\t     STACK *ca, int nid_key, int nid_cert, int iter, int mac_iter,\n\t     int keytype)\n{\n\tPKCS12 *p12;\n\tSTACK *bags, *safes;\n\tPKCS12_SAFEBAG *bag;\n\tPKCS8_PRIV_KEY_INFO *p8;\n\tPKCS7 *authsafe;\n\tX509 *tcert;\n\tint i;\n\tunsigned char keyid[EVP_MAX_MD_SIZE];\n\tunsigned int keyidlen;\n\tif(!nid_cert) nid_cert = NID_pbe_WithSHA1And40BitRC2_CBC;\n\tif(!nid_key) nid_key = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;\n\tif(!iter) iter = 1000;\n\tif(!mac_iter) mac_iter = 1;\n\tif(!pkey || !cert) {\n\t\tPKCS12err(PKCS12_F_PKCS12_CREATE,PKCS12_R_INVALID_NULL_ARGUMENT);\n\t\treturn NULL;\n\t}\n\tif(!(bags = sk_new (NULL))) {\n\t\tPKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE);\n\t\treturn NULL;\n\t}\n\tif(!(bag = M_PKCS12_x5092certbag(cert))) return NULL;\n\tif(name && !PKCS12_add_friendlyname(bag, name, -1)) return NULL;\n\tX509_digest(cert, EVP_sha1(), keyid, &keyidlen);\n\tif(!PKCS12_add_localkeyid(bag, keyid, keyidlen)) return NULL;\n\tif(!sk_push(bags, (char *)bag)) {\n\t\tPKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE);\n\t\treturn NULL;\n\t}\n\tif(ca) {\n\t\tfor(i = 0; i < sk_num(ca); i++) {\n\t\t\ttcert = (X509 *)sk_value(ca, i);\n\t\t\tif(!(bag = M_PKCS12_x5092certbag(tcert))) return NULL;\n\t\t\tif(!sk_push(bags, (char *)bag)) {\n\t\t\t\tPKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE);\n\t\t\t\treturn NULL;\n\t\t\t}\n\t\t}\n\t}\n\tauthsafe = PKCS12_pack_p7encdata (nid_cert, pass, -1, NULL, 0,\n\t\t\t\t\t  iter, bags);\n\tsk_pop_free(bags, PKCS12_SAFEBAG_free);\n\tif (!authsafe) return NULL;\n\tif(!(safes = sk_new (NULL)) || !sk_push(safes, (char *)authsafe)) {\n\t\tPKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE);\n\t\treturn NULL;\n\t}\n\tif(!(p8 = EVP_PKEY2PKCS8 (pkey))) return NULL;\n\tif(keytype && !PKCS8_add_keyusage(p8, keytype)) return NULL;\n\tbag = PKCS12_MAKE_SHKEYBAG (nid_key, pass, -1, NULL, 0, iter, p8);\n\tif(!bag) return NULL;\n\tPKCS8_PRIV_KEY_INFO_free(p8);\n        if (name && !PKCS12_add_friendlyname (bag, name, -1)) return NULL;\n\tif(!PKCS12_add_localkeyid (bag, keyid, keyidlen)) return NULL;\n\tif(!(bags = sk_new(NULL)) || !sk_push (bags, (char *)bag)) {\n\t\tPKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE);\n\t\treturn NULL;\n\t}\n\tif(!(authsafe = PKCS12_pack_p7data (bags))) return NULL;\n\tsk_pop_free(bags, PKCS12_SAFEBAG_free);\n\tif(!sk_push(safes, (char *)authsafe)) {\n\t\tPKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE);\n\t\treturn NULL;\n\t}\n\tif(!(p12 = PKCS12_init (NID_pkcs7_data))) return NULL;\n\tif(!M_PKCS12_pack_authsafes (p12, safes)) return NULL;\n\tsk_pop_free(safes, PKCS7_free);\n\tif(!PKCS12_set_mac (p12, pass, -1, NULL, 0, mac_iter, NULL))\n\t    return NULL;\n\treturn p12;\n}', 'PKCS12_SAFEBAG *PKCS12_pack_safebag (char *obj, int (*i2d)(), int nid1,\n\t     int nid2)\n{\n\tPKCS12_BAGS *bag;\n\tPKCS12_SAFEBAG *safebag;\n\tif (!(bag = PKCS12_BAGS_new ())) {\n\t\tPKCS12err(PKCS12_F_PKCS12_PACK_SAFEBAG, ERR_R_MALLOC_FAILURE);\n\t\treturn NULL;\n\t}\n\tbag->type = OBJ_nid2obj(nid1);\n\tif (!ASN1_pack_string(obj, i2d, &bag->value.octet)) {\n\t\tPKCS12err(PKCS12_F_PKCS12_PACK_SAFEBAG, ERR_R_MALLOC_FAILURE);\n\t\treturn NULL;\n\t}\n\tif (!(safebag = PKCS12_SAFEBAG_new ())) {\n\t\tPKCS12err(PKCS12_F_PKCS12_PACK_SAFEBAG, ERR_R_MALLOC_FAILURE);\n\t\treturn NULL;\n\t}\n\tsafebag->value.bag = bag;\n\tsafebag->type = OBJ_nid2obj(nid2);\n\treturn safebag;\n}', 'PKCS12_SAFEBAG *PKCS12_SAFEBAG_new(void)\n{\n\tPKCS12_SAFEBAG *ret=NULL;\n\tASN1_CTX c;\n\tM_ASN1_New_Malloc(ret, PKCS12_SAFEBAG);\n\tret->type=NULL;\n\tret->value.other=NULL;\n\tM_ASN1_New(ret->attrib, sk_new_null);\n\tret->rest=NULL;\n\treturn (ret);\n\tM_ASN1_New_Error(ASN1_F_PKCS12_SAFEBAG_NEW);\n}', 'STACK *sk_new(int (*c)())\n\t{\n\tSTACK *ret;\n\tint i;\n\tif ((ret=(STACK *)Malloc(sizeof(STACK))) == NULL)\n\t\tgoto err0;\n\tif ((ret->data=(char **)Malloc(sizeof(char *)*MIN_NODES)) == NULL)\n\t\tgoto err1;\n\tfor (i=0; i<MIN_NODES; i++)\n\t\tret->data[i]=NULL;\n\tret->comp=c;\n\tret->num_alloc=MIN_NODES;\n\tret->num=0;\n\tret->sorted=0;\n\treturn(ret);\nerr1:\n\tFree((char *)ret);\nerr0:\n\treturn(NULL);\n\t}', 'int sk_push(STACK *st, char *data)\n\t{\n\treturn(sk_insert(st,data,st->num));\n\t}', 'int sk_insert(STACK *st, char *data, int loc)\n\t{\n\tchar **s;\n\tif (st->num_alloc <= st->num+1)\n\t\t{\n\t\ts=(char **)Realloc((char *)st->data,\n\t\t\t(unsigned int)sizeof(char *)*st->num_alloc*2);\n\t\tif (s == NULL)\n\t\t\treturn(0);\n\t\tst->data=s;\n\t\tst->num_alloc*=2;\n\t\t}\n\tif ((loc >= (int)st->num) || (loc < 0))\n\t\tst->data[st->num]=data;\n\telse\n\t\t{\n\t\tint i;\n\t\tchar **f,**t;\n\t\tf=(char **)st->data;\n\t\tt=(char **)&(st->data[1]);\n\t\tfor (i=st->num; i>=loc; i--)\n\t\t\tt[i]=f[i];\n#ifdef undef\n\t\tmemmove( (char *)&(st->data[loc+1]),\n\t\t\t(char *)&(st->data[loc]),\n\t\t\tsizeof(char *)*(st->num-loc));\n#endif\n\t\tst->data[loc]=data;\n\t\t}\n\tst->num++;\n\tst->sorted=0;\n\treturn(st->num);\n\t}', 'void sk_pop_free(STACK *st, void (*func)())\n\t{\n\tint i;\n\tif (st == NULL) return;\n\tfor (i=0; i<st->num; i++)\n\t\tif (st->data[i] != NULL)\n\t\t\tfunc(st->data[i]);\n\tsk_free(st);\n\t}']