crypto/pkcs12/p12_utl.c:133: error: BUFFER_OVERRUN_L3
  Offset: [3, +oo] Size: [2, +oo].
Showing all 11 steps of the trace


crypto/pkcs12/p12_utl.c:84:10: <Length trace>
82.           asclen = strlen(asc);
83.   
84.       for (ulen = 0, i = 0; i < asclen; i += j) {
               ^
85.           j = UTF8_getc((const unsigned char *)asc+i, asclen-i, &utf32chr);
86.   

crypto/pkcs12/p12_utl.c:84:10: Assignment
82.           asclen = strlen(asc);
83.   
84.       for (ulen = 0, i = 0; i < asclen; i += j) {
               ^
85.           j = UTF8_getc((const unsigned char *)asc+i, asclen-i, &utf32chr);
86.   

crypto/pkcs12/p12_utl.c:115:5: Assignment
113.       }
114.   
115.       ulen += 2;  /* for trailing UTF16 zero */
           ^
116.   
117.       if ((ret = OPENSSL_malloc(ulen)) == NULL) {

crypto/pkcs12/p12_utl.c:117:16: Call
115.       ulen += 2;  /* for trailing UTF16 zero */
116.   
117.       if ((ret = OPENSSL_malloc(ulen)) == NULL) {
                      ^
118.           PKCS12err(PKCS12_F_OPENSSL_UTF82UNI, ERR_R_MALLOC_FAILURE);
119.           return NULL;

crypto/mem.c:201:9: Assignment
  199.   
  200.       if (num == 0)
  201.           return NULL;
                 ^
  202.   
  203.       FAILTEST();

crypto/pkcs12/p12_utl.c:117:10: Assignment
115.       ulen += 2;  /* for trailing UTF16 zero */
116.   
117.       if ((ret = OPENSSL_malloc(ulen)) == NULL) {
                ^
118.           PKCS12err(PKCS12_F_OPENSSL_UTF82UNI, ERR_R_MALLOC_FAILURE);
119.           return NULL;

crypto/pkcs12/p12_utl.c:122:10: Assignment
120.       }
121.       /* re-run the loop writing down UTF-16 characters in big-endian order */
122.       for (unitmp = ret, i = 0; i < asclen; i += j) {
                ^
123.           j = UTF8_getc((const unsigned char *)asc+i, asclen-i, &utf32chr);
124.           if (utf32chr >= 0x10000) {      /* pair if UTF-16 characters */

crypto/pkcs12/p12_utl.c:130:14: Assignment
128.               hi = 0xD800 + (utf32chr>>10);
129.               lo = 0xDC00 + (utf32chr&0x3ff);
130.               *unitmp++ = (unsigned char)(hi>>8);
                    ^
131.               *unitmp++ = (unsigned char)(hi);
132.               *unitmp++ = (unsigned char)(lo>>8);

crypto/pkcs12/p12_utl.c:131:14: Assignment
129.               lo = 0xDC00 + (utf32chr&0x3ff);
130.               *unitmp++ = (unsigned char)(hi>>8);
131.               *unitmp++ = (unsigned char)(hi);
                    ^
132.               *unitmp++ = (unsigned char)(lo>>8);
133.               *unitmp++ = (unsigned char)(lo);

crypto/pkcs12/p12_utl.c:132:14: Assignment
130.               *unitmp++ = (unsigned char)(hi>>8);
131.               *unitmp++ = (unsigned char)(hi);
132.               *unitmp++ = (unsigned char)(lo>>8);
                    ^
133.               *unitmp++ = (unsigned char)(lo);
134.           } else {                        /* or just one */

crypto/pkcs12/p12_utl.c:133:13: Array access: Offset: [3, +oo] Size: [2, +oo]
131.               *unitmp++ = (unsigned char)(hi);
132.               *unitmp++ = (unsigned char)(lo>>8);
133.               *unitmp++ = (unsigned char)(lo);
                   ^
134.           } else {                        /* or just one */
135.               *unitmp++ = (unsigned char)(utf32chr>>8);
