apps/x509.c:1064: error: BUFFER_OVERRUN_L3
  Offset added: [-2, +oo] Size: [1, +oo] by call to `set_cert_times`.
Showing all 26 steps of the trace


apps/x509.c:1062:10: Call
1060.   {
1061.   
1062.       if (!X509_set_issuer_name(x, X509_get_subject_name(x)))
                 ^
1063.           goto err;
1064.       if (!preserve_dates && !set_cert_times(x, NULL, NULL, days))

crypto/x509/x509_set.c:54:12: Call
  52.       if (x == NULL)
  53.           return 0;
  54.       return X509_NAME_set(&x->cert_info.issuer, name);
                   ^
  55.   }
  56.   

crypto/x509/x_name.c:491:22: Call
    489.       if (*xn == name)
    490.           return *xn != NULL;
    491.       if ((name_copy = X509_NAME_dup(name)) == NULL)
                                ^
    492.           return 0;
    493.       X509_NAME_free(*xn);

crypto/x509/x_name.c:88:1: Call
      86.   IMPLEMENT_ASN1_FUNCTIONS(X509_NAME)
      87.   
      88. > IMPLEMENT_ASN1_DUP_FUNCTION(X509_NAME)
      89.   
      90.   static int x509_name_ex_new(ASN1_VALUE **val, const ASN1_ITEM *it)

crypto/asn1/a_dup.c:59:9: Call
        57.           return NULL;
        58.   
        59.       i = ASN1_item_i2d(x, &b, it);
                      ^
        60.       if (b == NULL) {
        61.           ASN1err(ASN1_F_ASN1_ITEM_DUP, ERR_R_MALLOC_FAILURE);

crypto/asn1/tasn_enc.c:45:12: Call
          43.   int ASN1_item_i2d(const ASN1_VALUE *val, unsigned char **out, const ASN1_ITEM *it)
          44.   {
          45.       return asn1_item_flags_i2d(val, out, it, 0);
                           ^
          46.   }
          47.   

crypto/asn1/tasn_enc.c:55:1: Parameter `(*out)->strlen`
            53.    */
            54.   
            55. > static int asn1_item_flags_i2d(const ASN1_VALUE *val, unsigned char **out,
            56.                                  const ASN1_ITEM *it, int flags)
            57.   {

apps/x509.c:1064:29: Call
1062.       if (!X509_set_issuer_name(x, X509_get_subject_name(x)))
1063.           goto err;
1064.       if (!preserve_dates && !set_cert_times(x, NULL, NULL, days))
                                    ^
1065.           goto err;
1066.       if (fkey == NULL && !X509_set_pubkey(x, pkey))

apps/apps.c:2507:1: Parameter `startdate->strlen`
  2505.   }
  2506.   
  2507. > int set_cert_times(X509 *x, const char *startdate, const char *enddate,
  2508.                      int days)
  2509.   {

apps/apps.c:2514:14: Call
  2512.               return 0;
  2513.       } else {
  2514.           if (!ASN1_TIME_set_string_X509(X509_getm_notBefore(x), startdate))
                       ^
  2515.               return 0;
  2516.       }

crypto/asn1/a_time.c:374:1: <Offset trace>
372.   }
373.   
374. > int ASN1_TIME_set_string_X509(ASN1_TIME *s, const char *str)
375.   {
376.       ASN1_TIME t;

crypto/asn1/a_time.c:374:1: Parameter `str->strlen`
    372.   }
    373.   
    374. > int ASN1_TIME_set_string_X509(ASN1_TIME *s, const char *str)
    375.   {
    376.       ASN1_TIME t;

crypto/asn1/a_time.c:380:5: Assignment
    378.       int rv = 0;
    379.   
    380.       t.length = strlen(str);
               ^
    381.       t.data = (unsigned char *)str;
    382.       t.flags = ASN1_STRING_FLAG_X509_TIME;

crypto/asn1/a_time.c:410:13: Assignment
    408.               goto out;
    409.           if (is_utc(tm.tm_year)) {
    410.               t.length -= 2;
                       ^
    411.               /*
    412.                * it's OK to let original t.data go since that's assigned

crypto/asn1/a_time.c:374:1: <Length trace>
372.   }
373.   
374. > int ASN1_TIME_set_string_X509(ASN1_TIME *s, const char *str)
375.   {
376.       ASN1_TIME t;

crypto/asn1/a_time.c:374:1: Parameter `str->strlen`
    372.   }
    373.   
    374. > int ASN1_TIME_set_string_X509(ASN1_TIME *s, const char *str)
    375.   {
    376.       ASN1_TIME t;

crypto/asn1/a_time.c:380:5: Assignment
    378.       int rv = 0;
    379.   
    380.       t.length = strlen(str);
               ^
    381.       t.data = (unsigned char *)str;
    382.       t.flags = ASN1_STRING_FLAG_X509_TIME;

crypto/asn1/a_time.c:410:13: Assignment
    408.               goto out;
    409.           if (is_utc(tm.tm_year)) {
    410.               t.length -= 2;
                       ^
    411.               /*
    412.                * it's OK to let original t.data go since that's assigned

crypto/asn1/a_time.c:416:22: Call
    414.                * new t.data would be freed after ASN1_STRING_copy is done.
    415.                */
    416.               t.data = OPENSSL_zalloc(t.length + 1);
                                ^
    417.               if (t.data == NULL)
    418.                   goto out;

crypto/mem.c:228:1: Parameter `num`
      226.   }
      227.   
      228. > void *CRYPTO_zalloc(size_t num, const char *file, int line)
      229.   {
      230.       void *ret = CRYPTO_malloc(num, file, line);

crypto/mem.c:230:17: Call
      228.   void *CRYPTO_zalloc(size_t num, const char *file, int line)
      229.   {
      230.       void *ret = CRYPTO_malloc(num, file, line);
                             ^
      231.   
      232.       FAILTEST();

crypto/mem.c:201:9: Assignment
        199.   
        200.       if (num == 0)
        201.           return NULL;
                       ^
        202.   
        203.       FAILTEST();

crypto/mem.c:230:5: Assignment
      228.   void *CRYPTO_zalloc(size_t num, const char *file, int line)
      229.   {
      230.       void *ret = CRYPTO_malloc(num, file, line);
                 ^
      231.   
      232.       FAILTEST();

crypto/mem.c:235:5: Assignment
      233.       if (ret != NULL)
      234.           memset(ret, 0, num);
      235.       return ret;
                 ^
      236.   }
      237.   

crypto/asn1/a_time.c:416:13: Assignment
    414.                * new t.data would be freed after ASN1_STRING_copy is done.
    415.                */
    416.               t.data = OPENSSL_zalloc(t.length + 1);
                       ^
    417.               if (t.data == NULL)
    418.                   goto out;

crypto/asn1/a_time.c:419:13: Array access: Offset added: [-2, +oo] Size: [1, +oo] by call to `set_cert_times` 
    417.               if (t.data == NULL)
    418.                   goto out;
    419.               memcpy(t.data, str + 2, t.length);
                       ^
    420.               t.type = V_ASN1_UTCTIME;
    421.           }
