crypto/pem/pvkfmt.c:766: error: BUFFER_OVERRUN_L3
  Offset: 1 Size: [0, +oo] by call to `do_PVK_body`.
Showing all 21 steps of the trace


crypto/pem/pvkfmt.c:753:10: Call
751.       p = pvk_hdr;
752.   
753.       if (!do_PVK_header(&p, 24, 0, &saltlen, &keylen))
                ^
754.           return 0;
755.       buflen = (int)keylen + saltlen;

crypto/pem/pvkfmt.c:609:1: Parameter `*pkeylen`
  607.   # ifndef OPENSSL_NO_RC4
  608.   
  609. > static int do_PVK_header(const unsigned char **in, unsigned int length,
  610.                            int skip_magic,
  611.                            unsigned int *psaltlen, unsigned int *pkeylen)

crypto/pem/pvkfmt.c:755:5: Assignment
753.       if (!do_PVK_header(&p, 24, 0, &saltlen, &keylen))
754.           return 0;
755.       buflen = (int)keylen + saltlen;
           ^
756.       buf = OPENSSL_malloc(buflen);
757.       if (buf == NULL) {

crypto/pem/pvkfmt.c:756:11: Call
754.           return 0;
755.       buflen = (int)keylen + saltlen;
756.       buf = OPENSSL_malloc(buflen);
                 ^
757.       if (buf == NULL) {
758.           PEMerr(PEM_F_B2I_PVK_BIO, ERR_R_MALLOC_FAILURE);

crypto/mem.c:125:9: Assignment
  123.   
  124.       if (num <= 0)
  125.           return NULL;
                 ^
  126.   
  127.       allow_customize = 0;

crypto/pem/pvkfmt.c:756:5: Assignment
754.           return 0;
755.       buflen = (int)keylen + saltlen;
756.       buf = OPENSSL_malloc(buflen);
           ^
757.       if (buf == NULL) {
758.           PEMerr(PEM_F_B2I_PVK_BIO, ERR_R_MALLOC_FAILURE);

crypto/pem/pvkfmt.c:761:5: Assignment
759.           return 0;
760.       }
761.       p = buf;
           ^
762.       if (BIO_read(in, buf, buflen) != buflen) {
763.           PEMerr(PEM_F_B2I_PVK_BIO, PEM_R_PVK_DATA_TOO_SHORT);

crypto/pem/pvkfmt.c:766:11: Call
764.           goto err;
765.       }
766.       ret = do_PVK_body(&p, saltlen, keylen, cb, u);
                 ^
767.   
768.    err:

crypto/pem/pvkfmt.c:666:1: Parameter `**in`
  664.   }
  665.   
  666. > static EVP_PKEY *do_PVK_body(const unsigned char **in,
  667.                                unsigned int saltlen, unsigned int keylen,
  668.                                pem_password_cb *cb, void *u)

crypto/pem/pvkfmt.c:671:5: Assignment
  669.   {
  670.       EVP_PKEY *ret = NULL;
  671.       const unsigned char *p = *in;
             ^
  672.       unsigned int magic;
  673.       unsigned char *enctmp = NULL, *q;

crypto/pem/pvkfmt.c:733:11: Call
  731.       }
  732.   
  733.       ret = b2i_PrivateKey(&p, keylen);
                   ^
  734.    err:
  735.       EVP_CIPHER_CTX_free(cctx);

crypto/pem/pvkfmt.c:388:1: Parameter `**in`
    386.   }
    387.   
    388. > EVP_PKEY *b2i_PrivateKey(const unsigned char **in, long length)
    389.   {
    390.       return do_b2i(in, length, 0);

crypto/pem/pvkfmt.c:390:12: Call
    388.   EVP_PKEY *b2i_PrivateKey(const unsigned char **in, long length)
    389.   {
    390.       return do_b2i(in, length, 0);
                      ^
    391.   }
    392.   

crypto/pem/pvkfmt.c:234:1: Parameter `**in`
      232.   }
      233.   
      234. > static EVP_PKEY *do_b2i(const unsigned char **in, unsigned int length,
      235.                           int ispub)
      236.   {

crypto/pem/pvkfmt.c:237:5: Assignment
      235.                           int ispub)
      236.   {
      237.       const unsigned char *p = *in;
                 ^
      238.       unsigned int bitlen, magic;
      239.       int isdss;

crypto/pem/pvkfmt.c:240:9: Call
      238.       unsigned int bitlen, magic;
      239.       int isdss;
      240.       if (do_blob_header(&p, length, &magic, &bitlen, &isdss, &ispub) <= 0) {
                     ^
      241.           PEMerr(PEM_F_DO_B2I, PEM_R_KEYBLOB_HEADER_PARSE_ERROR);
      242.           return NULL;

crypto/pem/pvkfmt.c:140:1: <Length trace>
138.                            unsigned int bitlen, int ispub);
139.   
140. > static int do_blob_header(const unsigned char **in, unsigned int length,
141.                             unsigned int *pmagic, unsigned int *pbitlen,
142.                             int *pisdss, int *pispub)

crypto/pem/pvkfmt.c:140:1: Parameter `**in`
        138.                            unsigned int bitlen, int ispub);
        139.   
        140. > static int do_blob_header(const unsigned char **in, unsigned int length,
        141.                             unsigned int *pmagic, unsigned int *pbitlen,
        142.                             int *pisdss, int *pispub)

crypto/pem/pvkfmt.c:144:5: Assignment
        142.                             int *pisdss, int *pispub)
        143.   {
        144.       const unsigned char *p = *in;
                   ^
        145.       if (length < 16)
        146.           return 0;

crypto/pem/pvkfmt.c:162:5: Assignment
        160.       } else
        161.           return 0;
        162.       p++;
                   ^
        163.       /* Version */
        164.       if (*p++ != 0x2) {

crypto/pem/pvkfmt.c:164:9: Array access: Offset: 1 Size: [0, +oo] by call to `do_PVK_body` 
        162.       p++;
        163.       /* Version */
        164.       if (*p++ != 0x2) {
                       ^
        165.           PEMerr(PEM_F_DO_BLOB_HEADER, PEM_R_BAD_VERSION_NUMBER);
        166.           return 0;
