crypto/asn1/a_d2i_fp.c:117: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] Size: [1, 2147483644] by call to `ASN1_item_d2i`.
Showing all 24 steps of the trace


crypto/asn1/a_d2i_fp.c:112:11: Call
110.       int len;
111.   
112.       len = asn1_d2i_read_bio(in, &b);
                 ^
113.       if (len < 0)
114.           goto err;

crypto/asn1/a_d2i_fp.c:166:38: Call
  164.               want -= (len - off);
  165.   
  166.               if (len + want < len || !BUF_MEM_grow_clean(b, len + want)) {
                                              ^
  167.                   ASN1err(ASN1_F_ASN1_D2I_READ_BIO, ERR_R_MALLOC_FAILURE);
  168.                   goto err;

crypto/buffer/buffer.c:157:1: Parameter `*str->data`
    155.   }
    156.   
    157. > size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
    158.   {
    159.       char *ret;

crypto/asn1/a_d2i_fp.c:116:5: Assignment
114.           goto err;
115.   
116.       p = (const unsigned char *)b->data;
           ^
117.       ret = ASN1_item_d2i(x, &p, len, it);
118.    err:

crypto/asn1/a_d2i_fp.c:117:11: Call
115.   
116.       p = (const unsigned char *)b->data;
117.       ret = ASN1_item_d2i(x, &p, len, it);
                 ^
118.    err:
119.       BUF_MEM_free(b);

crypto/asn1/tasn_dec.c:143:1: Parameter `**in`
  141.    */
  142.   
  143. > ASN1_VALUE *ASN1_item_d2i(ASN1_VALUE **pval,
  144.                             const unsigned char **in, long len,
  145.                             const ASN1_ITEM *it)

crypto/asn1/tasn_dec.c:152:9: Call
  150.           pval = &ptmpval;
  151.       asn1_tlc_clear_nc(&c);
  152.       if (ASN1_item_ex_d2i(pval, in, len, it, -1, 0, 0, &c) > 0)
                 ^
  153.           return *pval;
  154.       return NULL;

crypto/asn1/tasn_dec.c:157:1: Parameter `**in`
    155.   }
    156.   
    157. > int ASN1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in, long len,
    158.                        const ASN1_ITEM *it,
    159.                        int tag, int aclass, char opt, ASN1_TLC *ctx)

crypto/asn1/tasn_dec.c:162:10: Call
    160.   {
    161.       int rv;
    162.       rv = asn1_item_embed_d2i(pval, in, len, it, tag, aclass, opt, ctx);
                    ^
    163.       if (rv <= 0)
    164.           ASN1_item_ex_free(pval, it);

crypto/asn1/tasn_dec.c:173:1: Parameter `**in`
      171.    */
      172.   
      173. > static int asn1_item_embed_d2i(ASN1_VALUE **pval, const unsigned char **in,
      174.                                  long len, const ASN1_ITEM *it,
      175.                                  int tag, int aclass, char opt, ASN1_TLC *ctx)

crypto/asn1/tasn_dec.c:217:9: Assignment
      215.   
      216.       case ASN1_ITYPE_MSTRING:
      217.           p = *in;
                     ^
      218.           /* Just read in tag and class */
      219.           ret = asn1_check_tlen(NULL, &otag, &oclass, NULL, NULL,

crypto/asn1/tasn_dec.c:219:15: Call
      217.           p = *in;
      218.           /* Just read in tag and class */
      219.           ret = asn1_check_tlen(NULL, &otag, &oclass, NULL, NULL,
                           ^
      220.                                 &p, len, -1, 0, 1, ctx);
      221.           if (!ret) {

crypto/asn1/tasn_dec.c:1096:1: Parameter `**in`
        1094.    */
        1095.   
        1096. > static int asn1_check_tlen(long *olen, int *otag, unsigned char *oclass,
        1097.                              char *inf, char *cst,
        1098.                              const unsigned char **in, long len,

crypto/asn1/tasn_dec.c:1105:5: Assignment
        1103.       long plen;
        1104.       const unsigned char *p, *q;
        1105.       p = *in;
                    ^
        1106.       q = p;
        1107.   

crypto/asn1/tasn_dec.c:1115:13: Call
        1113.           p += ctx->hdrlen;
        1114.       } else {
        1115.           i = ASN1_get_object(&p, &plen, &ptag, &pclass, len);
                            ^
        1116.           if (ctx) {
        1117.               ctx->ret = i;

crypto/asn1/asn1_lib.c:91:1: Parameter `**pp`
          89.   }
          90.   
          91. > int ASN1_get_object(const unsigned char **pp, long *plength, int *ptag,
          92.                       int *pclass, long omax)
          93.   {

crypto/asn1/asn1_lib.c:96:5: Assignment
          94.       int i, ret;
          95.       long l;
          96.       const unsigned char *p = *pp;
                    ^
          97.       int tag, xclass, inf;
          98.       long max = omax;

crypto/asn1/asn1_lib.c:125:9: Assignment
          123.       } else {
          124.           tag = i;
          125.           p++;
                         ^
          126.           if (--max == 0)
          127.               goto err;

crypto/asn1/asn1_lib.c:131:10: Call
          129.       *ptag = tag;
          130.       *pclass = xclass;
          131.       if (!asn1_get_length(&p, &inf, plength, max))
                          ^
          132.           goto err;
          133.   

crypto/asn1/asn1_lib.c:152:1: <Length trace>
150.   }
151.   
152. > static int asn1_get_length(const unsigned char **pp, int *inf, long *rl,
153.                              long max)
154.   {

crypto/asn1/asn1_lib.c:152:1: Parameter `**pp`
            150.   }
            151.   
            152. > static int asn1_get_length(const unsigned char **pp, int *inf, long *rl,
            153.                              long max)
            154.   {

crypto/asn1/asn1_lib.c:155:5: Assignment
            153.                              long max)
            154.   {
            155.       const unsigned char *p = *pp;
                       ^
            156.       unsigned long ret = 0;
            157.       unsigned long i;

crypto/asn1/asn1_lib.c:168:15: Assignment
            166.           *inf = 0;
            167.           i = *p & 0x7f;
            168.           if (*(p++) & 0x80) {
                                 ^
            169.               if (max < (long)i + 1)
            170.                   return 0;

crypto/asn1/asn1_lib.c:172:25: Array access: Offset: [2, +oo] Size: [1, 2147483644] by call to `ASN1_item_d2i` 
            170.                   return 0;
            171.               /* Skip leading zeroes */
            172.               while (i && *p == 0) {
                                           ^
            173.                   p++;
            174.                   i--;
