crypto/asn1/t_pkey.c:350: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, +oo] by call to `print`.
Showing all 11 steps of the trace


crypto/asn1/t_pkey.c:339:4: Call
337.   	int reason=ERR_R_BUF_LIB,i,ret=0;
338.   
339.   	i=BN_num_bytes(x->p);
          ^
340.   	m=(unsigned char *)Malloc((unsigned int)i+10);
341.   	if (m == NULL)

crypto/bn/bn_lib.c:245:19: Assignment
  243.   	bn_check_top(a);
  244.   
  245.   	if (a->top == 0) return(0);
                           ^
  246.   	l=a->d[a->top-1];
  247.   	i=(a->top-1)*BN_BITS2;

crypto/asn1/t_pkey.c:339:2: Assignment
337.   	int reason=ERR_R_BUF_LIB,i,ret=0;
338.   
339.   	i=BN_num_bytes(x->p);
        ^
340.   	m=(unsigned char *)Malloc((unsigned int)i+10);
341.   	if (m == NULL)

crypto/asn1/t_pkey.c:340:21: Array declaration
338.   
339.   	i=BN_num_bytes(x->p);
340.   	m=(unsigned char *)Malloc((unsigned int)i+10);
                           ^
341.   	if (m == NULL)
342.   		{

crypto/asn1/t_pkey.c:340:2: Assignment
338.   
339.   	i=BN_num_bytes(x->p);
340.   	m=(unsigned char *)Malloc((unsigned int)i+10);
        ^
341.   	if (m == NULL)
342.   		{

crypto/asn1/t_pkey.c:350:7: Call
348.   		BN_num_bits(x->p)) <= 0)
349.   		goto err;
350.   	if (!print(bp,"p:",x->p,m,4)) goto err;
             ^
351.   	if (!print(bp,"q:",x->q,m,4)) goto err;
352.   	if (!print(bp,"g:",x->g,m,4)) goto err;

crypto/asn1/t_pkey.c:212:1: Parameter `*buf`
  210.   #endif /* !NO_DSA */
  211.   
  212. > static int print(BIO *bp, const char *number, BIGNUM *num, unsigned char *buf,
  213.   	     int off)
  214.   	{

crypto/asn1/t_pkey.c:240:5: Call
  238.   			(neg[0] == '-')?" (Negative)":"") <= 0)
  239.   			return(0);
  240.   		n=BN_bn2bin(num,&buf[1]);
             ^
  241.   	
  242.   		if (buf[1] & 0x80)

crypto/bn/bn_lib.c:632:1: <Length trace>
630.   
631.   /* ignore negative */
632. > int BN_bn2bin(const BIGNUM *a, unsigned char *to)
633.   	{
634.   	int n,i;

crypto/bn/bn_lib.c:632:1: Parameter `*to`
    630.   
    631.   /* ignore negative */
    632. > int BN_bn2bin(const BIGNUM *a, unsigned char *to)
    633.   	{
    634.   	int n,i;

crypto/bn/bn_lib.c:641:3: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `print` 
    639.   		{
    640.   		l=a->d[i/BN_BYTES];
    641.   		*(to++)=(unsigned char)(l>>(8*(i%BN_BYTES)))&0xff;
             ^
    642.   		}
    643.   	return(n);

int BN_bn2bin(const BIGNUM *a, unsigned char *to)
	{
	int n,i;
	BN_ULONG l;
	n=i=BN_num_bytes(a);
	while (i-- > 0)
		{
		l=a->d[i/BN_BYTES];
		*(to++)=(unsigned char)(l>>(8*(i%BN_BYTES)))&0xff;
		}
	return(n);
	}
['int DSAparams_print(BIO *bp, DSA *x)\n\t{\n\tunsigned char *m=NULL;\n\tint reason=ERR_R_BUF_LIB,i,ret=0;\n\ti=BN_num_bytes(x->p);\n\tm=(unsigned char *)Malloc((unsigned int)i+10);\n\tif (m == NULL)\n\t\t{\n\t\treason=ERR_R_MALLOC_FAILURE;\n\t\tgoto err;\n\t\t}\n\tif (BIO_printf(bp,"DSA-Parameters: (%d bit)\\n",\n\t\tBN_num_bits(x->p)) <= 0)\n\t\tgoto err;\n\tif (!print(bp,"p:",x->p,m,4)) goto err;\n\tif (!print(bp,"q:",x->q,m,4)) goto err;\n\tif (!print(bp,"g:",x->g,m,4)) goto err;\n\tret=1;\nerr:\n\tif (m != NULL) Free((char *)m);\n\tDSAerr(DSA_F_DSAPARAMS_PRINT,reason);\n\treturn(ret);\n\t}', 'int BN_num_bits(const BIGNUM *a)\n\t{\n\tBN_ULONG l;\n\tint i;\n\tbn_check_top(a);\n\tif (a->top == 0) return(0);\n\tl=a->d[a->top-1];\n\ti=(a->top-1)*BN_BITS2;\n\tif (l == 0)\n\t\t{\n#if !defined(NO_STDIO) && !defined(WIN16)\n\t\tfprintf(stderr,"BAD TOP VALUE\\n");\n#endif\n\t\tabort();\n\t\t}\n\treturn(i+BN_num_bits_word(l));\n\t}', 'static int print(BIO *bp, const char *number, BIGNUM *num, unsigned char *buf,\n\t     int off)\n\t{\n\tint n,i;\n\tchar str[128];\n\tconst char *neg;\n\tif (num == NULL) return(1);\n\tneg=(num->neg)?"-":"";\n\tif (off)\n\t\t{\n\t\tif (off > 128) off=128;\n\t\tmemset(str,\' \',off);\n\t\tif (BIO_write(bp,str,off) <= 0) return(0);\n\t\t}\n\tif (BN_num_bytes(num) <= BN_BYTES)\n\t\t{\n\t\tif (BIO_printf(bp,"%s %s%lu (%s0x%lx)\\n",number,neg,\n\t\t\t(unsigned long)num->d[0],neg,(unsigned long)num->d[0])\n\t\t\t<= 0) return(0);\n\t\t}\n\telse\n\t\t{\n\t\tbuf[0]=0;\n\t\tif (BIO_printf(bp,"%s%s",number,\n\t\t\t(neg[0] == \'-\')?" (Negative)":"") <= 0)\n\t\t\treturn(0);\n\t\tn=BN_bn2bin(num,&buf[1]);\n\t\tif (buf[1] & 0x80)\n\t\t\tn++;\n\t\telse\tbuf++;\n\t\tfor (i=0; i<n; i++)\n\t\t\t{\n\t\t\tif ((i%15) == 0)\n\t\t\t\t{\n\t\t\t\tstr[0]=\'\\n\';\n\t\t\t\tmemset(&(str[1]),\' \',off+4);\n\t\t\t\tif (BIO_write(bp,str,off+1+4) <= 0) return(0);\n\t\t\t\t}\n\t\t\tif (BIO_printf(bp,"%02x%s",buf[i],((i+1) == n)?"":":")\n\t\t\t\t<= 0) return(0);\n\t\t\t}\n\t\tif (BIO_write(bp,"\\n",1) <= 0) return(0);\n\t\t}\n\treturn(1);\n\t}', 'int BN_bn2bin(const BIGNUM *a, unsigned char *to)\n\t{\n\tint n,i;\n\tBN_ULONG l;\n\tn=i=BN_num_bytes(a);\n\twhile (i-- > 0)\n\t\t{\n\t\tl=a->d[i/BN_BYTES];\n\t\t*(to++)=(unsigned char)(l>>(8*(i%BN_BYTES)))&0xff;\n\t\t}\n\treturn(n);\n\t}']