crypto/ct/ct_oct.c:310: error: BUFFER_OVERRUN_S2
  Offset added: [43+max(1, `sct->ext_len`), `sct->ext_len` + 43] (⇐ 43 + [max(1, `sct->ext_len`), `sct->ext_len`]) Size: [1, +oo].
Showing all 17 steps of the trace


crypto/ct/ct_oct.c:268:1: <Offset trace>
266.   }
267.   
268. > int i2o_SCT(const SCT *sct, unsigned char **out)
269.   {
270.       size_t len;

crypto/ct/ct_oct.c:268:1: Parameter `sct->ext_len`
266.   }
267.   
268. > int i2o_SCT(const SCT *sct, unsigned char **out)
269.   {
270.       size_t len;

crypto/ct/ct_oct.c:268:1: <Length trace>
266.   }
267.   
268. > int i2o_SCT(const SCT *sct, unsigned char **out)
269.   {
270.       size_t len;

crypto/ct/ct_oct.c:268:1: Parameter `**out`
266.   }
267.   
268. > int i2o_SCT(const SCT *sct, unsigned char **out)
269.   {
270.       size_t len;

crypto/ct/ct_oct.c:292:9: Assignment
290.   
291.       if (*out != NULL) {
292.           p = *out;
               ^
293.           *out += len;
294.       } else {

crypto/ct/ct_oct.c:304:10: Assignment
302.   
303.       if (sct->version == SCT_VERSION_V1) {
304.           *p++ = sct->version;
                ^
305.           memcpy(p, sct->log_id, CT_V1_HASHLEN);
306.           p += CT_V1_HASHLEN;

crypto/ct/ct_oct.c:306:9: Assignment
304.           *p++ = sct->version;
305.           memcpy(p, sct->log_id, CT_V1_HASHLEN);
306.           p += CT_V1_HASHLEN;
               ^
307.           l2n8(sct->timestamp, p);
308.           s2n(sct->ext_len, p);

crypto/ct/ct_oct.c:307:9: Assignment
305.           memcpy(p, sct->log_id, CT_V1_HASHLEN);
306.           p += CT_V1_HASHLEN;
307.           l2n8(sct->timestamp, p);
               ^
308.           s2n(sct->ext_len, p);
309.           if (sct->ext_len > 0) {

crypto/ct/ct_oct.c:307:9: Assignment
305.           memcpy(p, sct->log_id, CT_V1_HASHLEN);
306.           p += CT_V1_HASHLEN;
307.           l2n8(sct->timestamp, p);
               ^
308.           s2n(sct->ext_len, p);
309.           if (sct->ext_len > 0) {

crypto/ct/ct_oct.c:307:9: Assignment
305.           memcpy(p, sct->log_id, CT_V1_HASHLEN);
306.           p += CT_V1_HASHLEN;
307.           l2n8(sct->timestamp, p);
               ^
308.           s2n(sct->ext_len, p);
309.           if (sct->ext_len > 0) {

crypto/ct/ct_oct.c:307:9: Assignment
305.           memcpy(p, sct->log_id, CT_V1_HASHLEN);
306.           p += CT_V1_HASHLEN;
307.           l2n8(sct->timestamp, p);
               ^
308.           s2n(sct->ext_len, p);
309.           if (sct->ext_len > 0) {

crypto/ct/ct_oct.c:307:9: Assignment
305.           memcpy(p, sct->log_id, CT_V1_HASHLEN);
306.           p += CT_V1_HASHLEN;
307.           l2n8(sct->timestamp, p);
               ^
308.           s2n(sct->ext_len, p);
309.           if (sct->ext_len > 0) {

crypto/ct/ct_oct.c:307:9: Assignment
305.           memcpy(p, sct->log_id, CT_V1_HASHLEN);
306.           p += CT_V1_HASHLEN;
307.           l2n8(sct->timestamp, p);
               ^
308.           s2n(sct->ext_len, p);
309.           if (sct->ext_len > 0) {

crypto/ct/ct_oct.c:307:9: Assignment
305.           memcpy(p, sct->log_id, CT_V1_HASHLEN);
306.           p += CT_V1_HASHLEN;
307.           l2n8(sct->timestamp, p);
               ^
308.           s2n(sct->ext_len, p);
309.           if (sct->ext_len > 0) {

crypto/ct/ct_oct.c:307:9: Assignment
305.           memcpy(p, sct->log_id, CT_V1_HASHLEN);
306.           p += CT_V1_HASHLEN;
307.           l2n8(sct->timestamp, p);
               ^
308.           s2n(sct->ext_len, p);
309.           if (sct->ext_len > 0) {

crypto/ct/ct_oct.c:308:9: Assignment
306.           p += CT_V1_HASHLEN;
307.           l2n8(sct->timestamp, p);
308.           s2n(sct->ext_len, p);
               ^
309.           if (sct->ext_len > 0) {
310.               memcpy(p, sct->ext, sct->ext_len);

crypto/ct/ct_oct.c:310:13: Array access: Offset added: [43+max(1, sct->ext_len), sct->ext_len + 43] (⇐ 43 + [max(1, sct->ext_len), sct->ext_len]) Size: [1, +oo]
308.           s2n(sct->ext_len, p);
309.           if (sct->ext_len > 0) {
310.               memcpy(p, sct->ext, sct->ext_len);
                   ^
311.               p += sct->ext_len;
312.           }
