crypto/ct/ct_log.c:185: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] Size: [1, +oo] by call to `CTLOG_new_from_base64`.
Showing all 30 steps of the trace


crypto/ct/ct_log.c:185:11: Call
183.       }
184.   
185.       ret = CTLOG_new_from_base64(pkey_base64, description);
                 ^
186.       if (ret == NULL) {
187.           CTerr(CT_F_CTLOG_NEW_FROM_CONF, CT_R_LOG_CONF_INVALID);

crypto/ct/ct_b64.c:167:1: Parameter `pkey_base64->strlen`
  165.   }
  166.   
  167. > CTLOG *CTLOG_new_from_base64(const char *pkey_base64, const char *name)
  168.   {
  169.       unsigned char *pkey_der = NULL;

crypto/ct/ct_b64.c:170:24: Call
  168.   {
  169.       unsigned char *pkey_der = NULL;
  170.       int pkey_der_len = ct_base64_decode(pkey_base64, &pkey_der);
                                ^
  171.       const unsigned char *p;
  172.       EVP_PKEY *pkey = NULL;

crypto/ct/ct_b64.c:73:1: Parameter `**out`
    71.    * the caller. Do not provide a pre-allocated string in |out|.
    72.    */
    73. > static int ct_base64_decode(const char *in, unsigned char **out)
    74.   {
    75.       size_t inlen = strlen(in);

crypto/ct/ct_b64.c:180:5: Assignment
  178.       }
  179.   
  180.       p = pkey_der;
             ^
  181.       pkey = d2i_PUBKEY(NULL, &p, pkey_der_len);
  182.       OPENSSL_free(pkey_der);

crypto/ct/ct_b64.c:181:12: Call
  179.   
  180.       p = pkey_der;
  181.       pkey = d2i_PUBKEY(NULL, &p, pkey_der_len);
                    ^
  182.       OPENSSL_free(pkey_der);
  183.       if (pkey == NULL) {

crypto/x509/x_pubkey.c:191:1: Parameter `**pp`
    189.    */
    190.   
    191. > EVP_PKEY *d2i_PUBKEY(EVP_PKEY **a, const unsigned char **pp, long length)
    192.   {
    193.       X509_PUBKEY *xpk;

crypto/x509/x_pubkey.c:196:5: Assignment
    194.       EVP_PKEY *pktmp;
    195.       const unsigned char *q;
    196.       q = *pp;
               ^
    197.       xpk = d2i_X509_PUBKEY(NULL, &q, length);
    198.       if (!xpk)

crypto/x509/x_pubkey.c:197:11: Call
    195.       const unsigned char *q;
    196.       q = *pp;
    197.       xpk = d2i_X509_PUBKEY(NULL, &q, length);
                     ^
    198.       if (!xpk)
    199.           return NULL;

crypto/x509/x_pubkey.c:101:1: Parameter `**in`
      99.   } ASN1_SEQUENCE_END_cb(X509_PUBKEY, X509_PUBKEY)
      100.   
      101. > IMPLEMENT_ASN1_FUNCTIONS(X509_PUBKEY)
      102.   
      103.   int X509_PUBKEY_set(X509_PUBKEY **x, EVP_PKEY *pkey)

crypto/x509/x_pubkey.c:101:1: Call
      99.   } ASN1_SEQUENCE_END_cb(X509_PUBKEY, X509_PUBKEY)
      100.   
      101. > IMPLEMENT_ASN1_FUNCTIONS(X509_PUBKEY)
      102.   
      103.   int X509_PUBKEY_set(X509_PUBKEY **x, EVP_PKEY *pkey)

crypto/asn1/tasn_dec.c:143:1: Parameter `**in`
        141.    */
        142.   
        143. > ASN1_VALUE *ASN1_item_d2i(ASN1_VALUE **pval,
        144.                             const unsigned char **in, long len,
        145.                             const ASN1_ITEM *it)

crypto/asn1/tasn_dec.c:152:9: Call
        150.           pval = &ptmpval;
        151.       asn1_tlc_clear_nc(&c);
        152.       if (ASN1_item_ex_d2i(pval, in, len, it, -1, 0, 0, &c) > 0)
                       ^
        153.           return *pval;
        154.       return NULL;

crypto/asn1/tasn_dec.c:157:1: Parameter `**in`
          155.   }
          156.   
          157. > int ASN1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in, long len,
          158.                        const ASN1_ITEM *it,
          159.                        int tag, int aclass, char opt, ASN1_TLC *ctx)

crypto/asn1/tasn_dec.c:162:10: Call
          160.   {
          161.       int rv;
          162.       rv = asn1_item_embed_d2i(pval, in, len, it, tag, aclass, opt, ctx);
                          ^
          163.       if (rv <= 0)
          164.           ASN1_item_ex_free(pval, it);

crypto/asn1/tasn_dec.c:173:1: Parameter `**in`
            171.    */
            172.   
            173. > static int asn1_item_embed_d2i(ASN1_VALUE **pval, const unsigned char **in,
            174.                                  long len, const ASN1_ITEM *it,
            175.                                  int tag, int aclass, char opt, ASN1_TLC *ctx)

crypto/asn1/tasn_dec.c:217:9: Assignment
            215.   
            216.       case ASN1_ITYPE_MSTRING:
            217.           p = *in;
                           ^
            218.           /* Just read in tag and class */
            219.           ret = asn1_check_tlen(NULL, &otag, &oclass, NULL, NULL,

crypto/asn1/tasn_dec.c:219:15: Call
            217.           p = *in;
            218.           /* Just read in tag and class */
            219.           ret = asn1_check_tlen(NULL, &otag, &oclass, NULL, NULL,
                                 ^
            220.                                 &p, len, -1, 0, 1, ctx);
            221.           if (!ret) {

crypto/asn1/tasn_dec.c:1096:1: Parameter `**in`
              1094.    */
              1095.   
              1096. > static int asn1_check_tlen(long *olen, int *otag, unsigned char *oclass,
              1097.                              char *inf, char *cst,
              1098.                              const unsigned char **in, long len,

crypto/asn1/tasn_dec.c:1105:5: Assignment
              1103.       long plen;
              1104.       const unsigned char *p, *q;
              1105.       p = *in;
                          ^
              1106.       q = p;
              1107.   

crypto/asn1/tasn_dec.c:1115:13: Call
              1113.           p += ctx->hdrlen;
              1114.       } else {
              1115.           i = ASN1_get_object(&p, &plen, &ptag, &pclass, len);
                                  ^
              1116.           if (ctx) {
              1117.               ctx->ret = i;

crypto/asn1/asn1_lib.c:91:1: Parameter `**pp`
                89.   }
                90.   
                91. > int ASN1_get_object(const unsigned char **pp, long *plength, int *ptag,
                92.                       int *pclass, long omax)
                93.   {

crypto/asn1/asn1_lib.c:96:5: Assignment
                94.       int i, ret;
                95.       long l;
                96.       const unsigned char *p = *pp;
                          ^
                97.       int tag, xclass, inf;
                98.       long max = omax;

crypto/asn1/asn1_lib.c:125:9: Assignment
                123.       } else {
                124.           tag = i;
                125.           p++;
                               ^
                126.           if (--max == 0)
                127.               goto err;

crypto/asn1/asn1_lib.c:131:10: Call
                129.       *ptag = tag;
                130.       *pclass = xclass;
                131.       if (!asn1_get_length(&p, &inf, plength, max))
                                ^
                132.           goto err;
                133.   

crypto/asn1/asn1_lib.c:152:1: <Length trace>
150.   }
151.   
152. > static int asn1_get_length(const unsigned char **pp, int *inf, long *rl,
153.                              long max)
154.   {

crypto/asn1/asn1_lib.c:152:1: Parameter `**pp`
                  150.   }
                  151.   
                  152. > static int asn1_get_length(const unsigned char **pp, int *inf, long *rl,
                  153.                              long max)
                  154.   {

crypto/asn1/asn1_lib.c:155:5: Assignment
                  153.                              long max)
                  154.   {
                  155.       const unsigned char *p = *pp;
                             ^
                  156.       unsigned long ret = 0;
                  157.       unsigned long i;

crypto/asn1/asn1_lib.c:168:15: Assignment
                  166.           *inf = 0;
                  167.           i = *p & 0x7f;
                  168.           if (*(p++) & 0x80) {
                                       ^
                  169.               if (max < (long)i + 1)
                  170.                   return 0;

crypto/asn1/asn1_lib.c:172:25: Array access: Offset: [2, +oo] Size: [1, +oo] by call to `CTLOG_new_from_base64` 
                  170.                   return 0;
                  171.               /* Skip leading zeroes */
                  172.               while (i && *p == 0) {
                                                 ^
                  173.                   p++;
                  174.                   i--;
