crypto/pem/pem_lib.c:265: error: BUFFER_OVERRUN_L3
  Offset: [-12, +oo] Size: [1, 241] by call to `check_pem`.
Showing all 10 steps of the trace


crypto/pem/pem_lib.c:260:14: Call
258.           pem_free(header, flags);
259.           pem_free(data, flags);
260.           if (!PEM_read_bio_ex(bp, &nm, &header, &data, &len, flags)) {
                    ^
261.               if (ERR_GET_REASON(ERR_peek_error()) == PEM_R_NO_START_LINE)
262.                   ERR_add_error_data(2, "Expecting: ", name);

crypto/pem/pem_lib.c:958:5: Assignment
  956.       }
  957.       BIO_read(headerB, *header, headerlen);
  958.       (*header)[headerlen] = '\0';
             ^
  959.       BIO_read(dataB, *data, len);
  960.       *len_out = len;

crypto/pem/pem_lib.c:265:15: Call
263.               return 0;
264.           }
265.       } while (!check_pem(nm, name));
                     ^
266.       if (!PEM_get_EVP_CIPHER_INFO(header, &cipher))
267.           goto err;

crypto/pem/pem_lib.c:136:1: Parameter `*nm`
  134.   #endif
  135.   
  136. > static int check_pem(const char *nm, const char *name)
  137.   {
  138.       /* Normal matching nm and name */

crypto/pem/pem_lib.c:151:16: Call
  149.           if (strcmp(nm, PEM_STRING_PKCS8INF) == 0)
  150.               return 1;
  151.           slen = pem_check_suffix(nm, "PRIVATE KEY");
                        ^
  152.           if (slen > 0) {
  153.               /*

crypto/pem/pem_lib.c:985:1: <Length trace>
983.    */
984.   
985. > int pem_check_suffix(const char *pem_str, const char *suffix)
986.   {
987.       int pem_len = strlen(pem_str);

crypto/pem/pem_lib.c:985:1: Parameter `*pem_str`
    983.    */
    984.   
    985. > int pem_check_suffix(const char *pem_str, const char *suffix)
    986.   {
    987.       int pem_len = strlen(pem_str);

crypto/pem/pem_lib.c:992:5: Assignment
    990.       if (suffix_len + 1 >= pem_len)
    991.           return 0;
    992.       p = pem_str + pem_len - suffix_len;
               ^
    993.       if (strcmp(p, suffix))
    994.           return 0;

crypto/pem/pem_lib.c:995:5: Assignment
    993.       if (strcmp(p, suffix))
    994.           return 0;
    995.       p--;
               ^
    996.       if (*p != ' ')
    997.           return 0;

crypto/pem/pem_lib.c:996:9: Array access: Offset: [-12, +oo] Size: [1, 241] by call to `check_pem` 
    994.           return 0;
    995.       p--;
    996.       if (*p != ' ')
                   ^
    997.           return 0;
    998.       return p - pem_str;
