apps/ts.c:768: error: BUFFER_OVERRUN_L2
  Offset: [0, 1024] Size: 1024 by call to `a2i_ASN1_INTEGER`.
Showing all 7 steps of the trace


apps/ts.c:750:1: Array declaration
748.   }
749.   
750. > static ASN1_INTEGER *next_serial(const char *serialfile)
751.   {
752.       int ret = 0;

apps/ts.c:768:14: Call
766.       } else {
767.           char buf[1024];
768.           if (!a2i_ASN1_INTEGER(in, serial, buf, sizeof(buf))) {
                    ^
769.               BIO_printf(bio_err, "unable to load number from %s\n",
770.                          serialfile);

crypto/asn1/f_int.c:78:14: <Offset trace>
76.           again = (buf[i - 1] == '\\');
77.   
78.           for (j = 0; j < i; j++) {
                   ^
79.               if (!ossl_isxdigit(buf[j]))
80.               {

crypto/asn1/f_int.c:78:14: Assignment
  76.           again = (buf[i - 1] == '\\');
  77.   
  78.           for (j = 0; j < i; j++) {
                     ^
  79.               if (!ossl_isxdigit(buf[j]))
  80.               {

crypto/asn1/f_int.c:54:1: <Length trace>
52.   }
53.   
54. > int a2i_ASN1_INTEGER(BIO *bp, ASN1_INTEGER *bs, char *buf, int size)
55.   {
56.       int i, j, k, m, n, again, bufsize;

crypto/asn1/f_int.c:54:1: Parameter `*buf`
  52.   }
  53.   
  54. > int a2i_ASN1_INTEGER(BIO *bp, ASN1_INTEGER *bs, char *buf, int size)
  55.   {
  56.       int i, j, k, m, n, again, bufsize;

crypto/asn1/f_int.c:85:9: Array access: Offset: [0, 1024] Size: 1024 by call to `a2i_ASN1_INTEGER` 
  83.               }
  84.           }
  85.           buf[i] = '\0';
                ^
  86.           /*
  87.            * We have now cleared all the crap off the end of the line

int a2i_ASN1_INTEGER(BIO *bp, ASN1_INTEGER *bs, char *buf, int size)
{
    int i, j, k, m, n, again, bufsize;
    unsigned char *s = NULL, *sp;
    unsigned char *bufp;
    int num = 0, slen = 0, first = 1;
    bs->type = V_ASN1_INTEGER;
    bufsize = BIO_gets(bp, buf, size);
    for (;;) {
        if (bufsize < 1)
            goto err;
        i = bufsize;
        if (buf[i - 1] == '\n')
            buf[--i] = '\0';
        if (i == 0)
            goto err;
        if (buf[i - 1] == '\r')
            buf[--i] = '\0';
        if (i == 0)
            goto err;
        again = (buf[i - 1] == '\\');
        for (j = 0; j < i; j++) {
            if (!ossl_isxdigit(buf[j]))
            {
                i = j;
                break;
            }
        }
        buf[i] = '\0';
        if (i < 2)
            goto err;
        bufp = (unsigned char *)buf;
        if (first) {
            first = 0;
            if ((bufp[0] == '0') && (bufp[1] == '0')) {
                bufp += 2;
                i -= 2;
            }
        }
        k = 0;
        i -= again;
        if (i % 2 != 0) {
            ASN1err(ASN1_F_A2I_ASN1_INTEGER, ASN1_R_ODD_NUMBER_OF_CHARS);
            OPENSSL_free(s);
            return 0;
        }
        i /= 2;
        if (num + i > slen) {
            sp = OPENSSL_clear_realloc(s, slen, num + i * 2);
            if (sp == NULL) {
                ASN1err(ASN1_F_A2I_ASN1_INTEGER, ERR_R_MALLOC_FAILURE);
                OPENSSL_free(s);
                return 0;
            }
            s = sp;
            slen = num + i * 2;
        }
        for (j = 0; j < i; j++, k += 2) {
            for (n = 0; n < 2; n++) {
                m = OPENSSL_hexchar2int(bufp[k + n]);
                if (m < 0) {
                    ASN1err(ASN1_F_A2I_ASN1_INTEGER,
                            ASN1_R_NON_HEX_CHARACTERS);
                    goto err;
                }
                s[num + j] <<= 4;
                s[num + j] |= m;
            }
        }
        num += i;
        if (again)
            bufsize = BIO_gets(bp, buf, size);
        else
            break;
    }
    bs->length = num;
    bs->data = s;
    return 1;
 err:
    ASN1err(ASN1_F_A2I_ASN1_INTEGER, ASN1_R_SHORT_LINE);
    OPENSSL_free(s);
    return 0;
}
['static ASN1_INTEGER *next_serial(const char *serialfile)\n{\n    int ret = 0;\n    BIO *in = NULL;\n    ASN1_INTEGER *serial = NULL;\n    BIGNUM *bn = NULL;\n    if ((serial = ASN1_INTEGER_new()) == NULL)\n        goto err;\n    if ((in = BIO_new_file(serialfile, "r")) == NULL) {\n        ERR_clear_error();\n        BIO_printf(bio_err, "Warning: could not open file %s for "\n                   "reading, using serial number: 1\\n", serialfile);\n        if (!ASN1_INTEGER_set(serial, 1))\n            goto err;\n    } else {\n        char buf[1024];\n        if (!a2i_ASN1_INTEGER(in, serial, buf, sizeof(buf))) {\n            BIO_printf(bio_err, "unable to load number from %s\\n",\n                       serialfile);\n            goto err;\n        }\n        if ((bn = ASN1_INTEGER_to_BN(serial, NULL)) == NULL)\n            goto err;\n        ASN1_INTEGER_free(serial);\n        serial = NULL;\n        if (!BN_add_word(bn, 1))\n            goto err;\n        if ((serial = BN_to_ASN1_INTEGER(bn, NULL)) == NULL)\n            goto err;\n    }\n    ret = 1;\n err:\n    if (!ret) {\n        ASN1_INTEGER_free(serial);\n        serial = NULL;\n    }\n    BIO_free_all(in);\n    BN_free(bn);\n    return serial;\n}', "int a2i_ASN1_INTEGER(BIO *bp, ASN1_INTEGER *bs, char *buf, int size)\n{\n    int i, j, k, m, n, again, bufsize;\n    unsigned char *s = NULL, *sp;\n    unsigned char *bufp;\n    int num = 0, slen = 0, first = 1;\n    bs->type = V_ASN1_INTEGER;\n    bufsize = BIO_gets(bp, buf, size);\n    for (;;) {\n        if (bufsize < 1)\n            goto err;\n        i = bufsize;\n        if (buf[i - 1] == '\\n')\n            buf[--i] = '\\0';\n        if (i == 0)\n            goto err;\n        if (buf[i - 1] == '\\r')\n            buf[--i] = '\\0';\n        if (i == 0)\n            goto err;\n        again = (buf[i - 1] == '\\\\');\n        for (j = 0; j < i; j++) {\n            if (!ossl_isxdigit(buf[j]))\n            {\n                i = j;\n                break;\n            }\n        }\n        buf[i] = '\\0';\n        if (i < 2)\n            goto err;\n        bufp = (unsigned char *)buf;\n        if (first) {\n            first = 0;\n            if ((bufp[0] == '0') && (bufp[1] == '0')) {\n                bufp += 2;\n                i -= 2;\n            }\n        }\n        k = 0;\n        i -= again;\n        if (i % 2 != 0) {\n            ASN1err(ASN1_F_A2I_ASN1_INTEGER, ASN1_R_ODD_NUMBER_OF_CHARS);\n            OPENSSL_free(s);\n            return 0;\n        }\n        i /= 2;\n        if (num + i > slen) {\n            sp = OPENSSL_clear_realloc(s, slen, num + i * 2);\n            if (sp == NULL) {\n                ASN1err(ASN1_F_A2I_ASN1_INTEGER, ERR_R_MALLOC_FAILURE);\n                OPENSSL_free(s);\n                return 0;\n            }\n            s = sp;\n            slen = num + i * 2;\n        }\n        for (j = 0; j < i; j++, k += 2) {\n            for (n = 0; n < 2; n++) {\n                m = OPENSSL_hexchar2int(bufp[k + n]);\n                if (m < 0) {\n                    ASN1err(ASN1_F_A2I_ASN1_INTEGER,\n                            ASN1_R_NON_HEX_CHARACTERS);\n                    goto err;\n                }\n                s[num + j] <<= 4;\n                s[num + j] |= m;\n            }\n        }\n        num += i;\n        if (again)\n            bufsize = BIO_gets(bp, buf, size);\n        else\n            break;\n    }\n    bs->length = num;\n    bs->data = s;\n    return 1;\n err:\n    ASN1err(ASN1_F_A2I_ASN1_INTEGER, ASN1_R_SHORT_LINE);\n    OPENSSL_free(s);\n    return 0;\n}"]