crypto/cms/cms_smime.c:720: error: BUFFER_OVERRUN_L3
  Offset: 6 Size: [1, +oo] by call to `CMS_RecipientInfo_decrypt`.
Showing all 13 steps of the trace


crypto/cms/cms_smime.c:720:13: Call
718.               continue;
719.           CMS_RecipientInfo_set0_password(ri, pass, passlen);
720.           r = CMS_RecipientInfo_decrypt(cms, ri);
                   ^
721.           CMS_RecipientInfo_set0_password(ri, NULL, 0);
722.           if (r > 0)

crypto/cms/cms_env.c:739:1: Parameter `ri->d.pwri->encryptedKey->length`
  737.   }
  738.   
  739. > int CMS_RecipientInfo_decrypt(CMS_ContentInfo *cms, CMS_RecipientInfo *ri)
  740.   {
  741.       switch (ri->type) {

crypto/cms/cms_smime.c:720:13: Call
718.               continue;
719.           CMS_RecipientInfo_set0_password(ri, pass, passlen);
720.           r = CMS_RecipientInfo_decrypt(cms, ri);
                   ^
721.           CMS_RecipientInfo_set0_password(ri, NULL, 0);
722.           if (r > 0)

crypto/cms/cms_env.c:739:1: Parameter `ri->d.pwri->encryptedKey->length`
  737.   }
  738.   
  739. > int CMS_RecipientInfo_decrypt(CMS_ContentInfo *cms, CMS_RecipientInfo *ri)
  740.   {
  741.       switch (ri->type) {

crypto/cms/cms_env.c:749:16: Call
  747.   
  748.       case CMS_RECIPINFO_PASS:
  749.           return cms_RecipientInfo_pwri_crypt(cms, ri, 0);
                        ^
  750.   
  751.       default:

crypto/cms/cms_pwri.c:276:1: Parameter `ri->d.pwri->encryptedKey->length`
    274.   /* Encrypt/Decrypt content key in PWRI recipient info */
    275.   
    276. > int cms_RecipientInfo_pwri_crypt(const CMS_ContentInfo *cms, CMS_RecipientInfo *ri,
    277.                                    int en_de)
    278.   {

crypto/cms/cms_pwri.c:369:14: Call
    367.               goto err;
    368.           }
    369.           if (!kek_unwrap_key(key, &keylen,
                        ^
    370.                               pwri->encryptedKey->data,
    371.                               pwri->encryptedKey->length, kekctx)) {

crypto/cms/cms_pwri.c:176:1: <Length trace>
174.    */
175.   
176. > static int kek_unwrap_key(unsigned char *out, size_t *outlen,
177.                             const unsigned char *in, size_t inlen,
178.                             EVP_CIPHER_CTX *ctx)

crypto/cms/cms_pwri.c:176:1: Parameter `inlen`
      174.    */
      175.   
      176. > static int kek_unwrap_key(unsigned char *out, size_t *outlen,
      177.                             const unsigned char *in, size_t inlen,
      178.                             EVP_CIPHER_CTX *ctx)

crypto/cms/cms_pwri.c:191:16: Call
      189.           return 0;
      190.       }
      191.       if ((tmp = OPENSSL_malloc(inlen)) == NULL) {
                            ^
      192.           CMSerr(CMS_F_KEK_UNWRAP_KEY, ERR_R_MALLOC_FAILURE);
      193.           return 0;

crypto/mem.c:201:9: Assignment
        199.   
        200.       if (num == 0)
        201.           return NULL;
                       ^
        202.   
        203.       FAILTEST();

crypto/cms/cms_pwri.c:191:10: Assignment
      189.           return 0;
      190.       }
      191.       if ((tmp = OPENSSL_malloc(inlen)) == NULL) {
                      ^
      192.           CMSerr(CMS_F_KEK_UNWRAP_KEY, ERR_R_MALLOC_FAILURE);
      193.           return 0;

crypto/cms/cms_pwri.c:214:60: Array access: Offset: 6 Size: [1, +oo] by call to `CMS_RecipientInfo_decrypt` 
      212.           goto err;
      213.       /* Check check bytes */
      214.       if (((tmp[1] ^ tmp[4]) & (tmp[2] ^ tmp[5]) & (tmp[3] ^ tmp[6])) != 0xff) {
                                                                        ^
      215.           /* Check byte failure */
      216.           goto err;
