apps/ca.c:809: error: BUFFER_OVERRUN_L3
  Offset added: [-2, +oo] Size: [1, +oo] by call to `ASN1_TIME_set_string_X509`.
Showing all 23 steps of the trace


apps/ca.c:774:22: Call
772.               BIO_printf(bio_err, "policy is %s\n", policy);
773.   
774.           serialfile = lookup_conf(conf, section, ENV_SERIAL);
                            ^
775.           if (serialfile == NULL)
776.               goto end;

apps/ca.c:1243:9: Call
  1241.       char *entry = NCONF_get_string(conf, section, tag);
  1242.       if (entry == NULL)
  1243.           BIO_printf(bio_err, "variable lookup failed for %s::%s\n", section, tag);
                  ^
  1244.       return entry;
  1245.   }

crypto/bio/b_print.c:856:11: Call
    854.       va_start(args, format);
    855.   
    856.       ret = BIO_vprintf(bio, format, args);
                     ^
    857.   
    858.       va_end(args);

crypto/bio/b_print.c:875:10: Call
      873.   
      874.       dynbuf = NULL;
      875.       if (!_dopr(&hugebufp, &dynbuf, &hugebufsize, &retlen, &ignored, format,
                      ^
      876.                   args)) {
      877.           OPENSSL_free(dynbuf);

crypto/bio/b_print.c:114:21: Call
        112.                   state = DP_S_FLAGS;
        113.               else
        114.                   if(!doapr_outch(sbuffer, buffer, &currlen, maxlen, ch))
                                   ^
        115.                       return 0;
        116.               ch = *format++;

crypto/bio/b_print.c:804:1: Parameter `*maxlen`
          802.   #define BUFFER_INC  1024
          803.   
          804. > static int
          805.   doapr_outch(char **sbuffer,
          806.               char **buffer, size_t *currlen, size_t *maxlen, int c)

apps/ca.c:809:35: Call
807.                   ERR_clear_error();
808.           }
809.           if (startdate != NULL && !ASN1_TIME_set_string_X509(NULL, startdate)) {
                                         ^
810.               BIO_printf(bio_err,
811.                          "start date is invalid, it should be YYMMDDHHMMSSZ or YYYYMMDDHHMMSSZ\n");

crypto/asn1/a_time.c:132:1: <Offset trace>
130.   }
131.   
132. > int ASN1_TIME_set_string_X509(ASN1_TIME *s, const char *str)
133.   {
134.       ASN1_TIME t;

crypto/asn1/a_time.c:132:1: Parameter `str->strlen`
  130.   }
  131.   
  132. > int ASN1_TIME_set_string_X509(ASN1_TIME *s, const char *str)
  133.   {
  134.       ASN1_TIME t;

crypto/asn1/a_time.c:138:5: Assignment
  136.       int rv = 0;
  137.   
  138.       t.length = strlen(str);
             ^
  139.       t.data = (unsigned char *)str;
  140.       t.flags = ASN1_STRING_FLAG_X509_TIME;

crypto/asn1/a_time.c:168:13: Assignment
  166.               goto out;
  167.           if (tm.tm_year >= 50 && tm.tm_year < 150) {
  168.               t.length -= 2;
                     ^
  169.               /*
  170.                * it's OK to let original t.data go since that's assigned

crypto/asn1/a_time.c:132:1: <Length trace>
130.   }
131.   
132. > int ASN1_TIME_set_string_X509(ASN1_TIME *s, const char *str)
133.   {
134.       ASN1_TIME t;

crypto/asn1/a_time.c:132:1: Parameter `str->strlen`
  130.   }
  131.   
  132. > int ASN1_TIME_set_string_X509(ASN1_TIME *s, const char *str)
  133.   {
  134.       ASN1_TIME t;

crypto/asn1/a_time.c:138:5: Assignment
  136.       int rv = 0;
  137.   
  138.       t.length = strlen(str);
             ^
  139.       t.data = (unsigned char *)str;
  140.       t.flags = ASN1_STRING_FLAG_X509_TIME;

crypto/asn1/a_time.c:168:13: Assignment
  166.               goto out;
  167.           if (tm.tm_year >= 50 && tm.tm_year < 150) {
  168.               t.length -= 2;
                     ^
  169.               /*
  170.                * it's OK to let original t.data go since that's assigned

crypto/asn1/a_time.c:174:22: Call
  172.                * new t.data would be freed after ASN1_STRING_copy is done.
  173.                */
  174.               t.data = OPENSSL_zalloc(t.length + 1);
                              ^
  175.               if (t.data == NULL)
  176.                   goto out;

crypto/mem.c:186:1: Parameter `num`
    184.   }
    185.   
    186. > void *CRYPTO_zalloc(size_t num, const char *file, int line)
    187.   {
    188.       void *ret = CRYPTO_malloc(num, file, line);

crypto/mem.c:188:17: Call
    186.   void *CRYPTO_zalloc(size_t num, const char *file, int line)
    187.   {
    188.       void *ret = CRYPTO_malloc(num, file, line);
                           ^
    189.   
    190.       FAILTEST();

crypto/mem.c:166:9: Assignment
      164.   
      165.       if (num == 0)
      166.           return NULL;
                     ^
      167.   
      168.       FAILTEST();

crypto/mem.c:188:5: Assignment
    186.   void *CRYPTO_zalloc(size_t num, const char *file, int line)
    187.   {
    188.       void *ret = CRYPTO_malloc(num, file, line);
               ^
    189.   
    190.       FAILTEST();

crypto/mem.c:193:5: Assignment
    191.       if (ret != NULL)
    192.           memset(ret, 0, num);
    193.       return ret;
               ^
    194.   }
    195.   

crypto/asn1/a_time.c:174:13: Assignment
  172.                * new t.data would be freed after ASN1_STRING_copy is done.
  173.                */
  174.               t.data = OPENSSL_zalloc(t.length + 1);
                     ^
  175.               if (t.data == NULL)
  176.                   goto out;

crypto/asn1/a_time.c:177:13: Array access: Offset added: [-2, +oo] Size: [1, +oo] by call to `ASN1_TIME_set_string_X509` 
  175.               if (t.data == NULL)
  176.                   goto out;
  177.               memcpy(t.data, str + 2, t.length);
                     ^
  178.               t.type = V_ASN1_UTCTIME;
  179.           }
