crypto/asn1/a_time.c:92: error: BUFFER_OVERRUN_L3
  Offset added: 2 Size: [1, +oo].
Showing all 6 steps of the trace


crypto/asn1/a_time.c:62:1: <Length trace>
60.   
61.   /* Convert an ASN1_TIME structure to GeneralizedTime */
62. > ASN1_GENERALIZEDTIME *ASN1_TIME_to_generalizedtime(const ASN1_TIME *t,
63.                                                      ASN1_GENERALIZEDTIME **out)
64.   {

crypto/asn1/a_time.c:62:1: Parameter `*(*out)->data`
60.   
61.   /* Convert an ASN1_TIME structure to GeneralizedTime */
62. > ASN1_GENERALIZEDTIME *ASN1_TIME_to_generalizedtime(const ASN1_TIME *t,
63.                                                      ASN1_GENERALIZEDTIME **out)
64.   {

crypto/asn1/a_time.c:88:10: Call
86.        * The actual allocation is t->length + 3 to include a terminator byte.
87.        */
88.       if (!ASN1_STRING_set(ret, NULL, t->length + 2))
               ^
89.           goto err;
90.       str = (char *)ret->data;

crypto/asn1/asn1_lib.c:264:1: Parameter `*str->data`
  262.   }
  263.   
  264. > int ASN1_STRING_set(ASN1_STRING *str, const void *_data, int len)
  265.   {
  266.       unsigned char *c;

crypto/asn1/a_time.c:90:5: Assignment
88.       if (!ASN1_STRING_set(ret, NULL, t->length + 2))
89.           goto err;
90.       str = (char *)ret->data;
          ^
91.       /* Work out the century and prepend */
92.       memcpy(str, t->data[0] >= '5' ? "19" : "20", 2);

crypto/asn1/a_time.c:92:5: Array access: Offset added: 2 Size: [1, +oo]
90.       str = (char *)ret->data;
91.       /* Work out the century and prepend */
92.       memcpy(str, t->data[0] >= '5' ? "19" : "20", 2);
          ^
93.       /*
94.        * t->length + 1 is the size of the data and the allocated buffer has
