crypto/pem/pvkfmt.c:766: error: BUFFER_OVERRUN_L3
  Offset: 11 Size: [8, +oo] by call to `do_PVK_body`.
Showing all 16 steps of the trace


crypto/pem/pvkfmt.c:753:10: Call
751.       p = pvk_hdr;
752.   
753.       if (!do_PVK_header(&p, 24, 0, &saltlen, &keylen))
                ^
754.           return 0;
755.       buflen = (int)keylen + saltlen;

crypto/pem/pvkfmt.c:609:1: Parameter `*pkeylen`
  607.   # ifndef OPENSSL_NO_RC4
  608.   
  609. > static int do_PVK_header(const unsigned char **in, unsigned int length,
  610.                            int skip_magic,
  611.                            unsigned int *psaltlen, unsigned int *pkeylen)

crypto/pem/pvkfmt.c:766:11: Call
764.           goto err;
765.       }
766.       ret = do_PVK_body(&p, saltlen, keylen, cb, u);
                 ^
767.   
768.    err:

crypto/pem/pvkfmt.c:666:1: Parameter `keylen`
  664.   }
  665.   
  666. > static EVP_PKEY *do_PVK_body(const unsigned char **in,
  667.                                unsigned int saltlen, unsigned int keylen,
  668.                                pem_password_cb *cb, void *u)

crypto/pem/pvkfmt.c:688:18: Call
  686.               goto err;
  687.           }
  688.           enctmp = OPENSSL_malloc(keylen + 8);
                          ^
  689.           if (enctmp == NULL) {
  690.               PEMerr(PEM_F_DO_PVK_BODY, ERR_R_MALLOC_FAILURE);

crypto/mem.c:125:9: Assignment
    123.   
    124.       if (num <= 0)
    125.           return NULL;
                   ^
    126.   
    127.       allow_customize = 0;

crypto/pem/pvkfmt.c:688:9: Assignment
  686.               goto err;
  687.           }
  688.           enctmp = OPENSSL_malloc(keylen + 8);
                 ^
  689.           if (enctmp == NULL) {
  690.               PEMerr(PEM_F_DO_PVK_BODY, ERR_R_MALLOC_FAILURE);

crypto/pem/pvkfmt.c:705:9: Assignment
  703.           }
  704.           inlen = keylen - 8;
  705.           q = enctmp + 8;
                 ^
  706.           if (!EVP_DecryptInit_ex(cctx, EVP_rc4(), NULL, keybuf, NULL))
  707.               goto err;

crypto/pem/pvkfmt.c:712:17: Call
  710.           if (!EVP_DecryptFinal_ex(cctx, q + enctmplen, &enctmplen))
  711.               goto err;
  712.           magic = read_ledword((const unsigned char **)&q);
                         ^
  713.           if (magic != MS_RSA2MAGIC && magic != MS_DSS2MAGIC) {
  714.               q = enctmp + 8;

crypto/pem/pvkfmt.c:77:1: <Length trace>
75.    */
76.   
77. > static unsigned int read_ledword(const unsigned char **in)
78.   {
79.       const unsigned char *p = *in;

crypto/pem/pvkfmt.c:77:1: Parameter `**in`
    75.    */
    76.   
    77. > static unsigned int read_ledword(const unsigned char **in)
    78.   {
    79.       const unsigned char *p = *in;

crypto/pem/pvkfmt.c:79:5: Assignment
    77.   static unsigned int read_ledword(const unsigned char **in)
    78.   {
    79.       const unsigned char *p = *in;
              ^
    80.       unsigned int ret;
    81.       ret = *p++;

crypto/pem/pvkfmt.c:81:12: Assignment
    79.       const unsigned char *p = *in;
    80.       unsigned int ret;
    81.       ret = *p++;
                     ^
    82.       ret |= (*p++ << 8);
    83.       ret |= (*p++ << 16);

crypto/pem/pvkfmt.c:82:14: Assignment
    80.       unsigned int ret;
    81.       ret = *p++;
    82.       ret |= (*p++ << 8);
                       ^
    83.       ret |= (*p++ << 16);
    84.       ret |= (*p++ << 24);

crypto/pem/pvkfmt.c:83:14: Assignment
    81.       ret = *p++;
    82.       ret |= (*p++ << 8);
    83.       ret |= (*p++ << 16);
                       ^
    84.       ret |= (*p++ << 24);
    85.       *in = p;

crypto/pem/pvkfmt.c:84:13: Array access: Offset: 11 Size: [8, +oo] by call to `do_PVK_body` 
    82.       ret |= (*p++ << 8);
    83.       ret |= (*p++ << 16);
    84.       ret |= (*p++ << 24);
                      ^
    85.       *in = p;
    86.       return ret;
