crypto/ts/ts_rsp_sign.c:870: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] (⇐ [2, +oo] + [0, +oo]) Size: [1, +oo] by call to `i2d_ESS_SIGNING_CERT`.
Showing all 34 steps of the trace


crypto/ts/ts_rsp_sign.c:864:11: Call
862.       int len;
863.   
864.       len = i2d_ESS_SIGNING_CERT(sc, NULL);
                 ^
865.       if ((pp = OPENSSL_malloc(len)) == NULL) {
866.           TSerr(TS_F_ESS_ADD_SIGNING_CERT, ERR_R_MALLOC_FAILURE);

crypto/ts/ts_asn1.c:274:1: Call
  272.   } static_ASN1_SEQUENCE_END(ESS_SIGNING_CERT)
  273.   
  274. > IMPLEMENT_ASN1_FUNCTIONS_const(ESS_SIGNING_CERT)
  275.   IMPLEMENT_ASN1_DUP_FUNCTION(ESS_SIGNING_CERT)
  276.   

crypto/asn1/tasn_enc.c:94:12: Call
    92.   int ASN1_item_i2d(ASN1_VALUE *val, unsigned char **out, const ASN1_ITEM *it)
    93.   {
    94.       return asn1_item_flags_i2d(val, out, it, 0);
                     ^
    95.   }
    96.   

crypto/asn1/tasn_enc.c:115:13: Assignment
      113.           buf = OPENSSL_malloc(len);
      114.           if (buf == NULL)
      115.               return -1;
                         ^
      116.           p = buf;
      117.           ASN1_item_ex_i2d(&val, &p, it, -1, flags);

crypto/asn1/tasn_enc.c:94:5: Assignment
    92.   int ASN1_item_i2d(ASN1_VALUE *val, unsigned char **out, const ASN1_ITEM *it)
    93.   {
    94.       return asn1_item_flags_i2d(val, out, it, 0);
              ^
    95.   }
    96.   

crypto/ts/ts_asn1.c:274:1: Assignment
  272.   } static_ASN1_SEQUENCE_END(ESS_SIGNING_CERT)
  273.   
  274. > IMPLEMENT_ASN1_FUNCTIONS_const(ESS_SIGNING_CERT)
  275.   IMPLEMENT_ASN1_DUP_FUNCTION(ESS_SIGNING_CERT)
  276.   

crypto/ts/ts_rsp_sign.c:864:5: Assignment
862.       int len;
863.   
864.       len = i2d_ESS_SIGNING_CERT(sc, NULL);
           ^
865.       if ((pp = OPENSSL_malloc(len)) == NULL) {
866.           TSerr(TS_F_ESS_ADD_SIGNING_CERT, ERR_R_MALLOC_FAILURE);

crypto/ts/ts_rsp_sign.c:865:15: Call
863.   
864.       len = i2d_ESS_SIGNING_CERT(sc, NULL);
865.       if ((pp = OPENSSL_malloc(len)) == NULL) {
                     ^
866.           TSerr(TS_F_ESS_ADD_SIGNING_CERT, ERR_R_MALLOC_FAILURE);
867.           goto err;

crypto/mem.c:125:9: Assignment
  123.   
  124.       if (num <= 0)
  125.           return NULL;
                 ^
  126.   
  127.       allow_customize = 0;

crypto/ts/ts_rsp_sign.c:865:10: Assignment
863.   
864.       len = i2d_ESS_SIGNING_CERT(sc, NULL);
865.       if ((pp = OPENSSL_malloc(len)) == NULL) {
                ^
866.           TSerr(TS_F_ESS_ADD_SIGNING_CERT, ERR_R_MALLOC_FAILURE);
867.           goto err;

crypto/ts/ts_rsp_sign.c:869:5: Assignment
867.           goto err;
868.       }
869.       p = pp;
           ^
870.       i2d_ESS_SIGNING_CERT(sc, &p);
871.       if ((seq = ASN1_STRING_new()) == NULL || !ASN1_STRING_set(seq, pp, len)) {

crypto/ts/ts_rsp_sign.c:870:5: Call
868.       }
869.       p = pp;
870.       i2d_ESS_SIGNING_CERT(sc, &p);
           ^
871.       if ((seq = ASN1_STRING_new()) == NULL || !ASN1_STRING_set(seq, pp, len)) {
872.           TSerr(TS_F_ESS_ADD_SIGNING_CERT, ERR_R_MALLOC_FAILURE);

crypto/ts/ts_asn1.c:274:1: Parameter `**out`
  272.   } static_ASN1_SEQUENCE_END(ESS_SIGNING_CERT)
  273.   
  274. > IMPLEMENT_ASN1_FUNCTIONS_const(ESS_SIGNING_CERT)
  275.   IMPLEMENT_ASN1_DUP_FUNCTION(ESS_SIGNING_CERT)
  276.   

crypto/ts/ts_asn1.c:274:1: Call
  272.   } static_ASN1_SEQUENCE_END(ESS_SIGNING_CERT)
  273.   
  274. > IMPLEMENT_ASN1_FUNCTIONS_const(ESS_SIGNING_CERT)
  275.   IMPLEMENT_ASN1_DUP_FUNCTION(ESS_SIGNING_CERT)
  276.   

crypto/asn1/tasn_enc.c:92:1: Parameter `**out`
    90.   }
    91.   
    92. > int ASN1_item_i2d(ASN1_VALUE *val, unsigned char **out, const ASN1_ITEM *it)
    93.   {
    94.       return asn1_item_flags_i2d(val, out, it, 0);

crypto/asn1/tasn_enc.c:94:12: Call
    92.   int ASN1_item_i2d(ASN1_VALUE *val, unsigned char **out, const ASN1_ITEM *it)
    93.   {
    94.       return asn1_item_flags_i2d(val, out, it, 0);
                     ^
    95.   }
    96.   

crypto/asn1/tasn_enc.c:104:1: Parameter `**out`
      102.    */
      103.   
      104. > static int asn1_item_flags_i2d(ASN1_VALUE *val, unsigned char **out,
      105.                                  const ASN1_ITEM *it, int flags)
      106.   {

crypto/asn1/tasn_enc.c:122:12: Call
      120.       }
      121.   
      122.       return ASN1_item_ex_i2d(&val, out, it, -1, flags);
                        ^
      123.   }
      124.   

crypto/asn1/tasn_enc.c:130:1: Parameter `**out`
        128.    */
        129.   
        130. > int ASN1_item_ex_i2d(ASN1_VALUE **pval, unsigned char **out,
        131.                        const ASN1_ITEM *it, int tag, int aclass)
        132.   {

crypto/asn1/tasn_enc.c:154:16: Call
        152.   
        153.       case ASN1_ITYPE_MSTRING:
        154.           return asn1_i2d_ex_primitive(pval, out, it, -1, aclass);
                              ^
        155.   
        156.       case ASN1_ITYPE_CHOICE:

crypto/asn1/tasn_enc.c:472:1: Parameter `**out`
          470.   }
          471.   
          472. > static int asn1_i2d_ex_primitive(ASN1_VALUE **pval, unsigned char **out,
          473.                                    const ASN1_ITEM *it, int tag, int aclass)
          474.   {

crypto/asn1/tasn_enc.c:517:13: Call
          515.       if (out) {
          516.           if (usetag)
          517.               ASN1_put_object(out, ndef, len, tag, aclass);
                             ^
          518.           asn1_ex_i2c(pval, *out, &utype, it);
          519.           if (ndef)

crypto/asn1/asn1_lib.c:196:1: Parameter `**pp`
            194.    * class 0 is constructed constructed == 2 for indefinite length constructed
            195.    */
            196. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
            197.                        int xclass)
            198.   {

crypto/asn1/asn1_lib.c:199:5: Assignment
            197.                        int xclass)
            198.   {
            199.       unsigned char *p = *pp;
                       ^
            200.       int i, ttag;
            201.   

crypto/asn1/asn1_lib.c:205:11: Assignment
            203.       i |= (xclass & V_ASN1_PRIVATE);
            204.       if (tag < 31)
            205.           *(p++) = i | (tag & V_ASN1_PRIMITIVE_TAG);
                             ^
            206.       else {
            207.           *(p++) = i | V_ASN1_PRIMITIVE_TAG;

crypto/asn1/asn1_lib.c:222:9: Call
            220.           *(p++) = 0x80;
            221.       else
            222.           asn1_put_length(&p, length);
                           ^
            223.       *pp = p;
            224.   }

crypto/asn1/asn1_lib.c:243:14: <Offset trace>
241.       else {
242.           l = length;
243.           for (i = 0; l > 0; i++)
                    ^
244.               l >>= 8;
245.           *(p++) = i | 0x80;

crypto/asn1/asn1_lib.c:243:14: Assignment
              241.       else {
              242.           l = length;
              243.           for (i = 0; l > 0; i++)
                                  ^
              244.               l >>= 8;
              245.           *(p++) = i | 0x80;

crypto/asn1/asn1_lib.c:247:16: Assignment
              245.           *(p++) = i | 0x80;
              246.           l = i;
              247.           while (i-- > 0) {
                                    ^
              248.               p[i] = length & 0xff;
              249.               length >>= 8;

crypto/asn1/asn1_lib.c:235:1: <Length trace>
233.   }
234.   
235. > static void asn1_put_length(unsigned char **pp, int length)
236.   {
237.       unsigned char *p = *pp;

crypto/asn1/asn1_lib.c:235:1: Parameter `**pp`
              233.   }
              234.   
              235. > static void asn1_put_length(unsigned char **pp, int length)
              236.   {
              237.       unsigned char *p = *pp;

crypto/asn1/asn1_lib.c:237:5: Assignment
              235.   static void asn1_put_length(unsigned char **pp, int length)
              236.   {
              237.       unsigned char *p = *pp;
                         ^
              238.       int i, l;
              239.       if (length <= 127)

crypto/asn1/asn1_lib.c:245:11: Assignment
              243.           for (i = 0; l > 0; i++)
              244.               l >>= 8;
              245.           *(p++) = i | 0x80;
                               ^
              246.           l = i;
              247.           while (i-- > 0) {

crypto/asn1/asn1_lib.c:248:13: Array access: Offset: [2, +oo] (⇐ [2, +oo] + [0, +oo]) Size: [1, +oo] by call to `i2d_ESS_SIGNING_CERT` 
              246.           l = i;
              247.           while (i-- > 0) {
              248.               p[i] = length & 0xff;
                                 ^
              249.               length >>= 8;
              250.           }

static void asn1_put_length(unsigned char **pp, int length)
{
    unsigned char *p = *pp;
    int i, l;
    if (length <= 127)
        *(p++) = (unsigned char)length;
    else {
        l = length;
        for (i = 0; l > 0; i++)
            l >>= 8;
        *(p++) = i | 0x80;
        l = i;
        while (i-- > 0) {
            p[i] = length & 0xff;
            length >>= 8;
        }
        p += l;
    }
    *pp = p;
}
['static int ESS_add_signing_cert(PKCS7_SIGNER_INFO *si, ESS_SIGNING_CERT *sc)\n{\n    ASN1_STRING *seq = NULL;\n    unsigned char *p, *pp = NULL;\n    int len;\n    len = i2d_ESS_SIGNING_CERT(sc, NULL);\n    if ((pp = OPENSSL_malloc(len)) == NULL) {\n        TSerr(TS_F_ESS_ADD_SIGNING_CERT, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    p = pp;\n    i2d_ESS_SIGNING_CERT(sc, &p);\n    if ((seq = ASN1_STRING_new()) == NULL || !ASN1_STRING_set(seq, pp, len)) {\n        TSerr(TS_F_ESS_ADD_SIGNING_CERT, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    OPENSSL_free(pp);\n    pp = NULL;\n    return PKCS7_add_signed_attribute(si,\n                                      NID_id_smime_aa_signingCertificate,\n                                      V_ASN1_SEQUENCE, seq);\n err:\n    ASN1_STRING_free(seq);\n    OPENSSL_free(pp);\n    return 0;\n}', 'IMPLEMENT_ASN1_FUNCTIONS_const(ESS_SIGNING_CERT)', 'int ASN1_item_i2d(ASN1_VALUE *val, unsigned char **out, const ASN1_ITEM *it)\n{\n    return asn1_item_flags_i2d(val, out, it, 0);\n}', 'static int asn1_item_flags_i2d(ASN1_VALUE *val, unsigned char **out,\n                               const ASN1_ITEM *it, int flags)\n{\n    if (out && !*out) {\n        unsigned char *p, *buf;\n        int len;\n        len = ASN1_item_ex_i2d(&val, NULL, it, -1, flags);\n        if (len <= 0)\n            return len;\n        buf = OPENSSL_malloc(len);\n        if (buf == NULL)\n            return -1;\n        p = buf;\n        ASN1_item_ex_i2d(&val, &p, it, -1, flags);\n        *out = buf;\n        return len;\n    }\n    return ASN1_item_ex_i2d(&val, out, it, -1, flags);\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (num <= 0)\n        return NULL;\n    allow_customize = 0;\n#ifdef CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    (void)file;\n    (void)line;\n    ret = malloc(num);\n#endif\n#ifndef OPENSSL_CPUID_OBJ\n    if (ret && (num > 2048)) {\n        extern unsigned char cleanse_ctr;\n        ((unsigned char *)ret)[0] = cleanse_ctr;\n    }\n#endif\n    return ret;\n}', 'int ASN1_item_ex_i2d(ASN1_VALUE **pval, unsigned char **out,\n                     const ASN1_ITEM *it, int tag, int aclass)\n{\n    const ASN1_TEMPLATE *tt = NULL;\n    int i, seqcontlen, seqlen, ndef = 1;\n    const ASN1_EXTERN_FUNCS *ef;\n    const ASN1_AUX *aux = it->funcs;\n    ASN1_aux_cb *asn1_cb = 0;\n    if ((it->itype != ASN1_ITYPE_PRIMITIVE) && !*pval)\n        return 0;\n    if (aux && aux->asn1_cb)\n        asn1_cb = aux->asn1_cb;\n    switch (it->itype) {\n    case ASN1_ITYPE_PRIMITIVE:\n        if (it->templates)\n            return asn1_template_ex_i2d(pval, out, it->templates,\n                                        tag, aclass);\n        return asn1_i2d_ex_primitive(pval, out, it, tag, aclass);\n    case ASN1_ITYPE_MSTRING:\n        return asn1_i2d_ex_primitive(pval, out, it, -1, aclass);\n    case ASN1_ITYPE_CHOICE:\n        if (asn1_cb && !asn1_cb(ASN1_OP_I2D_PRE, pval, it, NULL))\n            return 0;\n        i = asn1_get_choice_selector(pval, it);\n        if ((i >= 0) && (i < it->tcount)) {\n            ASN1_VALUE **pchval;\n            const ASN1_TEMPLATE *chtt;\n            chtt = it->templates + i;\n            pchval = asn1_get_field_ptr(pval, chtt);\n            return asn1_template_ex_i2d(pchval, out, chtt, -1, aclass);\n        }\n        if (asn1_cb && !asn1_cb(ASN1_OP_I2D_POST, pval, it, NULL))\n            return 0;\n        break;\n    case ASN1_ITYPE_EXTERN:\n        ef = it->funcs;\n        return ef->asn1_ex_i2d(pval, out, it, tag, aclass);\n    case ASN1_ITYPE_NDEF_SEQUENCE:\n        if (aclass & ASN1_TFLG_NDEF)\n            ndef = 2;\n    case ASN1_ITYPE_SEQUENCE:\n        i = asn1_enc_restore(&seqcontlen, out, pval, it);\n        if (i < 0)\n            return 0;\n        if (i > 0)\n            return seqcontlen;\n        seqcontlen = 0;\n        if (tag == -1) {\n            tag = V_ASN1_SEQUENCE;\n            aclass = (aclass & ~ASN1_TFLG_TAG_CLASS)\n                | V_ASN1_UNIVERSAL;\n        }\n        if (asn1_cb && !asn1_cb(ASN1_OP_I2D_PRE, pval, it, NULL))\n            return 0;\n        for (i = 0, tt = it->templates; i < it->tcount; tt++, i++) {\n            const ASN1_TEMPLATE *seqtt;\n            ASN1_VALUE **pseqval;\n            seqtt = asn1_do_adb(pval, tt, 1);\n            if (!seqtt)\n                return 0;\n            pseqval = asn1_get_field_ptr(pval, seqtt);\n            seqcontlen += asn1_template_ex_i2d(pseqval, NULL, seqtt,\n                                               -1, aclass);\n        }\n        seqlen = ASN1_object_size(ndef, seqcontlen, tag);\n        if (!out)\n            return seqlen;\n        ASN1_put_object(out, ndef, seqcontlen, tag, aclass);\n        for (i = 0, tt = it->templates; i < it->tcount; tt++, i++) {\n            const ASN1_TEMPLATE *seqtt;\n            ASN1_VALUE **pseqval;\n            seqtt = asn1_do_adb(pval, tt, 1);\n            if (!seqtt)\n                return 0;\n            pseqval = asn1_get_field_ptr(pval, seqtt);\n            asn1_template_ex_i2d(pseqval, out, seqtt, -1, aclass);\n        }\n        if (ndef == 2)\n            ASN1_put_eoc(out);\n        if (asn1_cb && !asn1_cb(ASN1_OP_I2D_POST, pval, it, NULL))\n            return 0;\n        return seqlen;\n    default:\n        return 0;\n    }\n    return 0;\n}', 'static int asn1_i2d_ex_primitive(ASN1_VALUE **pval, unsigned char **out,\n                                 const ASN1_ITEM *it, int tag, int aclass)\n{\n    int len;\n    int utype;\n    int usetag;\n    int ndef = 0;\n    utype = it->utype;\n    len = asn1_ex_i2c(pval, NULL, &utype, it);\n    if ((utype == V_ASN1_SEQUENCE) || (utype == V_ASN1_SET) ||\n        (utype == V_ASN1_OTHER))\n        usetag = 0;\n    else\n        usetag = 1;\n    if (len == -1)\n        return 0;\n    if (len == -2) {\n        ndef = 2;\n        len = 0;\n    }\n    if (tag == -1)\n        tag = utype;\n    if (out) {\n        if (usetag)\n            ASN1_put_object(out, ndef, len, tag, aclass);\n        asn1_ex_i2c(pval, *out, &utype, it);\n        if (ndef)\n            ASN1_put_eoc(out);\n        else\n            *out += len;\n    }\n    if (usetag)\n        return ASN1_object_size(ndef, len, tag);\n    return len;\n}', 'void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,\n                     int xclass)\n{\n    unsigned char *p = *pp;\n    int i, ttag;\n    i = (constructed) ? V_ASN1_CONSTRUCTED : 0;\n    i |= (xclass & V_ASN1_PRIVATE);\n    if (tag < 31)\n        *(p++) = i | (tag & V_ASN1_PRIMITIVE_TAG);\n    else {\n        *(p++) = i | V_ASN1_PRIMITIVE_TAG;\n        for (i = 0, ttag = tag; ttag > 0; i++)\n            ttag >>= 7;\n        ttag = i;\n        while (i-- > 0) {\n            p[i] = tag & 0x7f;\n            if (i != (ttag - 1))\n                p[i] |= 0x80;\n            tag >>= 7;\n        }\n        p += ttag;\n    }\n    if (constructed == 2)\n        *(p++) = 0x80;\n    else\n        asn1_put_length(&p, length);\n    *pp = p;\n}', 'static void asn1_put_length(unsigned char **pp, int length)\n{\n    unsigned char *p = *pp;\n    int i, l;\n    if (length <= 127)\n        *(p++) = (unsigned char)length;\n    else {\n        l = length;\n        for (i = 0; l > 0; i++)\n            l >>= 8;\n        *(p++) = i | 0x80;\n        l = i;\n        while (i-- > 0) {\n            p[i] = length & 0xff;\n            length >>= 8;\n        }\n        p += l;\n    }\n    *pp = p;\n}']