crypto/x509/x509spki.c:92: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] Size: [1, +oo] by call to `EVP_DecodeBlock`.
Showing all 10 steps of the trace


crypto/x509/x509spki.c:80:1: Parameter `len`
78.   /* Load a Netscape SPKI from a base64 encoded string */
79.   
80. > NETSCAPE_SPKI *NETSCAPE_SPKI_b64_decode(const char *str, int len)
81.   {
82.       unsigned char *spki_der;

crypto/x509/x509spki.c:88:21: Call
86.       if (len <= 0)
87.           len = strlen(str);
88.       if ((spki_der = OPENSSL_malloc(len + 1)) == NULL) {
                          ^
89.           X509err(X509_F_NETSCAPE_SPKI_B64_DECODE, ERR_R_MALLOC_FAILURE);
90.           return NULL;

crypto/mem.c:125:9: Assignment
  123.   
  124.       if (num <= 0)
  125.           return NULL;
                 ^
  126.   
  127.       allow_customize = 0;

crypto/x509/x509spki.c:88:10: Assignment
86.       if (len <= 0)
87.           len = strlen(str);
88.       if ((spki_der = OPENSSL_malloc(len + 1)) == NULL) {
               ^
89.           X509err(X509_F_NETSCAPE_SPKI_B64_DECODE, ERR_R_MALLOC_FAILURE);
90.           return NULL;

crypto/x509/x509spki.c:92:16: Call
90.           return NULL;
91.       }
92.       spki_len = EVP_DecodeBlock(spki_der, (const unsigned char *)str, len);
                     ^
93.       if (spki_len < 0) {
94.           X509err(X509_F_NETSCAPE_SPKI_B64_DECODE, X509_R_BASE64_DECODE_ERROR);

crypto/evp/encode.c:384:1: <Length trace>
382.   }
383.   
384. > int EVP_DecodeBlock(unsigned char *t, const unsigned char *f, int n)
385.   {
386.       int i, ret = 0, a, b, c, d;

crypto/evp/encode.c:384:1: Parameter `*t`
  382.   }
  383.   
  384. > int EVP_DecodeBlock(unsigned char *t, const unsigned char *f, int n)
  385.   {
  386.       int i, ret = 0, a, b, c, d;

crypto/evp/encode.c:415:11: Assignment
  413.                (((unsigned long)b) << 12L) |
  414.                (((unsigned long)c) << 6L) | (((unsigned long)d)));
  415.           *(t++) = (unsigned char)(l >> 16L) & 0xff;
                   ^
  416.           *(t++) = (unsigned char)(l >> 8L) & 0xff;
  417.           *(t++) = (unsigned char)(l) & 0xff;

crypto/evp/encode.c:416:11: Assignment
  414.                (((unsigned long)c) << 6L) | (((unsigned long)d)));
  415.           *(t++) = (unsigned char)(l >> 16L) & 0xff;
  416.           *(t++) = (unsigned char)(l >> 8L) & 0xff;
                   ^
  417.           *(t++) = (unsigned char)(l) & 0xff;
  418.           ret += 3;

crypto/evp/encode.c:417:9: Array access: Offset: [2, +oo] Size: [1, +oo] by call to `EVP_DecodeBlock` 
  415.           *(t++) = (unsigned char)(l >> 16L) & 0xff;
  416.           *(t++) = (unsigned char)(l >> 8L) & 0xff;
  417.           *(t++) = (unsigned char)(l) & 0xff;
                 ^
  418.           ret += 3;
  419.       }

int EVP_DecodeBlock(unsigned char *t, const unsigned char *f, int n)
{
    int i, ret = 0, a, b, c, d;
    unsigned long l;
    while ((conv_ascii2bin(*f) == B64_WS) && (n > 0)) {
        f++;
        n--;
    }
    while ((n > 3) && (B64_NOT_BASE64(conv_ascii2bin(f[n - 1]))))
        n--;
    if (n % 4 != 0)
        return (-1);
    for (i = 0; i < n; i += 4) {
        a = conv_ascii2bin(*(f++));
        b = conv_ascii2bin(*(f++));
        c = conv_ascii2bin(*(f++));
        d = conv_ascii2bin(*(f++));
        if ((a & 0x80) || (b & 0x80) || (c & 0x80) || (d & 0x80))
            return (-1);
        l = ((((unsigned long)a) << 18L) |
             (((unsigned long)b) << 12L) |
             (((unsigned long)c) << 6L) | (((unsigned long)d)));
        *(t++) = (unsigned char)(l >> 16L) & 0xff;
        *(t++) = (unsigned char)(l >> 8L) & 0xff;
        *(t++) = (unsigned char)(l) & 0xff;
        ret += 3;
    }
    return (ret);
}
['NETSCAPE_SPKI *NETSCAPE_SPKI_b64_decode(const char *str, int len)\n{\n    unsigned char *spki_der;\n    const unsigned char *p;\n    int spki_len;\n    NETSCAPE_SPKI *spki;\n    if (len <= 0)\n        len = strlen(str);\n    if ((spki_der = OPENSSL_malloc(len + 1)) == NULL) {\n        X509err(X509_F_NETSCAPE_SPKI_B64_DECODE, ERR_R_MALLOC_FAILURE);\n        return NULL;\n    }\n    spki_len = EVP_DecodeBlock(spki_der, (const unsigned char *)str, len);\n    if (spki_len < 0) {\n        X509err(X509_F_NETSCAPE_SPKI_B64_DECODE, X509_R_BASE64_DECODE_ERROR);\n        OPENSSL_free(spki_der);\n        return NULL;\n    }\n    p = spki_der;\n    spki = d2i_NETSCAPE_SPKI(NULL, &p, spki_len);\n    OPENSSL_free(spki_der);\n    return spki;\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (num <= 0)\n        return NULL;\n    allow_customize = 0;\n#ifdef CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    (void)file;\n    (void)line;\n    ret = malloc(num);\n#endif\n#ifndef OPENSSL_CPUID_OBJ\n    if (ret && (num > 2048)) {\n        extern unsigned char cleanse_ctr;\n        ((unsigned char *)ret)[0] = cleanse_ctr;\n    }\n#endif\n    return ret;\n}', 'int EVP_DecodeBlock(unsigned char *t, const unsigned char *f, int n)\n{\n    int i, ret = 0, a, b, c, d;\n    unsigned long l;\n    while ((conv_ascii2bin(*f) == B64_WS) && (n > 0)) {\n        f++;\n        n--;\n    }\n    while ((n > 3) && (B64_NOT_BASE64(conv_ascii2bin(f[n - 1]))))\n        n--;\n    if (n % 4 != 0)\n        return (-1);\n    for (i = 0; i < n; i += 4) {\n        a = conv_ascii2bin(*(f++));\n        b = conv_ascii2bin(*(f++));\n        c = conv_ascii2bin(*(f++));\n        d = conv_ascii2bin(*(f++));\n        if ((a & 0x80) || (b & 0x80) || (c & 0x80) || (d & 0x80))\n            return (-1);\n        l = ((((unsigned long)a) << 18L) |\n             (((unsigned long)b) << 12L) |\n             (((unsigned long)c) << 6L) | (((unsigned long)d)));\n        *(t++) = (unsigned char)(l >> 16L) & 0xff;\n        *(t++) = (unsigned char)(l >> 8L) & 0xff;\n        *(t++) = (unsigned char)(l) & 0xff;\n        ret += 3;\n    }\n    return (ret);\n}']