apps/ts.c:655: error: BUFFER_OVERRUN_L3
  Offset: [-529, +oo] Size: 12 by call to `TS_TST_INFO_print_bio`.
Showing all 13 steps of the trace


apps/ts.c:639:20: Call
637.           }
638.       } else {
639.           response = create_response(conf, section, engine, queryfile,
                          ^
640.                                      passin, inkey, md, signer, chain, policy);
641.           if (response)

apps/ts.c:762:10: Call
  760.       if (!TS_CONF_set_def_policy(conf, section, policy, resp_ctx))
  761.           goto end;
  762.       if (!TS_CONF_set_policies(conf, section, resp_ctx))
                  ^
  763.           goto end;
  764.       if (!TS_CONF_set_digests(conf, section, resp_ctx))

crypto/ts/ts_conf.c:361:29: Call
    359.   
    360.       /* If no other policy is specified, that's fine. */
    361.       if (policies && (list = X509V3_parse_list(policies)) == NULL) {
                                       ^
    362.           ts_CONF_invalid(section, ENV_OTHER_POLICIES);
    363.           goto err;

crypto/x509v3/v3_utl.c:313:17: Assignment
      311.               if (c == ':') {
      312.                   state = HDR_VALUE;
      313.                   *p = 0;
                             ^
      314.                   ntmp = strip_spaces(q);
      315.                   if (!ntmp) {

apps/ts.c:655:18: Call
653.           if (token_out) {
654.               TS_TST_INFO *tst_info = TS_RESP_get_tst_info(response);
655.               if (!TS_TST_INFO_print_bio(out_bio, tst_info))
                        ^
656.                   goto end;
657.           } else {

crypto/ts/ts_rsp_print.c:167:1: Parameter `*a->time->data`
  165.   }
  166.   
  167. > int TS_TST_INFO_print_bio(BIO *bio, TS_TST_INFO *a)
  168.   {
  169.       int v;

crypto/ts/ts_rsp_print.c:190:5: Call
  188.   
  189.       BIO_printf(bio, "Time stamp: ");
  190.       ASN1_GENERALIZEDTIME_print(bio, a->time);
             ^
  191.       BIO_write(bio, "\n", 1);
  192.   

crypto/asn1/a_gentm.c:265:1: <Offset trace>
263.   };
264.   
265. > int ASN1_GENERALIZEDTIME_print(BIO *bp, const ASN1_GENERALIZEDTIME *tm)
266.   {
267.       char *v;

crypto/asn1/a_gentm.c:265:1: Parameter `*tm->data`
    263.   };
    264.   
    265. > int ASN1_GENERALIZEDTIME_print(BIO *bp, const ASN1_GENERALIZEDTIME *tm)
    266.   {
    267.       char *v;

crypto/asn1/a_gentm.c:286:5: Assignment
    284.       y = (v[0] - '0') * 1000 + (v[1] - '0') * 100
    285.           + (v[2] - '0') * 10 + (v[3] - '0');
    286.       M = (v[4] - '0') * 10 + (v[5] - '0');
               ^
    287.       if ((M > 12) || (M < 1))
    288.           goto err;

crypto/asn1/a_gentm.c:260:1: <Length trace>
258.   }
259.   
260. > const char *_asn1_mon[12] = {
261.       "Jan", "Feb", "Mar", "Apr", "May", "Jun",
262.       "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"

crypto/asn1/a_gentm.c:260:1: Array declaration
    258.   }
    259.   
    260. > const char *_asn1_mon[12] = {
    261.       "Jan", "Feb", "Mar", "Apr", "May", "Jun",
    262.       "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"

crypto/asn1/a_gentm.c:307:20: Array access: Offset: [-529, +oo] Size: 12 by call to `TS_TST_INFO_print_bio` 
    305.   
    306.       if (BIO_printf(bp, "%s %2d %02d:%02d:%02d%.*s %d%s",
    307.                      _asn1_mon[M - 1], d, h, m, s, f_len, f, y,
                              ^
    308.                      (gmt) ? " GMT" : "") <= 0)
    309.           return (0);

int ASN1_GENERALIZEDTIME_print(BIO *bp, const ASN1_GENERALIZEDTIME *tm)
{
    char *v;
    int gmt = 0;
    int i;
    int y = 0, M = 0, d = 0, h = 0, m = 0, s = 0;
    char *f = NULL;
    int f_len = 0;
    i = tm->length;
    v = (char *)tm->data;
    if (i < 12)
        goto err;
    if (v[i - 1] == 'Z')
        gmt = 1;
    for (i = 0; i < 12; i++)
        if ((v[i] > '9') || (v[i] < '0'))
            goto err;
    y = (v[0] - '0') * 1000 + (v[1] - '0') * 100
        + (v[2] - '0') * 10 + (v[3] - '0');
    M = (v[4] - '0') * 10 + (v[5] - '0');
    if ((M > 12) || (M < 1))
        goto err;
    d = (v[6] - '0') * 10 + (v[7] - '0');
    h = (v[8] - '0') * 10 + (v[9] - '0');
    m = (v[10] - '0') * 10 + (v[11] - '0');
    if (tm->length >= 14 &&
        (v[12] >= '0') && (v[12] <= '9') &&
        (v[13] >= '0') && (v[13] <= '9')) {
        s = (v[12] - '0') * 10 + (v[13] - '0');
        if (tm->length >= 15 && v[14] == '.') {
            int l = tm->length;
            f = &v[14];
            f_len = 1;
            while (14 + f_len < l && f[f_len] >= '0' && f[f_len] <= '9')
                ++f_len;
        }
    }
    if (BIO_printf(bp, "%s %2d %02d:%02d:%02d%.*s %d%s",
                   _asn1_mon[M - 1], d, h, m, s, f_len, f, y,
                   (gmt) ? " GMT" : "") <= 0)
        return (0);
    else
        return (1);
 err:
    BIO_write(bp, "Bad time value", 14);
    return (0);
}
['static int reply_command(CONF *conf, char *section, char *engine,\n                         char *queryfile, char *passin, char *inkey,\n                         const EVP_MD *md, char *signer, char *chain,\n                         const char *policy, char *in, int token_in,\n                         char *out, int token_out, int text)\n{\n    int ret = 0;\n    TS_RESP *response = NULL;\n    BIO *in_bio = NULL;\n    BIO *query_bio = NULL;\n    BIO *inkey_bio = NULL;\n    BIO *signer_bio = NULL;\n    BIO *out_bio = NULL;\n    if (in != NULL) {\n        if ((in_bio = BIO_new_file(in, "rb")) == NULL)\n            goto end;\n        if (token_in) {\n            response = read_PKCS7(in_bio);\n        } else {\n            response = d2i_TS_RESP_bio(in_bio, NULL);\n        }\n    } else {\n        response = create_response(conf, section, engine, queryfile,\n                                   passin, inkey, md, signer, chain, policy);\n        if (response)\n            BIO_printf(bio_err, "Response has been generated.\\n");\n        else\n            BIO_printf(bio_err, "Response is not generated.\\n");\n    }\n    if (response == NULL)\n        goto end;\n    if (text) {\n        if ((out_bio = bio_open_default(out, \'w\', FORMAT_TEXT)) == NULL)\n        goto end;\n        if (token_out) {\n            TS_TST_INFO *tst_info = TS_RESP_get_tst_info(response);\n            if (!TS_TST_INFO_print_bio(out_bio, tst_info))\n                goto end;\n        } else {\n            if (!TS_RESP_print_bio(out_bio, response))\n                goto end;\n        }\n    } else {\n        if ((out_bio = bio_open_default(out, \'w\', FORMAT_ASN1)) == NULL)\n            goto end;\n        if (token_out) {\n            PKCS7 *token = TS_RESP_get_token(response);\n            if (!i2d_PKCS7_bio(out_bio, token))\n                goto end;\n        } else {\n            if (!i2d_TS_RESP_bio(out_bio, response))\n                goto end;\n        }\n    }\n    ret = 1;\n end:\n    ERR_print_errors(bio_err);\n    BIO_free_all(in_bio);\n    BIO_free_all(query_bio);\n    BIO_free_all(inkey_bio);\n    BIO_free_all(signer_bio);\n    BIO_free_all(out_bio);\n    TS_RESP_free(response);\n    return ret;\n}', 'static TS_RESP *create_response(CONF *conf, const char *section, char *engine,\n                                char *queryfile, char *passin,\n                                char *inkey, const EVP_MD *md, char *signer,\n                                char *chain, const char *policy)\n{\n    int ret = 0;\n    TS_RESP *response = NULL;\n    BIO *query_bio = NULL;\n    TS_RESP_CTX *resp_ctx = NULL;\n    if ((query_bio = BIO_new_file(queryfile, "rb")) == NULL)\n        goto end;\n    if ((section = TS_CONF_get_tsa_section(conf, section)) == NULL)\n        goto end;\n    if ((resp_ctx = TS_RESP_CTX_new()) == NULL)\n        goto end;\n    if (!TS_CONF_set_serial(conf, section, serial_cb, resp_ctx))\n        goto end;\n# ifndef OPENSSL_NO_ENGINE\n    if (!TS_CONF_set_crypto_device(conf, section, engine))\n        goto end;\n# endif\n    if (!TS_CONF_set_signer_cert(conf, section, signer, resp_ctx))\n        goto end;\n    if (!TS_CONF_set_certs(conf, section, chain, resp_ctx))\n        goto end;\n    if (!TS_CONF_set_signer_key(conf, section, inkey, passin, resp_ctx))\n        goto end;\n    if (md) {\n        if (!TS_RESP_CTX_set_signer_digest(resp_ctx, md))\n            goto end;\n    } else if (!TS_CONF_set_signer_digest(conf, section, NULL, resp_ctx)) {\n            goto end;\n    }\n    if (!TS_CONF_set_def_policy(conf, section, policy, resp_ctx))\n        goto end;\n    if (!TS_CONF_set_policies(conf, section, resp_ctx))\n        goto end;\n    if (!TS_CONF_set_digests(conf, section, resp_ctx))\n        goto end;\n    if (!TS_CONF_set_accuracy(conf, section, resp_ctx))\n        goto end;\n    if (!TS_CONF_set_clock_precision_digits(conf, section, resp_ctx))\n        goto end;\n    if (!TS_CONF_set_ordering(conf, section, resp_ctx))\n        goto end;\n    if (!TS_CONF_set_tsa_name(conf, section, resp_ctx))\n        goto end;\n    if (!TS_CONF_set_ess_cert_id_chain(conf, section, resp_ctx))\n        goto end;\n    if ((response = TS_RESP_create_response(resp_ctx, query_bio)) == NULL)\n        goto end;\n    ret = 1;\n end:\n    if (!ret) {\n        TS_RESP_free(response);\n        response = NULL;\n    }\n    TS_RESP_CTX_free(resp_ctx);\n    BIO_free_all(query_bio);\n    return response;\n}', 'int TS_CONF_set_policies(CONF *conf, const char *section, TS_RESP_CTX *ctx)\n{\n    int ret = 0;\n    int i;\n    STACK_OF(CONF_VALUE) *list = NULL;\n    char *policies = NCONF_get_string(conf, section, ENV_OTHER_POLICIES);\n    if (policies && (list = X509V3_parse_list(policies)) == NULL) {\n        ts_CONF_invalid(section, ENV_OTHER_POLICIES);\n        goto err;\n    }\n    for (i = 0; i < sk_CONF_VALUE_num(list); ++i) {\n        CONF_VALUE *val = sk_CONF_VALUE_value(list, i);\n        const char *extval = val->value ? val->value : val->name;\n        ASN1_OBJECT *objtmp;\n        if ((objtmp = OBJ_txt2obj(extval, 0)) == NULL) {\n            ts_CONF_invalid(section, ENV_OTHER_POLICIES);\n            goto err;\n        }\n        if (!TS_RESP_CTX_add_policy(ctx, objtmp))\n            goto err;\n        ASN1_OBJECT_free(objtmp);\n    }\n    ret = 1;\n err:\n    sk_CONF_VALUE_pop_free(list, X509V3_conf_free);\n    return ret;\n}', "STACK_OF(CONF_VALUE) *X509V3_parse_list(const char *line)\n{\n    char *p, *q, c;\n    char *ntmp, *vtmp;\n    STACK_OF(CONF_VALUE) *values = NULL;\n    char *linebuf;\n    int state;\n    linebuf = OPENSSL_strdup(line);\n    if (linebuf == NULL) {\n        X509V3err(X509V3_F_X509V3_PARSE_LIST, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    state = HDR_NAME;\n    ntmp = NULL;\n    for (p = linebuf, q = linebuf; (c = *p) && (c != '\\r') && (c != '\\n');\n         p++) {\n        switch (state) {\n        case HDR_NAME:\n            if (c == ':') {\n                state = HDR_VALUE;\n                *p = 0;\n                ntmp = strip_spaces(q);\n                if (!ntmp) {\n                    X509V3err(X509V3_F_X509V3_PARSE_LIST,\n                              X509V3_R_INVALID_NULL_NAME);\n                    goto err;\n                }\n                q = p + 1;\n            } else if (c == ',') {\n                *p = 0;\n                ntmp = strip_spaces(q);\n                q = p + 1;\n                if (!ntmp) {\n                    X509V3err(X509V3_F_X509V3_PARSE_LIST,\n                              X509V3_R_INVALID_NULL_NAME);\n                    goto err;\n                }\n                X509V3_add_value(ntmp, NULL, &values);\n            }\n            break;\n        case HDR_VALUE:\n            if (c == ',') {\n                state = HDR_NAME;\n                *p = 0;\n                vtmp = strip_spaces(q);\n                if (!vtmp) {\n                    X509V3err(X509V3_F_X509V3_PARSE_LIST,\n                              X509V3_R_INVALID_NULL_VALUE);\n                    goto err;\n                }\n                X509V3_add_value(ntmp, vtmp, &values);\n                ntmp = NULL;\n                q = p + 1;\n            }\n        }\n    }\n    if (state == HDR_VALUE) {\n        vtmp = strip_spaces(q);\n        if (!vtmp) {\n            X509V3err(X509V3_F_X509V3_PARSE_LIST,\n                      X509V3_R_INVALID_NULL_VALUE);\n            goto err;\n        }\n        X509V3_add_value(ntmp, vtmp, &values);\n    } else {\n        ntmp = strip_spaces(q);\n        if (!ntmp) {\n            X509V3err(X509V3_F_X509V3_PARSE_LIST, X509V3_R_INVALID_NULL_NAME);\n            goto err;\n        }\n        X509V3_add_value(ntmp, NULL, &values);\n    }\n    OPENSSL_free(linebuf);\n    return values;\n err:\n    OPENSSL_free(linebuf);\n    sk_CONF_VALUE_pop_free(values, X509V3_conf_free);\n    return NULL;\n}", 'int TS_TST_INFO_print_bio(BIO *bio, TS_TST_INFO *a)\n{\n    int v;\n    if (a == NULL)\n        return 0;\n    v = ASN1_INTEGER_get(a->version);\n    BIO_printf(bio, "Version: %d\\n", v);\n    BIO_printf(bio, "Policy OID: ");\n    TS_OBJ_print_bio(bio, a->policy_id);\n    TS_MSG_IMPRINT_print_bio(bio, a->msg_imprint);\n    BIO_printf(bio, "Serial number: ");\n    if (a->serial == NULL)\n        BIO_printf(bio, "unspecified");\n    else\n        TS_ASN1_INTEGER_print_bio(bio, a->serial);\n    BIO_write(bio, "\\n", 1);\n    BIO_printf(bio, "Time stamp: ");\n    ASN1_GENERALIZEDTIME_print(bio, a->time);\n    BIO_write(bio, "\\n", 1);\n    BIO_printf(bio, "Accuracy: ");\n    if (a->accuracy == NULL)\n        BIO_printf(bio, "unspecified");\n    else\n        ts_ACCURACY_print_bio(bio, a->accuracy);\n    BIO_write(bio, "\\n", 1);\n    BIO_printf(bio, "Ordering: %s\\n", a->ordering ? "yes" : "no");\n    BIO_printf(bio, "Nonce: ");\n    if (a->nonce == NULL)\n        BIO_printf(bio, "unspecified");\n    else\n        TS_ASN1_INTEGER_print_bio(bio, a->nonce);\n    BIO_write(bio, "\\n", 1);\n    BIO_printf(bio, "TSA: ");\n    if (a->tsa == NULL)\n        BIO_printf(bio, "unspecified");\n    else {\n        STACK_OF(CONF_VALUE) *nval;\n        if ((nval = i2v_GENERAL_NAME(NULL, a->tsa, NULL)))\n            X509V3_EXT_val_prn(bio, nval, 0, 0);\n        sk_CONF_VALUE_pop_free(nval, X509V3_conf_free);\n    }\n    BIO_write(bio, "\\n", 1);\n    TS_ext_print_bio(bio, a->extensions);\n    return 1;\n}', 'int ASN1_GENERALIZEDTIME_print(BIO *bp, const ASN1_GENERALIZEDTIME *tm)\n{\n    char *v;\n    int gmt = 0;\n    int i;\n    int y = 0, M = 0, d = 0, h = 0, m = 0, s = 0;\n    char *f = NULL;\n    int f_len = 0;\n    i = tm->length;\n    v = (char *)tm->data;\n    if (i < 12)\n        goto err;\n    if (v[i - 1] == \'Z\')\n        gmt = 1;\n    for (i = 0; i < 12; i++)\n        if ((v[i] > \'9\') || (v[i] < \'0\'))\n            goto err;\n    y = (v[0] - \'0\') * 1000 + (v[1] - \'0\') * 100\n        + (v[2] - \'0\') * 10 + (v[3] - \'0\');\n    M = (v[4] - \'0\') * 10 + (v[5] - \'0\');\n    if ((M > 12) || (M < 1))\n        goto err;\n    d = (v[6] - \'0\') * 10 + (v[7] - \'0\');\n    h = (v[8] - \'0\') * 10 + (v[9] - \'0\');\n    m = (v[10] - \'0\') * 10 + (v[11] - \'0\');\n    if (tm->length >= 14 &&\n        (v[12] >= \'0\') && (v[12] <= \'9\') &&\n        (v[13] >= \'0\') && (v[13] <= \'9\')) {\n        s = (v[12] - \'0\') * 10 + (v[13] - \'0\');\n        if (tm->length >= 15 && v[14] == \'.\') {\n            int l = tm->length;\n            f = &v[14];\n            f_len = 1;\n            while (14 + f_len < l && f[f_len] >= \'0\' && f[f_len] <= \'9\')\n                ++f_len;\n        }\n    }\n    if (BIO_printf(bp, "%s %2d %02d:%02d:%02d%.*s %d%s",\n                   _asn1_mon[M - 1], d, h, m, s, f_len, f, y,\n                   (gmt) ? " GMT" : "") <= 0)\n        return (0);\n    else\n        return (1);\n err:\n    BIO_write(bp, "Bad time value", 14);\n    return (0);\n}']