crypto/pem/pvkfmt.c:766: error: BUFFER_OVERRUN_L3
  Offset added: [10, +oo] (⇐ [9, +oo] + [1, +oo]) Size: [8, +oo] by call to `do_PVK_body`.
Showing all 13 steps of the trace


crypto/pem/pvkfmt.c:753:10: Call
751.       p = pvk_hdr;
752.   
753.       if (!do_PVK_header(&p, 24, 0, &saltlen, &keylen))
                ^
754.           return 0;
755.       buflen = (int)keylen + saltlen;

crypto/pem/pvkfmt.c:609:1: Parameter `*pkeylen`
  607.   # ifndef OPENSSL_NO_RC4
  608.   
  609. > static int do_PVK_header(const unsigned char **in, unsigned int length,
  610.                            int skip_magic,
  611.                            unsigned int *psaltlen, unsigned int *pkeylen)

crypto/pem/pvkfmt.c:766:11: Call
764.           goto err;
765.       }
766.       ret = do_PVK_body(&p, saltlen, keylen, cb, u);
                 ^
767.   
768.    err:

crypto/pem/pvkfmt.c:666:1: Parameter `keylen`
  664.   }
  665.   
  666. > static EVP_PKEY *do_PVK_body(const unsigned char **in,
  667.                                unsigned int saltlen, unsigned int keylen,
  668.                                pem_password_cb *cb, void *u)

crypto/pem/pvkfmt.c:704:9: Assignment
  702.               goto err;
  703.           }
  704.           inlen = keylen - 8;
                 ^
  705.           q = enctmp + 8;
  706.           if (!EVP_DecryptInit_ex(cctx, EVP_rc4(), NULL, keybuf, NULL))

crypto/pem/pvkfmt.c:708:14: Call
  706.           if (!EVP_DecryptInit_ex(cctx, EVP_rc4(), NULL, keybuf, NULL))
  707.               goto err;
  708.           if (!EVP_DecryptUpdate(cctx, q, &enctmplen, p, inlen))
                      ^
  709.               goto err;
  710.           if (!EVP_DecryptFinal_ex(cctx, q + enctmplen, &enctmplen))

crypto/evp/evp_enc.c:422:1: Parameter `inl`
    420.   }
    421.   
    422. > int EVP_DecryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,
    423.                         const unsigned char *in, int inl)
    424.   {

crypto/evp/evp_enc.c:444:16: Call
    442.   
    443.       if (ctx->flags & EVP_CIPH_NO_PADDING)
    444.           return EVP_EncryptUpdate(ctx, out, outl, in, inl);
                          ^
    445.   
    446.       b = ctx->cipher->block_size;

crypto/evp/evp_enc.c:310:1: <Offset trace>
308.   }
309.   
310. > int EVP_EncryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,
311.                         const unsigned char *in, int inl)
312.   {

crypto/evp/evp_enc.c:310:1: Parameter `inl`
      308.   }
      309.   
      310. > int EVP_EncryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,
      311.                         const unsigned char *in, int inl)
      312.   {

crypto/evp/evp_enc.c:310:1: <Length trace>
308.   }
309.   
310. > int EVP_EncryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,
311.                         const unsigned char *in, int inl)
312.   {

crypto/evp/evp_enc.c:310:1: Parameter `*in`
      308.   }
      309.   
      310. > int EVP_EncryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,
      311.                         const unsigned char *in, int inl)
      312.   {

crypto/evp/evp_enc.c:343:13: Array access: Offset added: [10, +oo] (⇐ [9, +oo] + [1, +oo]) Size: [8, +oo] by call to `do_PVK_body` 
      341.       if (i != 0) {
      342.           if (i + inl < bl) {
      343.               memcpy(&(ctx->buf[i]), in, inl);
                         ^
      344.               ctx->buf_len += inl;
      345.               *outl = 0;
