crypto/pkcs12/p12_utl.c:128: error: BUFFER_OVERRUN_L3
  Offset: [3, +oo] Size: [2, +oo].
Showing all 11 steps of the trace


crypto/pkcs12/p12_utl.c:80:10: <Length trace>
78.           asclen = strlen(asc);
79.   
80.       for (ulen = 0, i = 0; i < asclen; i += j) {
               ^
81.           j = UTF8_getc((const unsigned char *)asc+i, asclen-i, &utf32chr);
82.   

crypto/pkcs12/p12_utl.c:80:10: Assignment
78.           asclen = strlen(asc);
79.   
80.       for (ulen = 0, i = 0; i < asclen; i += j) {
               ^
81.           j = UTF8_getc((const unsigned char *)asc+i, asclen-i, &utf32chr);
82.   

crypto/pkcs12/p12_utl.c:111:5: Assignment
109.       }
110.   
111.       ulen += 2;  /* for trailing UTF16 zero */
           ^
112.   
113.       if ((ret = OPENSSL_malloc(ulen)) == NULL)

crypto/pkcs12/p12_utl.c:113:16: Call
111.       ulen += 2;  /* for trailing UTF16 zero */
112.   
113.       if ((ret = OPENSSL_malloc(ulen)) == NULL)
                      ^
114.           return NULL;
115.   

crypto/mem.c:166:9: Assignment
  164.   
  165.       if (num == 0)
  166.           return NULL;
                 ^
  167.   
  168.       FAILTEST();

crypto/pkcs12/p12_utl.c:113:10: Assignment
111.       ulen += 2;  /* for trailing UTF16 zero */
112.   
113.       if ((ret = OPENSSL_malloc(ulen)) == NULL)
                ^
114.           return NULL;
115.   

crypto/pkcs12/p12_utl.c:117:10: Assignment
115.   
116.       /* re-run the loop writing down UTF-16 characters in big-endian order */
117.       for (unitmp = ret, i = 0; i < asclen; i += j) {
                ^
118.           j = UTF8_getc((const unsigned char *)asc+i, asclen-i, &utf32chr);
119.           if (utf32chr >= 0x10000) {      /* pair if UTF-16 characters */

crypto/pkcs12/p12_utl.c:125:14: Assignment
123.               hi = 0xD800 + (utf32chr>>10);
124.               lo = 0xDC00 + (utf32chr&0x3ff);
125.               *unitmp++ = (unsigned char)(hi>>8);
                    ^
126.               *unitmp++ = (unsigned char)(hi);
127.               *unitmp++ = (unsigned char)(lo>>8);

crypto/pkcs12/p12_utl.c:126:14: Assignment
124.               lo = 0xDC00 + (utf32chr&0x3ff);
125.               *unitmp++ = (unsigned char)(hi>>8);
126.               *unitmp++ = (unsigned char)(hi);
                    ^
127.               *unitmp++ = (unsigned char)(lo>>8);
128.               *unitmp++ = (unsigned char)(lo);

crypto/pkcs12/p12_utl.c:127:14: Assignment
125.               *unitmp++ = (unsigned char)(hi>>8);
126.               *unitmp++ = (unsigned char)(hi);
127.               *unitmp++ = (unsigned char)(lo>>8);
                    ^
128.               *unitmp++ = (unsigned char)(lo);
129.           } else {                        /* or just one */

crypto/pkcs12/p12_utl.c:128:13: Array access: Offset: [3, +oo] Size: [2, +oo]
126.               *unitmp++ = (unsigned char)(hi);
127.               *unitmp++ = (unsigned char)(lo>>8);
128.               *unitmp++ = (unsigned char)(lo);
                   ^
129.           } else {                        /* or just one */
130.               *unitmp++ = (unsigned char)(utf32chr>>8);

unsigned char *OPENSSL_utf82uni(const char *asc, int asclen,
                                unsigned char **uni, int *unilen)
{
    int ulen, i, j;
    unsigned char *unitmp, *ret;
    unsigned long utf32chr = 0;
    if (asclen == -1)
        asclen = strlen(asc);
    for (ulen = 0, i = 0; i < asclen; i += j) {
        j = UTF8_getc((const unsigned char *)asc+i, asclen-i, &utf32chr);
        if (j < 0)
	    return OPENSSL_asc2uni(asc, asclen, uni, unilen);
        if (utf32chr > 0x10FFFF)
	    return NULL;
        if (utf32chr >= 0x10000)
            ulen += 2*2;
        else
            ulen += 2;
    }
    ulen += 2;
    if ((ret = OPENSSL_malloc(ulen)) == NULL)
        return NULL;
    for (unitmp = ret, i = 0; i < asclen; i += j) {
        j = UTF8_getc((const unsigned char *)asc+i, asclen-i, &utf32chr);
        if (utf32chr >= 0x10000) {
            unsigned int hi, lo;
            utf32chr -= 0x10000;
            hi = 0xD800 + (utf32chr>>10);
            lo = 0xDC00 + (utf32chr&0x3ff);
            *unitmp++ = (unsigned char)(hi>>8);
            *unitmp++ = (unsigned char)(hi);
            *unitmp++ = (unsigned char)(lo>>8);
            *unitmp++ = (unsigned char)(lo);
        } else {
            *unitmp++ = (unsigned char)(utf32chr>>8);
            *unitmp++ = (unsigned char)(utf32chr);
        }
    }
    *unitmp++ = 0;
    *unitmp++ = 0;
    if (unilen)
        *unilen = ulen;
    if (uni)
        *uni = ret;
    return ret;
}
['unsigned char *OPENSSL_utf82uni(const char *asc, int asclen,\n                                unsigned char **uni, int *unilen)\n{\n    int ulen, i, j;\n    unsigned char *unitmp, *ret;\n    unsigned long utf32chr = 0;\n    if (asclen == -1)\n        asclen = strlen(asc);\n    for (ulen = 0, i = 0; i < asclen; i += j) {\n        j = UTF8_getc((const unsigned char *)asc+i, asclen-i, &utf32chr);\n        if (j < 0)\n\t    return OPENSSL_asc2uni(asc, asclen, uni, unilen);\n        if (utf32chr > 0x10FFFF)\n\t    return NULL;\n        if (utf32chr >= 0x10000)\n            ulen += 2*2;\n        else\n            ulen += 2;\n    }\n    ulen += 2;\n    if ((ret = OPENSSL_malloc(ulen)) == NULL)\n        return NULL;\n    for (unitmp = ret, i = 0; i < asclen; i += j) {\n        j = UTF8_getc((const unsigned char *)asc+i, asclen-i, &utf32chr);\n        if (utf32chr >= 0x10000) {\n            unsigned int hi, lo;\n            utf32chr -= 0x10000;\n            hi = 0xD800 + (utf32chr>>10);\n            lo = 0xDC00 + (utf32chr&0x3ff);\n            *unitmp++ = (unsigned char)(hi>>8);\n            *unitmp++ = (unsigned char)(hi);\n            *unitmp++ = (unsigned char)(lo>>8);\n            *unitmp++ = (unsigned char)(lo);\n        } else {\n            *unitmp++ = (unsigned char)(utf32chr>>8);\n            *unitmp++ = (unsigned char)(utf32chr);\n        }\n    }\n    *unitmp++ = 0;\n    *unitmp++ = 0;\n    if (unilen)\n        *unilen = ulen;\n    if (uni)\n        *uni = ret;\n    return ret;\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)\n        return malloc_impl(num, file, line);\n    if (num == 0)\n        return NULL;\n    FAILTEST();\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    osslargused(file); osslargused(line);\n    ret = malloc(num);\n#endif\n    return ret;\n}']