crypto/pkcs12/p12_decr.c:110: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] Size: [1, +oo] by call to `ASN1_item_d2i`.
Showing all 23 steps of the trace


crypto/pkcs12/p12_decr.c:91:10: Call
89.       int outlen;
90.   
91.       if (!PKCS12_pbe_crypt(algor, pass, passlen, oct->data, oct->length,
               ^
92.                             &out, &outlen, 0)) {
93.           PKCS12err(PKCS12_F_PKCS12_ITEM_DECRYPT_D2I,

crypto/pkcs12/p12_decr.c:23:1: Parameter `**data`
  21.    * OPENSSL_malloc'ed buffer
  22.    */
  23. > unsigned char *PKCS12_pbe_crypt(const X509_ALGOR *algor,
  24.                                   const char *pass, int passlen,
  25.                                   const unsigned char *in, int inlen,

crypto/pkcs12/p12_decr.c:97:5: Assignment
95.           return NULL;
96.       }
97.       p = out;
           ^
98.   #ifdef OPENSSL_DEBUG_DECRYPT
99.       {

crypto/pkcs12/p12_decr.c:110:11: Call
108.       }
109.   #endif
110.       ret = ASN1_item_d2i(NULL, &p, outlen, it);
                 ^
111.       if (zbuf)
112.           OPENSSL_cleanse(out, outlen);

crypto/asn1/tasn_dec.c:95:1: Parameter `**in`
  93.    */
  94.   
  95. > ASN1_VALUE *ASN1_item_d2i(ASN1_VALUE **pval,
  96.                             const unsigned char **in, long len,
  97.                             const ASN1_ITEM *it)

crypto/asn1/tasn_dec.c:104:9: Call
  102.           pval = &ptmpval;
  103.       asn1_tlc_clear_nc(&c);
  104.       if (ASN1_item_ex_d2i(pval, in, len, it, -1, 0, 0, &c) > 0)
                 ^
  105.           return *pval;
  106.       return NULL;

crypto/asn1/tasn_dec.c:109:1: Parameter `**in`
    107.   }
    108.   
    109. > int ASN1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in, long len,
    110.                        const ASN1_ITEM *it,
    111.                        int tag, int aclass, char opt, ASN1_TLC *ctx)

crypto/asn1/tasn_dec.c:114:10: Call
    112.   {
    113.       int rv;
    114.       rv = asn1_item_embed_d2i(pval, in, len, it, tag, aclass, opt, ctx);
                    ^
    115.       if (rv <= 0)
    116.           ASN1_item_ex_free(pval, it);

crypto/asn1/tasn_dec.c:125:1: Parameter `**in`
      123.    */
      124.   
      125. > static int asn1_item_embed_d2i(ASN1_VALUE **pval, const unsigned char **in,
      126.                                  long len, const ASN1_ITEM *it,
      127.                                  int tag, int aclass, char opt, ASN1_TLC *ctx)

crypto/asn1/tasn_dec.c:169:9: Assignment
      167.   
      168.       case ASN1_ITYPE_MSTRING:
      169.           p = *in;
                     ^
      170.           /* Just read in tag and class */
      171.           ret = asn1_check_tlen(NULL, &otag, &oclass, NULL, NULL,

crypto/asn1/tasn_dec.c:171:15: Call
      169.           p = *in;
      170.           /* Just read in tag and class */
      171.           ret = asn1_check_tlen(NULL, &otag, &oclass, NULL, NULL,
                           ^
      172.                                 &p, len, -1, 0, 1, ctx);
      173.           if (!ret) {

crypto/asn1/tasn_dec.c:1060:1: Parameter `**in`
        1058.    */
        1059.   
        1060. > static int asn1_check_tlen(long *olen, int *otag, unsigned char *oclass,
        1061.                              char *inf, char *cst,
        1062.                              const unsigned char **in, long len,

crypto/asn1/tasn_dec.c:1069:5: Assignment
        1067.       long plen;
        1068.       const unsigned char *p, *q;
        1069.       p = *in;
                    ^
        1070.       q = p;
        1071.   

crypto/asn1/tasn_dec.c:1079:13: Call
        1077.           p += ctx->hdrlen;
        1078.       } else {
        1079.           i = ASN1_get_object(&p, &plen, &ptag, &pclass, len);
                            ^
        1080.           if (ctx) {
        1081.               ctx->ret = i;

crypto/asn1/asn1_lib.c:44:1: Parameter `**pp`
          42.   }
          43.   
          44. > int ASN1_get_object(const unsigned char **pp, long *plength, int *ptag,
          45.                       int *pclass, long omax)
          46.   {

crypto/asn1/asn1_lib.c:49:5: Assignment
          47.       int i, ret;
          48.       long l;
          49.       const unsigned char *p = *pp;
                    ^
          50.       int tag, xclass, inf;
          51.       long max = omax;

crypto/asn1/asn1_lib.c:78:9: Assignment
          76.       } else {
          77.           tag = i;
          78.           p++;
                        ^
          79.           if (--max == 0)
          80.               goto err;

crypto/asn1/asn1_lib.c:84:10: Call
          82.       *ptag = tag;
          83.       *pclass = xclass;
          84.       if (!asn1_get_length(&p, &inf, plength, max))
                         ^
          85.           goto err;
          86.   

crypto/asn1/asn1_lib.c:112:1: <Length trace>
110.    * are stored most significant digit first.
111.    */
112. > static int asn1_get_length(const unsigned char **pp, int *inf, long *rl,
113.                              long max)
114.   {

crypto/asn1/asn1_lib.c:112:1: Parameter `**pp`
            110.    * are stored most significant digit first.
            111.    */
            112. > static int asn1_get_length(const unsigned char **pp, int *inf, long *rl,
            113.                              long max)
            114.   {

crypto/asn1/asn1_lib.c:115:5: Assignment
            113.                              long max)
            114.   {
            115.       const unsigned char *p = *pp;
                       ^
            116.       unsigned long ret = 0;
            117.       int i;

crypto/asn1/asn1_lib.c:127:14: Assignment
            125.           *inf = 0;
            126.           i = *p & 0x7f;
            127.           if (*p++ & 0x80) {
                                ^
            128.               if (max < i + 1)
            129.                   return 0;

crypto/asn1/asn1_lib.c:131:29: Array access: Offset: [2, +oo] Size: [1, +oo] by call to `ASN1_item_d2i` 
            129.                   return 0;
            130.               /* Skip leading zeroes */
            131.               while (i > 0 && *p == 0) {
                                               ^
            132.                   p++;
            133.                   i--;
