crypto/x509v3/v3_scts.c:193: error: BUFFER_OVERRUN_L3
  Offset added: [5, +oo] (⇐ [4, +oo] + [1, +oo]) Size: [1, +oo].
Showing all 17 steps of the trace


crypto/x509v3/v3_scts.c:160:9: <Offset trace>
158.       const unsigned char *q = *pp;
159.   
160.       if (d2i_ASN1_OCTET_STRING(&oct, &q, length) == NULL)
               ^
161.           return NULL;
162.       if (oct->length < 2)

crypto/x509v3/v3_scts.c:160:9: Call
158.       const unsigned char *q = *pp;
159.   
160.       if (d2i_ASN1_OCTET_STRING(&oct, &q, length) == NULL)
               ^
161.           return NULL;
162.       if (oct->length < 2)

crypto/asn1/tasn_typ.c:77:1: Call
  75.   }
  76.   
  77. > IMPLEMENT_ASN1_STRING_FUNCTIONS(ASN1_OCTET_STRING)
  78.   IMPLEMENT_ASN1_STRING_FUNCTIONS(ASN1_INTEGER)
  79.   IMPLEMENT_ASN1_STRING_FUNCTIONS(ASN1_ENUMERATED)

crypto/asn1/tasn_dec.c:153:9: Call
    151.           pval = &ptmpval;
    152.       asn1_tlc_clear_nc(&c);
    153.       if (ASN1_item_ex_d2i(pval, in, len, it, -1, 0, 0, &c) > 0)
                   ^
    154.           return *pval;
    155.       return NULL;

crypto/asn1/tasn_dec.c:163:10: Call
      161.   {
      162.       int rv;
      163.       rv = asn1_item_embed_d2i(pval, in, len, it, tag, aclass, opt, ctx);
                      ^
      164.       if (rv <= 0)
      165.           ASN1_item_ex_free(pval, it);

crypto/asn1/tasn_dec.c:174:1: Parameter `**pval`
        172.    */
        173.   
        174. > static int asn1_item_embed_d2i(ASN1_VALUE **pval, const unsigned char **in,
        175.                                  long len, const ASN1_ITEM *it,
        176.                                  int tag, int aclass, char opt, ASN1_TLC *ctx)

crypto/x509v3/v3_scts.c:175:9: Assignment
173.           if (listlen < 2)
174.               goto err;
175.           n2s(p, sctlen);
               ^
176.           listlen -= 2;
177.   

crypto/x509v3/v3_scts.c:160:9: <Length trace>
158.       const unsigned char *q = *pp;
159.   
160.       if (d2i_ASN1_OCTET_STRING(&oct, &q, length) == NULL)
               ^
161.           return NULL;
162.       if (oct->length < 2)

crypto/x509v3/v3_scts.c:160:9: Call
158.       const unsigned char *q = *pp;
159.   
160.       if (d2i_ASN1_OCTET_STRING(&oct, &q, length) == NULL)
               ^
161.           return NULL;
162.       if (oct->length < 2)

crypto/asn1/tasn_typ.c:77:1: Call
  75.   }
  76.   
  77. > IMPLEMENT_ASN1_STRING_FUNCTIONS(ASN1_OCTET_STRING)
  78.   IMPLEMENT_ASN1_STRING_FUNCTIONS(ASN1_INTEGER)
  79.   IMPLEMENT_ASN1_STRING_FUNCTIONS(ASN1_ENUMERATED)

crypto/asn1/tasn_dec.c:153:9: Call
    151.           pval = &ptmpval;
    152.       asn1_tlc_clear_nc(&c);
    153.       if (ASN1_item_ex_d2i(pval, in, len, it, -1, 0, 0, &c) > 0)
                   ^
    154.           return *pval;
    155.       return NULL;

crypto/asn1/tasn_dec.c:163:10: Call
      161.   {
      162.       int rv;
      163.       rv = asn1_item_embed_d2i(pval, in, len, it, tag, aclass, opt, ctx);
                      ^
      164.       if (rv <= 0)
      165.           ASN1_item_ex_free(pval, it);

crypto/asn1/tasn_dec.c:174:1: Parameter `**pval`
        172.    */
        173.   
        174. > static int asn1_item_embed_d2i(ASN1_VALUE **pval, const unsigned char **in,
        175.                                  long len, const ASN1_ITEM *it,
        176.                                  int tag, int aclass, char opt, ASN1_TLC *ctx)

crypto/x509v3/v3_scts.c:175:9: Assignment
173.           if (listlen < 2)
174.               goto err;
175.           n2s(p, sctlen);
               ^
176.           listlen -= 2;
177.   

crypto/x509v3/v3_scts.c:195:9: Assignment
193.           memcpy(sct->sct, p, sctlen);
194.           sct->sct_len = sctlen;
195.           p += sctlen;
               ^
196.           p2 = sct->sct;
197.   

crypto/x509v3/v3_scts.c:175:9: Assignment
173.           if (listlen < 2)
174.               goto err;
175.           n2s(p, sctlen);
               ^
176.           listlen -= 2;
177.   

crypto/x509v3/v3_scts.c:193:9: Array access: Offset added: [5, +oo] (⇐ [4, +oo] + [1, +oo]) Size: [1, +oo]
191.           if (sct->sct == NULL)
192.               goto err;
193.           memcpy(sct->sct, p, sctlen);
               ^
194.           sct->sct_len = sctlen;
195.           p += sctlen;

static STACK_OF(SCT) *d2i_SCT_LIST(STACK_OF(SCT) **a,
                                   const unsigned char **pp, long length)
{
    ASN1_OCTET_STRING *oct = NULL;
    STACK_OF(SCT) *sk = NULL;
    SCT *sct;
    unsigned char *p, *p2;
    unsigned short listlen, sctlen = 0, fieldlen;
    const unsigned char *q = *pp;
    if (d2i_ASN1_OCTET_STRING(&oct, &q, length) == NULL)
        return NULL;
    if (oct->length < 2)
        goto done;
    p = oct->data;
    n2s(p, listlen);
    if (listlen != oct->length - 2)
        goto done;
    if ((sk = sk_SCT_new_null()) == NULL)
        goto done;
    while (listlen > 0) {
        if (listlen < 2)
            goto err;
        n2s(p, sctlen);
        listlen -= 2;
        if ((sctlen < 1) || (sctlen > listlen))
            goto err;
        listlen -= sctlen;
        sct = OPENSSL_malloc(sizeof(*sct));
        if (sct == NULL)
            goto err;
        if (!sk_SCT_push(sk, sct)) {
            OPENSSL_free(sct);
            goto err;
        }
        sct->sct = OPENSSL_malloc(sctlen);
        if (sct->sct == NULL)
            goto err;
        memcpy(sct->sct, p, sctlen);
        sct->sct_len = sctlen;
        p += sctlen;
        p2 = sct->sct;
        sct->version = *p2++;
        if (sct->version == 0) {
            if (sctlen < 43)
                goto err;
            sctlen -= 43;
            sct->log_id = p2;
            sct->log_id_len = 32;
            p2 += 32;
            n2l8(p2, sct->timestamp);
            n2s(p2, fieldlen);
            if (sctlen < fieldlen)
                goto err;
            sct->ext = p2;
            sct->ext_len = fieldlen;
            p2 += fieldlen;
            sctlen -= fieldlen;
            if (sctlen < 4)
                goto err;
            sctlen -= 4;
            sct->hash_alg = *p2++;
            sct->sig_alg = *p2++;
            n2s(p2, fieldlen);
            if (sctlen != fieldlen)
                goto err;
            sct->sig = p2;
            sct->sig_len = fieldlen;
        }
    }
 done:
    ASN1_OCTET_STRING_free(oct);
    *pp = q;
    return sk;
 err:
    SCT_LIST_free(sk);
    sk = NULL;
    goto done;
}
['static STACK_OF(SCT) *d2i_SCT_LIST(STACK_OF(SCT) **a,\n                                   const unsigned char **pp, long length)\n{\n    ASN1_OCTET_STRING *oct = NULL;\n    STACK_OF(SCT) *sk = NULL;\n    SCT *sct;\n    unsigned char *p, *p2;\n    unsigned short listlen, sctlen = 0, fieldlen;\n    const unsigned char *q = *pp;\n    if (d2i_ASN1_OCTET_STRING(&oct, &q, length) == NULL)\n        return NULL;\n    if (oct->length < 2)\n        goto done;\n    p = oct->data;\n    n2s(p, listlen);\n    if (listlen != oct->length - 2)\n        goto done;\n    if ((sk = sk_SCT_new_null()) == NULL)\n        goto done;\n    while (listlen > 0) {\n        if (listlen < 2)\n            goto err;\n        n2s(p, sctlen);\n        listlen -= 2;\n        if ((sctlen < 1) || (sctlen > listlen))\n            goto err;\n        listlen -= sctlen;\n        sct = OPENSSL_malloc(sizeof(*sct));\n        if (sct == NULL)\n            goto err;\n        if (!sk_SCT_push(sk, sct)) {\n            OPENSSL_free(sct);\n            goto err;\n        }\n        sct->sct = OPENSSL_malloc(sctlen);\n        if (sct->sct == NULL)\n            goto err;\n        memcpy(sct->sct, p, sctlen);\n        sct->sct_len = sctlen;\n        p += sctlen;\n        p2 = sct->sct;\n        sct->version = *p2++;\n        if (sct->version == 0) {\n            if (sctlen < 43)\n                goto err;\n            sctlen -= 43;\n            sct->log_id = p2;\n            sct->log_id_len = 32;\n            p2 += 32;\n            n2l8(p2, sct->timestamp);\n            n2s(p2, fieldlen);\n            if (sctlen < fieldlen)\n                goto err;\n            sct->ext = p2;\n            sct->ext_len = fieldlen;\n            p2 += fieldlen;\n            sctlen -= fieldlen;\n            if (sctlen < 4)\n                goto err;\n            sctlen -= 4;\n            sct->hash_alg = *p2++;\n            sct->sig_alg = *p2++;\n            n2s(p2, fieldlen);\n            if (sctlen != fieldlen)\n                goto err;\n            sct->sig = p2;\n            sct->sig_len = fieldlen;\n        }\n    }\n done:\n    ASN1_OCTET_STRING_free(oct);\n    *pp = q;\n    return sk;\n err:\n    SCT_LIST_free(sk);\n    sk = NULL;\n    goto done;\n}', 'IMPLEMENT_ASN1_STRING_FUNCTIONS(ASN1_OCTET_STRING)', 'ASN1_VALUE *ASN1_item_d2i(ASN1_VALUE **pval,\n                          const unsigned char **in, long len,\n                          const ASN1_ITEM *it)\n{\n    ASN1_TLC c;\n    ASN1_VALUE *ptmpval = NULL;\n    if (!pval)\n        pval = &ptmpval;\n    asn1_tlc_clear_nc(&c);\n    if (ASN1_item_ex_d2i(pval, in, len, it, -1, 0, 0, &c) > 0)\n        return *pval;\n    return NULL;\n}', 'int ASN1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in, long len,\n                     const ASN1_ITEM *it,\n                     int tag, int aclass, char opt, ASN1_TLC *ctx)\n{\n    int rv;\n    rv = asn1_item_embed_d2i(pval, in, len, it, tag, aclass, opt, ctx);\n    if (rv <= 0)\n        ASN1_item_ex_free(pval, it);\n    return rv;\n}', 'static int asn1_item_embed_d2i(ASN1_VALUE **pval, const unsigned char **in,\n                               long len, const ASN1_ITEM *it,\n                               int tag, int aclass, char opt, ASN1_TLC *ctx)\n{\n    const ASN1_TEMPLATE *tt, *errtt = NULL;\n    const ASN1_EXTERN_FUNCS *ef;\n    const ASN1_AUX *aux = it->funcs;\n    ASN1_aux_cb *asn1_cb;\n    const unsigned char *p = NULL, *q;\n    unsigned char oclass;\n    char seq_eoc, seq_nolen, cst, isopt;\n    long tmplen;\n    int i;\n    int otag;\n    int ret = 0;\n    ASN1_VALUE **pchptr;\n    if (!pval)\n        return 0;\n    if (aux && aux->asn1_cb)\n        asn1_cb = aux->asn1_cb;\n    else\n        asn1_cb = 0;\n    switch (it->itype) {\n    case ASN1_ITYPE_PRIMITIVE:\n        if (it->templates) {\n            if ((tag != -1) || opt) {\n                ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I,\n                        ASN1_R_ILLEGAL_OPTIONS_ON_ITEM_TEMPLATE);\n                goto err;\n            }\n            return asn1_template_ex_d2i(pval, in, len,\n                                        it->templates, opt, ctx);\n        }\n        return asn1_d2i_ex_primitive(pval, in, len, it,\n                                     tag, aclass, opt, ctx);\n    case ASN1_ITYPE_MSTRING:\n        p = *in;\n        ret = asn1_check_tlen(NULL, &otag, &oclass, NULL, NULL,\n                              &p, len, -1, 0, 1, ctx);\n        if (!ret) {\n            ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ERR_R_NESTED_ASN1_ERROR);\n            goto err;\n        }\n        if (oclass != V_ASN1_UNIVERSAL) {\n            if (opt)\n                return -1;\n            ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ASN1_R_MSTRING_NOT_UNIVERSAL);\n            goto err;\n        }\n        if (!(ASN1_tag2bit(otag) & it->utype)) {\n            if (opt)\n                return -1;\n            ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ASN1_R_MSTRING_WRONG_TAG);\n            goto err;\n        }\n        return asn1_d2i_ex_primitive(pval, in, len, it, otag, 0, 0, ctx);\n    case ASN1_ITYPE_EXTERN:\n        ef = it->funcs;\n        return ef->asn1_ex_d2i(pval, in, len, it, tag, aclass, opt, ctx);\n    case ASN1_ITYPE_CHOICE:\n        if (asn1_cb && !asn1_cb(ASN1_OP_D2I_PRE, pval, it, NULL))\n            goto auxerr;\n        if (*pval) {\n            i = asn1_get_choice_selector(pval, it);\n            if ((i >= 0) && (i < it->tcount)) {\n                tt = it->templates + i;\n                pchptr = asn1_get_field_ptr(pval, tt);\n                asn1_template_free(pchptr, tt);\n                asn1_set_choice_selector(pval, -1, it);\n            }\n        } else if (!ASN1_item_ex_new(pval, it)) {\n            ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ERR_R_NESTED_ASN1_ERROR);\n            goto err;\n        }\n        p = *in;\n        for (i = 0, tt = it->templates; i < it->tcount; i++, tt++) {\n            pchptr = asn1_get_field_ptr(pval, tt);\n            ret = asn1_template_ex_d2i(pchptr, &p, len, tt, 1, ctx);\n            if (ret == -1)\n                continue;\n            if (ret > 0)\n                break;\n            errtt = tt;\n            ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ERR_R_NESTED_ASN1_ERROR);\n            goto err;\n        }\n        if (i == it->tcount) {\n            if (opt) {\n                ASN1_item_ex_free(pval, it);\n                return -1;\n            }\n            ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ASN1_R_NO_MATCHING_CHOICE_TYPE);\n            goto err;\n        }\n        asn1_set_choice_selector(pval, i, it);\n        if (asn1_cb && !asn1_cb(ASN1_OP_D2I_POST, pval, it, NULL))\n            goto auxerr;\n        *in = p;\n        return 1;\n    case ASN1_ITYPE_NDEF_SEQUENCE:\n    case ASN1_ITYPE_SEQUENCE:\n        p = *in;\n        tmplen = len;\n        if (tag == -1) {\n            tag = V_ASN1_SEQUENCE;\n            aclass = V_ASN1_UNIVERSAL;\n        }\n        ret = asn1_check_tlen(&len, NULL, NULL, &seq_eoc, &cst,\n                              &p, len, tag, aclass, opt, ctx);\n        if (!ret) {\n            ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ERR_R_NESTED_ASN1_ERROR);\n            goto err;\n        } else if (ret == -1)\n            return -1;\n        if (aux && (aux->flags & ASN1_AFLG_BROKEN)) {\n            len = tmplen - (p - *in);\n            seq_nolen = 1;\n        }\n        else\n            seq_nolen = seq_eoc;\n        if (!cst) {\n            ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ASN1_R_SEQUENCE_NOT_CONSTRUCTED);\n            goto err;\n        }\n        if (!*pval && !ASN1_item_ex_new(pval, it)) {\n            ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ERR_R_NESTED_ASN1_ERROR);\n            goto err;\n        }\n        if (asn1_cb && !asn1_cb(ASN1_OP_D2I_PRE, pval, it, NULL))\n            goto auxerr;\n        for (i = 0, tt = it->templates; i < it->tcount; i++, tt++) {\n            if (tt->flags & ASN1_TFLG_ADB_MASK) {\n                const ASN1_TEMPLATE *seqtt;\n                ASN1_VALUE **pseqval;\n                seqtt = asn1_do_adb(pval, tt, 1);\n                pseqval = asn1_get_field_ptr(pval, seqtt);\n                asn1_template_free(pseqval, seqtt);\n            }\n        }\n        for (i = 0, tt = it->templates; i < it->tcount; i++, tt++) {\n            const ASN1_TEMPLATE *seqtt;\n            ASN1_VALUE **pseqval;\n            seqtt = asn1_do_adb(pval, tt, 1);\n            if (!seqtt)\n                goto err;\n            pseqval = asn1_get_field_ptr(pval, seqtt);\n            if (!len)\n                break;\n            q = p;\n            if (asn1_check_eoc(&p, len)) {\n                if (!seq_eoc) {\n                    ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ASN1_R_UNEXPECTED_EOC);\n                    goto err;\n                }\n                len -= p - q;\n                seq_eoc = 0;\n                q = p;\n                break;\n            }\n            if (i == (it->tcount - 1))\n                isopt = 0;\n            else\n                isopt = (char)(seqtt->flags & ASN1_TFLG_OPTIONAL);\n            ret = asn1_template_ex_d2i(pseqval, &p, len, seqtt, isopt, ctx);\n            if (!ret) {\n                errtt = seqtt;\n                goto err;\n            } else if (ret == -1) {\n                asn1_template_free(pseqval, seqtt);\n                continue;\n            }\n            len -= p - q;\n        }\n        if (seq_eoc && !asn1_check_eoc(&p, len)) {\n            ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ASN1_R_MISSING_EOC);\n            goto err;\n        }\n        if (!seq_nolen && len) {\n            ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ASN1_R_SEQUENCE_LENGTH_MISMATCH);\n            goto err;\n        }\n        for (; i < it->tcount; tt++, i++) {\n            const ASN1_TEMPLATE *seqtt;\n            seqtt = asn1_do_adb(pval, tt, 1);\n            if (!seqtt)\n                goto err;\n            if (seqtt->flags & ASN1_TFLG_OPTIONAL) {\n                ASN1_VALUE **pseqval;\n                pseqval = asn1_get_field_ptr(pval, seqtt);\n                asn1_template_free(pseqval, seqtt);\n            } else {\n                errtt = seqtt;\n                ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ASN1_R_FIELD_MISSING);\n                goto err;\n            }\n        }\n        if (!asn1_enc_save(pval, *in, p - *in, it))\n            goto auxerr;\n        if (asn1_cb && !asn1_cb(ASN1_OP_D2I_POST, pval, it, NULL))\n            goto auxerr;\n        *in = p;\n        return 1;\n    default:\n        return 0;\n    }\n auxerr:\n    ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ASN1_R_AUX_ERROR);\n err:\n    if (errtt)\n        ERR_add_error_data(4, "Field=", errtt->field_name,\n                           ", Type=", it->sname);\n    else\n        ERR_add_error_data(2, "Type=", it->sname);\n    return 0;\n}']