crypto/x509v3/v3_alt.c:97: error: BUFFER_OVERRUN_L2
  Offset: [-oo, 1048576] Size: 256 by call to `X509_NAME_oneline`.
Showing all 8 steps of the trace


crypto/x509v3/v3_alt.c:64:1: Array declaration
62.   }
63.   
64. > STACK_OF(CONF_VALUE) *i2v_GENERAL_NAME(X509V3_EXT_METHOD *method,
65.                                          GENERAL_NAME *gen,
66.                                          STACK_OF(CONF_VALUE) *ret)

crypto/x509v3/v3_alt.c:97:9: Call
95.   
96.       case GEN_DIRNAME:
97.           X509_NAME_oneline(gen->d.dirn, oline, 256);
               ^
98.           X509V3_add_value("DirName", oline, &ret);
99.           break;

crypto/x509/x509_obj.c:62:5: <Offset trace>
60.   
61.       len--;                      /* space for '\0' */
62.       l = 0;
          ^
63.       for (i = 0; i < sk_X509_NAME_ENTRY_num(a->entries); i++) {
64.           ne = sk_X509_NAME_ENTRY_value(a->entries, i);

crypto/x509/x509_obj.c:62:5: Assignment
  60.   
  61.       len--;                      /* space for '\0' */
  62.       l = 0;
            ^
  63.       for (i = 0; i < sk_X509_NAME_ENTRY_num(a->entries); i++) {
  64.           ne = sk_X509_NAME_ENTRY_value(a->entries, i);

crypto/x509/x509_obj.c:121:9: Assignment
  119.           }
  120.   
  121.           lold = l;
                 ^
  122.           l += 1 + l1 + 1 + l2;
  123.           if (l > NAME_ONELINE_MAX) {

crypto/x509/x509_obj.c:25:1: <Length trace>
23.   #define NAME_ONELINE_MAX    (1024 * 1024)
24.   
25. > char *X509_NAME_oneline(const X509_NAME *a, char *buf, int len)
26.   {
27.       const X509_NAME_ENTRY *ne;

crypto/x509/x509_obj.c:25:1: Parameter `*buf`
  23.   #define NAME_ONELINE_MAX    (1024 * 1024)
  24.   
  25. > char *X509_NAME_oneline(const X509_NAME *a, char *buf, int len)
  26.   {
  27.       const X509_NAME_ENTRY *ne;

crypto/x509/x509_obj.c:134:13: Array access: Offset: [-oo, 1048576] Size: 256 by call to `X509_NAME_oneline` 
  132.               break;
  133.           } else
  134.               p = &(buf[lold]);
                     ^
  135.           *(p++) = '/';
  136.           memcpy(p, s, (unsigned int)l1);
