crypto/pem/pem_lib.c:722: error: BUFFER_OVERRUN_L1
  Offset: -5 Size: [1, 2147483644].
Showing all 7 steps of the trace


crypto/pem/pem_lib.c:676:1: <Offset trace>
674.   #endif
675.   
676. > int PEM_read_bio(BIO *bp, char **name, char **header, unsigned char **data,
677.                    long *len)
678.   {

crypto/pem/pem_lib.c:676:1: Array declaration
674.   #endif
675.   
676. > int PEM_read_bio(BIO *bp, char **name, char **header, unsigned char **data,
677.                    long *len)
678.   {

crypto/pem/pem_lib.c:713:13: Assignment
711.   
712.           if (strncmp(buf, "-----BEGIN ", 11) == 0) {
713.               i = strlen(&(buf[11]));
                   ^
714.   
715.               if (strncmp(&(buf[11 + i - 6]), "-----\n", 6) != 0)

crypto/pem/pem_lib.c:717:18: <Length trace>
715.               if (strncmp(&(buf[11 + i - 6]), "-----\n", 6) != 0)
716.                   continue;
717.               if (!BUF_MEM_grow(nameB, i + 9)) {
                        ^
718.                   PEMerr(PEM_F_PEM_READ_BIO, ERR_R_MALLOC_FAILURE);
719.                   goto err;

crypto/pem/pem_lib.c:717:18: Call
715.               if (strncmp(&(buf[11 + i - 6]), "-----\n", 6) != 0)
716.                   continue;
717.               if (!BUF_MEM_grow(nameB, i + 9)) {
                        ^
718.                   PEMerr(PEM_F_PEM_READ_BIO, ERR_R_MALLOC_FAILURE);
719.                   goto err;

crypto/buffer/buffer.c:122:1: Parameter `*str->data`
  120.   }
  121.   
  122. > size_t BUF_MEM_grow(BUF_MEM *str, size_t len)
  123.   {
  124.       char *ret;

crypto/pem/pem_lib.c:722:13: Array access: Offset: -5 Size: [1, 2147483644]
720.               }
721.               memcpy(nameB->data, &(buf[11]), i - 6);
722.               nameB->data[i - 6] = '\0';
                   ^
723.               break;
724.           }

int PEM_read_bio(BIO *bp, char **name, char **header, unsigned char **data,
                 long *len)
{
    EVP_ENCODE_CTX *ctx = EVP_ENCODE_CTX_new();
    int end = 0, i, k, bl = 0, hl = 0, nohead = 0;
    char buf[256];
    BUF_MEM *nameB;
    BUF_MEM *headerB;
    BUF_MEM *dataB, *tmpB;
    if (ctx == NULL) {
        PEMerr(PEM_F_PEM_READ_BIO, ERR_R_MALLOC_FAILURE);
        return (0);
    }
    nameB = BUF_MEM_new();
    headerB = BUF_MEM_new();
    dataB = BUF_MEM_new();
    if ((nameB == NULL) || (headerB == NULL) || (dataB == NULL)) {
        goto err;
    }
    buf[254] = '\0';
    for (;;) {
        i = BIO_gets(bp, buf, 254);
        if (i <= 0) {
            PEMerr(PEM_F_PEM_READ_BIO, PEM_R_NO_START_LINE);
            goto err;
        }
        while ((i >= 0) && (buf[i] <= ' '))
            i--;
        buf[++i] = '\n';
        buf[++i] = '\0';
        if (strncmp(buf, "-----BEGIN ", 11) == 0) {
            i = strlen(&(buf[11]));
            if (strncmp(&(buf[11 + i - 6]), "-----\n", 6) != 0)
                continue;
            if (!BUF_MEM_grow(nameB, i + 9)) {
                PEMerr(PEM_F_PEM_READ_BIO, ERR_R_MALLOC_FAILURE);
                goto err;
            }
            memcpy(nameB->data, &(buf[11]), i - 6);
            nameB->data[i - 6] = '\0';
            break;
        }
    }
    hl = 0;
    if (!BUF_MEM_grow(headerB, 256)) {
        PEMerr(PEM_F_PEM_READ_BIO, ERR_R_MALLOC_FAILURE);
        goto err;
    }
    headerB->data[0] = '\0';
    for (;;) {
        i = BIO_gets(bp, buf, 254);
        if (i <= 0)
            break;
        while ((i >= 0) && (buf[i] <= ' '))
            i--;
        buf[++i] = '\n';
        buf[++i] = '\0';
        if (buf[0] == '\n')
            break;
        if (!BUF_MEM_grow(headerB, hl + i + 9)) {
            PEMerr(PEM_F_PEM_READ_BIO, ERR_R_MALLOC_FAILURE);
            goto err;
        }
        if (strncmp(buf, "-----END ", 9) == 0) {
            nohead = 1;
            break;
        }
        memcpy(&(headerB->data[hl]), buf, i);
        headerB->data[hl + i] = '\0';
        hl += i;
    }
    bl = 0;
    if (!BUF_MEM_grow(dataB, 1024)) {
        PEMerr(PEM_F_PEM_READ_BIO, ERR_R_MALLOC_FAILURE);
        goto err;
    }
    dataB->data[0] = '\0';
    if (!nohead) {
        for (;;) {
            i = BIO_gets(bp, buf, 254);
            if (i <= 0)
                break;
            while ((i >= 0) && (buf[i] <= ' '))
                i--;
            buf[++i] = '\n';
            buf[++i] = '\0';
            if (i != 65)
                end = 1;
            if (strncmp(buf, "-----END ", 9) == 0)
                break;
            if (i > 65)
                break;
            if (!BUF_MEM_grow_clean(dataB, i + bl + 9)) {
                PEMerr(PEM_F_PEM_READ_BIO, ERR_R_MALLOC_FAILURE);
                goto err;
            }
            memcpy(&(dataB->data[bl]), buf, i);
            dataB->data[bl + i] = '\0';
            bl += i;
            if (end) {
                buf[0] = '\0';
                i = BIO_gets(bp, buf, 254);
                if (i <= 0)
                    break;
                while ((i >= 0) && (buf[i] <= ' '))
                    i--;
                buf[++i] = '\n';
                buf[++i] = '\0';
                break;
            }
        }
    } else {
        tmpB = headerB;
        headerB = dataB;
        dataB = tmpB;
        bl = hl;
    }
    i = strlen(nameB->data);
    if ((strncmp(buf, "-----END ", 9) != 0) ||
        (strncmp(nameB->data, &(buf[9]), i) != 0) ||
        (strncmp(&(buf[9 + i]), "-----\n", 6) != 0)) {
        PEMerr(PEM_F_PEM_READ_BIO, PEM_R_BAD_END_LINE);
        goto err;
    }
    EVP_DecodeInit(ctx);
    i = EVP_DecodeUpdate(ctx,
                         (unsigned char *)dataB->data, &bl,
                         (unsigned char *)dataB->data, bl);
    if (i < 0) {
        PEMerr(PEM_F_PEM_READ_BIO, PEM_R_BAD_BASE64_DECODE);
        goto err;
    }
    i = EVP_DecodeFinal(ctx, (unsigned char *)&(dataB->data[bl]), &k);
    if (i < 0) {
        PEMerr(PEM_F_PEM_READ_BIO, PEM_R_BAD_BASE64_DECODE);
        goto err;
    }
    bl += k;
    if (bl == 0)
        goto err;
    *name = nameB->data;
    *header = headerB->data;
    *data = (unsigned char *)dataB->data;
    *len = bl;
    OPENSSL_free(nameB);
    OPENSSL_free(headerB);
    OPENSSL_free(dataB);
    EVP_ENCODE_CTX_free(ctx);
    return (1);
 err:
    BUF_MEM_free(nameB);
    BUF_MEM_free(headerB);
    BUF_MEM_free(dataB);
    EVP_ENCODE_CTX_free(ctx);
    return (0);
}
['int PEM_read_bio(BIO *bp, char **name, char **header, unsigned char **data,\n                 long *len)\n{\n    EVP_ENCODE_CTX *ctx = EVP_ENCODE_CTX_new();\n    int end = 0, i, k, bl = 0, hl = 0, nohead = 0;\n    char buf[256];\n    BUF_MEM *nameB;\n    BUF_MEM *headerB;\n    BUF_MEM *dataB, *tmpB;\n    if (ctx == NULL) {\n        PEMerr(PEM_F_PEM_READ_BIO, ERR_R_MALLOC_FAILURE);\n        return (0);\n    }\n    nameB = BUF_MEM_new();\n    headerB = BUF_MEM_new();\n    dataB = BUF_MEM_new();\n    if ((nameB == NULL) || (headerB == NULL) || (dataB == NULL)) {\n        goto err;\n    }\n    buf[254] = \'\\0\';\n    for (;;) {\n        i = BIO_gets(bp, buf, 254);\n        if (i <= 0) {\n            PEMerr(PEM_F_PEM_READ_BIO, PEM_R_NO_START_LINE);\n            goto err;\n        }\n        while ((i >= 0) && (buf[i] <= \' \'))\n            i--;\n        buf[++i] = \'\\n\';\n        buf[++i] = \'\\0\';\n        if (strncmp(buf, "-----BEGIN ", 11) == 0) {\n            i = strlen(&(buf[11]));\n            if (strncmp(&(buf[11 + i - 6]), "-----\\n", 6) != 0)\n                continue;\n            if (!BUF_MEM_grow(nameB, i + 9)) {\n                PEMerr(PEM_F_PEM_READ_BIO, ERR_R_MALLOC_FAILURE);\n                goto err;\n            }\n            memcpy(nameB->data, &(buf[11]), i - 6);\n            nameB->data[i - 6] = \'\\0\';\n            break;\n        }\n    }\n    hl = 0;\n    if (!BUF_MEM_grow(headerB, 256)) {\n        PEMerr(PEM_F_PEM_READ_BIO, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    headerB->data[0] = \'\\0\';\n    for (;;) {\n        i = BIO_gets(bp, buf, 254);\n        if (i <= 0)\n            break;\n        while ((i >= 0) && (buf[i] <= \' \'))\n            i--;\n        buf[++i] = \'\\n\';\n        buf[++i] = \'\\0\';\n        if (buf[0] == \'\\n\')\n            break;\n        if (!BUF_MEM_grow(headerB, hl + i + 9)) {\n            PEMerr(PEM_F_PEM_READ_BIO, ERR_R_MALLOC_FAILURE);\n            goto err;\n        }\n        if (strncmp(buf, "-----END ", 9) == 0) {\n            nohead = 1;\n            break;\n        }\n        memcpy(&(headerB->data[hl]), buf, i);\n        headerB->data[hl + i] = \'\\0\';\n        hl += i;\n    }\n    bl = 0;\n    if (!BUF_MEM_grow(dataB, 1024)) {\n        PEMerr(PEM_F_PEM_READ_BIO, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    dataB->data[0] = \'\\0\';\n    if (!nohead) {\n        for (;;) {\n            i = BIO_gets(bp, buf, 254);\n            if (i <= 0)\n                break;\n            while ((i >= 0) && (buf[i] <= \' \'))\n                i--;\n            buf[++i] = \'\\n\';\n            buf[++i] = \'\\0\';\n            if (i != 65)\n                end = 1;\n            if (strncmp(buf, "-----END ", 9) == 0)\n                break;\n            if (i > 65)\n                break;\n            if (!BUF_MEM_grow_clean(dataB, i + bl + 9)) {\n                PEMerr(PEM_F_PEM_READ_BIO, ERR_R_MALLOC_FAILURE);\n                goto err;\n            }\n            memcpy(&(dataB->data[bl]), buf, i);\n            dataB->data[bl + i] = \'\\0\';\n            bl += i;\n            if (end) {\n                buf[0] = \'\\0\';\n                i = BIO_gets(bp, buf, 254);\n                if (i <= 0)\n                    break;\n                while ((i >= 0) && (buf[i] <= \' \'))\n                    i--;\n                buf[++i] = \'\\n\';\n                buf[++i] = \'\\0\';\n                break;\n            }\n        }\n    } else {\n        tmpB = headerB;\n        headerB = dataB;\n        dataB = tmpB;\n        bl = hl;\n    }\n    i = strlen(nameB->data);\n    if ((strncmp(buf, "-----END ", 9) != 0) ||\n        (strncmp(nameB->data, &(buf[9]), i) != 0) ||\n        (strncmp(&(buf[9 + i]), "-----\\n", 6) != 0)) {\n        PEMerr(PEM_F_PEM_READ_BIO, PEM_R_BAD_END_LINE);\n        goto err;\n    }\n    EVP_DecodeInit(ctx);\n    i = EVP_DecodeUpdate(ctx,\n                         (unsigned char *)dataB->data, &bl,\n                         (unsigned char *)dataB->data, bl);\n    if (i < 0) {\n        PEMerr(PEM_F_PEM_READ_BIO, PEM_R_BAD_BASE64_DECODE);\n        goto err;\n    }\n    i = EVP_DecodeFinal(ctx, (unsigned char *)&(dataB->data[bl]), &k);\n    if (i < 0) {\n        PEMerr(PEM_F_PEM_READ_BIO, PEM_R_BAD_BASE64_DECODE);\n        goto err;\n    }\n    bl += k;\n    if (bl == 0)\n        goto err;\n    *name = nameB->data;\n    *header = headerB->data;\n    *data = (unsigned char *)dataB->data;\n    *len = bl;\n    OPENSSL_free(nameB);\n    OPENSSL_free(headerB);\n    OPENSSL_free(dataB);\n    EVP_ENCODE_CTX_free(ctx);\n    return (1);\n err:\n    BUF_MEM_free(nameB);\n    BUF_MEM_free(headerB);\n    BUF_MEM_free(dataB);\n    EVP_ENCODE_CTX_free(ctx);\n    return (0);\n}', 'size_t BUF_MEM_grow(BUF_MEM *str, size_t len)\n{\n    char *ret;\n    size_t n;\n    if (str->length >= len) {\n        str->length = len;\n        return (len);\n    }\n    if (str->max >= len) {\n        memset(&str->data[str->length], 0, len - str->length);\n        str->length = len;\n        return (len);\n    }\n    if (len > LIMIT_BEFORE_EXPANSION) {\n        BUFerr(BUF_F_BUF_MEM_GROW, ERR_R_MALLOC_FAILURE);\n        return 0;\n    }\n    n = (len + 3) / 3 * 4;\n    if ((str->flags & BUF_MEM_FLAG_SECURE))\n        ret = sec_alloc_realloc(str, n);\n    else\n        ret = OPENSSL_realloc(str->data, n);\n    if (ret == NULL) {\n        BUFerr(BUF_F_BUF_MEM_GROW, ERR_R_MALLOC_FAILURE);\n        len = 0;\n    } else {\n        str->data = ret;\n        str->max = n;\n        memset(&str->data[str->length], 0, len - str->length);\n        str->length = len;\n    }\n    return (len);\n}']