crypto/pem/pem_pkey.c:216: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] Size: [1, +oo] by call to `d2i_DHxparams`.
Showing all 29 steps of the trace


crypto/pem/pem_pkey.c:211:10: Call
209.       DH *ret = NULL;
210.   
211.       if (!PEM_bytes_read_bio(&data, &len, &nm, PEM_STRING_DHPARAMS, bp, cb, u))
                ^
212.           return NULL;
213.       p = data;

crypto/pem/pem_lib.c:280:1: Parameter `**pdata`
  278.   }
  279.   
  280. > int PEM_bytes_read_bio(unsigned char **pdata, long *plen, char **pnm,
  281.                          const char *name, BIO *bp, pem_password_cb *cb,
  282.                          void *u) {

crypto/pem/pem_lib.c:283:12: Call
  281.                          const char *name, BIO *bp, pem_password_cb *cb,
  282.                          void *u) {
  283.       return pem_bytes_read_bio_flags(pdata, plen, pnm, name, bp, cb, u,
                    ^
  284.                                       PEM_FLAG_EAY_COMPATIBLE);
  285.   }

crypto/pem/pem_lib.c:237:1: Parameter `**pdata`
    235.   }
    236.   
    237. > static int pem_bytes_read_bio_flags(unsigned char **pdata, long *plen,
    238.                                       char **pnm, const char *name, BIO *bp,
    239.                                       pem_password_cb *cb, void *u,

crypto/pem/pem_pkey.c:213:5: Assignment
211.       if (!PEM_bytes_read_bio(&data, &len, &nm, PEM_STRING_DHPARAMS, bp, cb, u))
212.           return NULL;
213.       p = data;
           ^
214.   
215.       if (strcmp(nm, PEM_STRING_DHXPARAMS) == 0)

crypto/pem/pem_pkey.c:216:15: Call
214.   
215.       if (strcmp(nm, PEM_STRING_DHXPARAMS) == 0)
216.           ret = d2i_DHxparams(x, &p, len);
                     ^
217.       else
218.           ret = d2i_DHparams(x, &p, len);

crypto/dh/dh_asn1.c:81:1: Parameter `**pp`
  79.   /* Application public function: read in X9.42 DH parameters into DH structure */
  80.   
  81. > DH *d2i_DHxparams(DH **a, const unsigned char **pp, long length)
  82.   {
  83.       int_dhx942_dh *dhx = NULL;

crypto/dh/dh_asn1.c:88:11: Call
  86.       if (dh == NULL)
  87.           return NULL;
  88.       dhx = d2i_int_dhx(NULL, pp, length);
                  ^
  89.       if (dhx == NULL) {
  90.           DH_free(dh);

crypto/dh/dh_asn1.c:77:1: Parameter `**in`
    75.   int i2d_int_dhx(const int_dhx942_dh *a, unsigned char **pp);
    76.   
    77. > IMPLEMENT_ASN1_ENCODE_FUNCTIONS_const_fname(int_dhx942_dh, DHxparams, int_dhx)
    78.   
    79.   /* Application public function: read in X9.42 DH parameters into DH structure */

crypto/dh/dh_asn1.c:77:1: Call
    75.   int i2d_int_dhx(const int_dhx942_dh *a, unsigned char **pp);
    76.   
    77. > IMPLEMENT_ASN1_ENCODE_FUNCTIONS_const_fname(int_dhx942_dh, DHxparams, int_dhx)
    78.   
    79.   /* Application public function: read in X9.42 DH parameters into DH structure */

crypto/asn1/tasn_dec.c:95:1: Parameter `**in`
      93.    */
      94.   
      95. > ASN1_VALUE *ASN1_item_d2i(ASN1_VALUE **pval,
      96.                             const unsigned char **in, long len,
      97.                             const ASN1_ITEM *it)

crypto/asn1/tasn_dec.c:104:9: Call
      102.           pval = &ptmpval;
      103.       asn1_tlc_clear_nc(&c);
      104.       if (ASN1_item_ex_d2i(pval, in, len, it, -1, 0, 0, &c) > 0)
                     ^
      105.           return *pval;
      106.       return NULL;

crypto/asn1/tasn_dec.c:109:1: Parameter `**in`
        107.   }
        108.   
        109. > int ASN1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in, long len,
        110.                        const ASN1_ITEM *it,
        111.                        int tag, int aclass, char opt, ASN1_TLC *ctx)

crypto/asn1/tasn_dec.c:114:10: Call
        112.   {
        113.       int rv;
        114.       rv = asn1_item_embed_d2i(pval, in, len, it, tag, aclass, opt, ctx);
                        ^
        115.       if (rv <= 0)
        116.           ASN1_item_ex_free(pval, it);

crypto/asn1/tasn_dec.c:125:1: Parameter `**in`
          123.    */
          124.   
          125. > static int asn1_item_embed_d2i(ASN1_VALUE **pval, const unsigned char **in,
          126.                                  long len, const ASN1_ITEM *it,
          127.                                  int tag, int aclass, char opt, ASN1_TLC *ctx)

crypto/asn1/tasn_dec.c:169:9: Assignment
          167.   
          168.       case ASN1_ITYPE_MSTRING:
          169.           p = *in;
                         ^
          170.           /* Just read in tag and class */
          171.           ret = asn1_check_tlen(NULL, &otag, &oclass, NULL, NULL,

crypto/asn1/tasn_dec.c:171:15: Call
          169.           p = *in;
          170.           /* Just read in tag and class */
          171.           ret = asn1_check_tlen(NULL, &otag, &oclass, NULL, NULL,
                               ^
          172.                                 &p, len, -1, 0, 1, ctx);
          173.           if (!ret) {

crypto/asn1/tasn_dec.c:1060:1: Parameter `**in`
            1058.    */
            1059.   
            1060. > static int asn1_check_tlen(long *olen, int *otag, unsigned char *oclass,
            1061.                              char *inf, char *cst,
            1062.                              const unsigned char **in, long len,

crypto/asn1/tasn_dec.c:1069:5: Assignment
            1067.       long plen;
            1068.       const unsigned char *p, *q;
            1069.       p = *in;
                        ^
            1070.       q = p;
            1071.   

crypto/asn1/tasn_dec.c:1079:13: Call
            1077.           p += ctx->hdrlen;
            1078.       } else {
            1079.           i = ASN1_get_object(&p, &plen, &ptag, &pclass, len);
                                ^
            1080.           if (ctx) {
            1081.               ctx->ret = i;

crypto/asn1/asn1_lib.c:44:1: Parameter `**pp`
              42.   }
              43.   
              44. > int ASN1_get_object(const unsigned char **pp, long *plength, int *ptag,
              45.                       int *pclass, long omax)
              46.   {

crypto/asn1/asn1_lib.c:49:5: Assignment
              47.       int i, ret;
              48.       long l;
              49.       const unsigned char *p = *pp;
                        ^
              50.       int tag, xclass, inf;
              51.       long max = omax;

crypto/asn1/asn1_lib.c:78:9: Assignment
              76.       } else {
              77.           tag = i;
              78.           p++;
                            ^
              79.           if (--max == 0)
              80.               goto err;

crypto/asn1/asn1_lib.c:84:10: Call
              82.       *ptag = tag;
              83.       *pclass = xclass;
              84.       if (!asn1_get_length(&p, &inf, plength, max))
                             ^
              85.           goto err;
              86.   

crypto/asn1/asn1_lib.c:112:1: <Length trace>
110.    * are stored most significant digit first.
111.    */
112. > static int asn1_get_length(const unsigned char **pp, int *inf, long *rl,
113.                              long max)
114.   {

crypto/asn1/asn1_lib.c:112:1: Parameter `**pp`
                110.    * are stored most significant digit first.
                111.    */
                112. > static int asn1_get_length(const unsigned char **pp, int *inf, long *rl,
                113.                              long max)
                114.   {

crypto/asn1/asn1_lib.c:115:5: Assignment
                113.                              long max)
                114.   {
                115.       const unsigned char *p = *pp;
                           ^
                116.       unsigned long ret = 0;
                117.       int i;

crypto/asn1/asn1_lib.c:127:14: Assignment
                125.           *inf = 0;
                126.           i = *p & 0x7f;
                127.           if (*p++ & 0x80) {
                                    ^
                128.               if (max < i + 1)
                129.                   return 0;

crypto/asn1/asn1_lib.c:131:29: Array access: Offset: [2, +oo] Size: [1, +oo] by call to `d2i_DHxparams` 
                129.                   return 0;
                130.               /* Skip leading zeroes */
                131.               while (i > 0 && *p == 0) {
                                                   ^
                132.                   p++;
                133.                   i--;
