crypto/ct/ct_log.c:135: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] Size: [1, +oo] by call to `CTLOG_new_from_base64`.
Showing all 30 steps of the trace


crypto/ct/ct_log.c:135:12: Call
133.       }
134.   
135.       return CTLOG_new_from_base64(ct_log, pkey_base64, description);
                  ^
136.   }
137.   

crypto/ct/ct_b64.c:135:1: Parameter `pkey_base64->strlen`
  133.    * -1 on internal (malloc) failure
  134.    */
  135. > int CTLOG_new_from_base64(CTLOG **ct_log, const char *pkey_base64, const char *name)
  136.   {
  137.       unsigned char *pkey_der = NULL;

crypto/ct/ct_b64.c:147:20: Call
  145.       }
  146.   
  147.       pkey_der_len = ct_base64_decode(pkey_base64, &pkey_der);
                            ^
  148.       if (pkey_der_len < 0) {
  149.           CTerr(CT_F_CTLOG_NEW_FROM_BASE64, CT_R_LOG_CONF_INVALID_KEY);

crypto/ct/ct_b64.c:24:1: Parameter `**out`
    22.    * the caller. Do not provide a pre-allocated string in |out|.
    23.    */
    24. > static int ct_base64_decode(const char *in, unsigned char **out)
    25.   {
    26.       size_t inlen = strlen(in);

crypto/ct/ct_b64.c:153:5: Assignment
  151.       }
  152.   
  153.       p = pkey_der;
             ^
  154.       pkey = d2i_PUBKEY(NULL, &p, pkey_der_len);
  155.       OPENSSL_free(pkey_der);

crypto/ct/ct_b64.c:154:12: Call
  152.   
  153.       p = pkey_der;
  154.       pkey = d2i_PUBKEY(NULL, &p, pkey_der_len);
                    ^
  155.       OPENSSL_free(pkey_der);
  156.       if (pkey == NULL) {

crypto/x509/x_pubkey.c:181:1: Parameter `**pp`
    179.    */
    180.   
    181. > EVP_PKEY *d2i_PUBKEY(EVP_PKEY **a, const unsigned char **pp, long length)
    182.   {
    183.       X509_PUBKEY *xpk;

crypto/x509/x_pubkey.c:186:5: Assignment
    184.       EVP_PKEY *pktmp;
    185.       const unsigned char *q;
    186.       q = *pp;
               ^
    187.       xpk = d2i_X509_PUBKEY(NULL, &q, length);
    188.       if (!xpk)

crypto/x509/x_pubkey.c:187:11: Call
    185.       const unsigned char *q;
    186.       q = *pp;
    187.       xpk = d2i_X509_PUBKEY(NULL, &q, length);
                     ^
    188.       if (!xpk)
    189.           return NULL;

crypto/x509/x_pubkey.c:57:1: Parameter `**in`
      55.   } ASN1_SEQUENCE_END_cb(X509_PUBKEY, X509_PUBKEY)
      56.   
      57. > IMPLEMENT_ASN1_FUNCTIONS(X509_PUBKEY)
      58.   
      59.   int X509_PUBKEY_set(X509_PUBKEY **x, EVP_PKEY *pkey)

crypto/x509/x_pubkey.c:57:1: Call
      55.   } ASN1_SEQUENCE_END_cb(X509_PUBKEY, X509_PUBKEY)
      56.   
      57. > IMPLEMENT_ASN1_FUNCTIONS(X509_PUBKEY)
      58.   
      59.   int X509_PUBKEY_set(X509_PUBKEY **x, EVP_PKEY *pkey)

crypto/asn1/tasn_dec.c:95:1: Parameter `**in`
        93.    */
        94.   
        95. > ASN1_VALUE *ASN1_item_d2i(ASN1_VALUE **pval,
        96.                             const unsigned char **in, long len,
        97.                             const ASN1_ITEM *it)

crypto/asn1/tasn_dec.c:104:9: Call
        102.           pval = &ptmpval;
        103.       asn1_tlc_clear_nc(&c);
        104.       if (ASN1_item_ex_d2i(pval, in, len, it, -1, 0, 0, &c) > 0)
                       ^
        105.           return *pval;
        106.       return NULL;

crypto/asn1/tasn_dec.c:109:1: Parameter `**in`
          107.   }
          108.   
          109. > int ASN1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in, long len,
          110.                        const ASN1_ITEM *it,
          111.                        int tag, int aclass, char opt, ASN1_TLC *ctx)

crypto/asn1/tasn_dec.c:114:10: Call
          112.   {
          113.       int rv;
          114.       rv = asn1_item_embed_d2i(pval, in, len, it, tag, aclass, opt, ctx);
                          ^
          115.       if (rv <= 0)
          116.           ASN1_item_ex_free(pval, it);

crypto/asn1/tasn_dec.c:125:1: Parameter `**in`
            123.    */
            124.   
            125. > static int asn1_item_embed_d2i(ASN1_VALUE **pval, const unsigned char **in,
            126.                                  long len, const ASN1_ITEM *it,
            127.                                  int tag, int aclass, char opt, ASN1_TLC *ctx)

crypto/asn1/tasn_dec.c:169:9: Assignment
            167.   
            168.       case ASN1_ITYPE_MSTRING:
            169.           p = *in;
                           ^
            170.           /* Just read in tag and class */
            171.           ret = asn1_check_tlen(NULL, &otag, &oclass, NULL, NULL,

crypto/asn1/tasn_dec.c:171:15: Call
            169.           p = *in;
            170.           /* Just read in tag and class */
            171.           ret = asn1_check_tlen(NULL, &otag, &oclass, NULL, NULL,
                                 ^
            172.                                 &p, len, -1, 0, 1, ctx);
            173.           if (!ret) {

crypto/asn1/tasn_dec.c:1060:1: Parameter `**in`
              1058.    */
              1059.   
              1060. > static int asn1_check_tlen(long *olen, int *otag, unsigned char *oclass,
              1061.                              char *inf, char *cst,
              1062.                              const unsigned char **in, long len,

crypto/asn1/tasn_dec.c:1069:5: Assignment
              1067.       long plen;
              1068.       const unsigned char *p, *q;
              1069.       p = *in;
                          ^
              1070.       q = p;
              1071.   

crypto/asn1/tasn_dec.c:1079:13: Call
              1077.           p += ctx->hdrlen;
              1078.       } else {
              1079.           i = ASN1_get_object(&p, &plen, &ptag, &pclass, len);
                                  ^
              1080.           if (ctx) {
              1081.               ctx->ret = i;

crypto/asn1/asn1_lib.c:44:1: Parameter `**pp`
                42.   }
                43.   
                44. > int ASN1_get_object(const unsigned char **pp, long *plength, int *ptag,
                45.                       int *pclass, long omax)
                46.   {

crypto/asn1/asn1_lib.c:49:5: Assignment
                47.       int i, ret;
                48.       long l;
                49.       const unsigned char *p = *pp;
                          ^
                50.       int tag, xclass, inf;
                51.       long max = omax;

crypto/asn1/asn1_lib.c:78:9: Assignment
                76.       } else {
                77.           tag = i;
                78.           p++;
                              ^
                79.           if (--max == 0)
                80.               goto err;

crypto/asn1/asn1_lib.c:84:10: Call
                82.       *ptag = tag;
                83.       *pclass = xclass;
                84.       if (!asn1_get_length(&p, &inf, plength, max))
                               ^
                85.           goto err;
                86.   

crypto/asn1/asn1_lib.c:112:1: <Length trace>
110.    * are stored most significant digit first.
111.    */
112. > static int asn1_get_length(const unsigned char **pp, int *inf, long *rl,
113.                              long max)
114.   {

crypto/asn1/asn1_lib.c:112:1: Parameter `**pp`
                  110.    * are stored most significant digit first.
                  111.    */
                  112. > static int asn1_get_length(const unsigned char **pp, int *inf, long *rl,
                  113.                              long max)
                  114.   {

crypto/asn1/asn1_lib.c:115:5: Assignment
                  113.                              long max)
                  114.   {
                  115.       const unsigned char *p = *pp;
                             ^
                  116.       unsigned long ret = 0;
                  117.       int i;

crypto/asn1/asn1_lib.c:127:14: Assignment
                  125.           *inf = 0;
                  126.           i = *p & 0x7f;
                  127.           if (*p++ & 0x80) {
                                      ^
                  128.               if (max < i + 1)
                  129.                   return 0;

crypto/asn1/asn1_lib.c:131:29: Array access: Offset: [2, +oo] Size: [1, +oo] by call to `CTLOG_new_from_base64` 
                  129.                   return 0;
                  130.               /* Skip leading zeroes */
                  131.               while (i > 0 && *p == 0) {
                                                     ^
                  132.                   p++;
                  133.                   i--;
