crypto/x509v3/v3_alt.c:146: error: BUFFER_OVERRUN_L2
  Offset: [-oo, 1048576] Size: 256 by call to `X509_NAME_oneline`.
Showing all 8 steps of the trace


crypto/x509v3/v3_alt.c:113:1: Array declaration
111.   }
112.   
113. > STACK_OF(CONF_VALUE) *i2v_GENERAL_NAME(X509V3_EXT_METHOD *method,
114.                                          GENERAL_NAME *gen,
115.                                          STACK_OF(CONF_VALUE) *ret)

crypto/x509v3/v3_alt.c:146:9: Call
144.   
145.       case GEN_DIRNAME:
146.           X509_NAME_oneline(gen->d.dirn, oline, 256);
               ^
147.           X509V3_add_value("DirName", oline, &ret);
148.           break;

crypto/x509/x509_obj.c:110:5: <Offset trace>
108.   
109.       len--;                      /* space for '\0' */
110.       l = 0;
           ^
111.       for (i = 0; i < sk_X509_NAME_ENTRY_num(a->entries); i++) {
112.           ne = sk_X509_NAME_ENTRY_value(a->entries, i);

crypto/x509/x509_obj.c:110:5: Assignment
  108.   
  109.       len--;                      /* space for '\0' */
  110.       l = 0;
             ^
  111.       for (i = 0; i < sk_X509_NAME_ENTRY_num(a->entries); i++) {
  112.           ne = sk_X509_NAME_ENTRY_value(a->entries, i);

crypto/x509/x509_obj.c:168:9: Assignment
  166.           }
  167.   
  168.           lold = l;
                 ^
  169.           l += 1 + l1 + 1 + l2;
  170.           if (l > NAME_ONELINE_MAX) {

crypto/x509/x509_obj.c:73:1: <Length trace>
71.   #define NAME_ONELINE_MAX    (1024 * 1024)
72.   
73. > char *X509_NAME_oneline(X509_NAME *a, char *buf, int len)
74.   {
75.       X509_NAME_ENTRY *ne;

crypto/x509/x509_obj.c:73:1: Parameter `*buf`
  71.   #define NAME_ONELINE_MAX    (1024 * 1024)
  72.   
  73. > char *X509_NAME_oneline(X509_NAME *a, char *buf, int len)
  74.   {
  75.       X509_NAME_ENTRY *ne;

crypto/x509/x509_obj.c:181:13: Array access: Offset: [-oo, 1048576] Size: 256 by call to `X509_NAME_oneline` 
  179.               break;
  180.           } else
  181.               p = &(buf[lold]);
                     ^
  182.           *(p++) = '/';
  183.           memcpy(p, s, (unsigned int)l1);
