crypto/cms/cms_env.c:910: error: BUFFER_OVERRUN_L3
  Offset: 6 Size: [1, +oo] by call to `CMS_RecipientInfo_encrypt`.
Showing all 13 steps of the trace


crypto/cms/cms_env.c:910:13: Call
908.       for (i = 0; i < sk_CMS_RecipientInfo_num(rinfos); i++) {
909.           ri = sk_CMS_RecipientInfo_value(rinfos, i);
910.           if (CMS_RecipientInfo_encrypt(cms, ri) <= 0) {
                   ^
911.               CMSerr(CMS_F_CMS_ENVELOPEDDATA_INIT_BIO,
912.                      CMS_R_ERROR_SETTING_RECIPIENTINFO);

crypto/cms/cms_env.c:801:1: Parameter `ri->d.pwri->encryptedKey->length`
  799.   }
  800.   
  801. > int CMS_RecipientInfo_encrypt(CMS_ContentInfo *cms, CMS_RecipientInfo *ri)
  802.   {
  803.       switch (ri->type) {

crypto/cms/cms_env.c:910:13: Call
908.       for (i = 0; i < sk_CMS_RecipientInfo_num(rinfos); i++) {
909.           ri = sk_CMS_RecipientInfo_value(rinfos, i);
910.           if (CMS_RecipientInfo_encrypt(cms, ri) <= 0) {
                   ^
911.               CMSerr(CMS_F_CMS_ENVELOPEDDATA_INIT_BIO,
912.                      CMS_R_ERROR_SETTING_RECIPIENTINFO);

crypto/cms/cms_env.c:801:1: Parameter `ri->d.pwri->encryptedKey->length`
  799.   }
  800.   
  801. > int CMS_RecipientInfo_encrypt(CMS_ContentInfo *cms, CMS_RecipientInfo *ri)
  802.   {
  803.       switch (ri->type) {

crypto/cms/cms_env.c:814:16: Call
  812.   
  813.       case CMS_RECIPINFO_PASS:
  814.           return cms_RecipientInfo_pwri_crypt(cms, ri, 1);
                        ^
  815.   
  816.       default:

crypto/cms/cms_pwri.c:320:1: Parameter `ri->d.pwri->encryptedKey->length`
    318.   /* Encrypt/Decrypt content key in PWRI recipient info */
    319.   
    320. > int cms_RecipientInfo_pwri_crypt(CMS_ContentInfo *cms, CMS_RecipientInfo *ri,
    321.                                    int en_de)
    322.   {

crypto/cms/cms_pwri.c:409:14: Call
    407.               goto err;
    408.           }
    409.           if (!kek_unwrap_key(key, &keylen,
                        ^
    410.                               pwri->encryptedKey->data,
    411.                               pwri->encryptedKey->length, kekctx)) {

crypto/cms/cms_pwri.c:221:1: <Length trace>
219.    */
220.   
221. > static int kek_unwrap_key(unsigned char *out, size_t *outlen,
222.                             const unsigned char *in, size_t inlen,
223.                             EVP_CIPHER_CTX *ctx)

crypto/cms/cms_pwri.c:221:1: Parameter `inlen`
      219.    */
      220.   
      221. > static int kek_unwrap_key(unsigned char *out, size_t *outlen,
      222.                             const unsigned char *in, size_t inlen,
      223.                             EVP_CIPHER_CTX *ctx)

crypto/cms/cms_pwri.c:236:11: Call
      234.           return 0;
      235.       }
      236.       tmp = OPENSSL_malloc(inlen);
                       ^
      237.       if (tmp == NULL)
      238.           return 0;

crypto/mem.c:125:9: Assignment
        123.   
        124.       if (num <= 0)
        125.           return NULL;
                       ^
        126.   
        127.       allow_customize = 0;

crypto/cms/cms_pwri.c:236:5: Assignment
      234.           return 0;
      235.       }
      236.       tmp = OPENSSL_malloc(inlen);
                 ^
      237.       if (tmp == NULL)
      238.           return 0;

crypto/cms/cms_pwri.c:258:60: Array access: Offset: 6 Size: [1, +oo] by call to `CMS_RecipientInfo_encrypt` 
      256.           goto err;
      257.       /* Check check bytes */
      258.       if (((tmp[1] ^ tmp[4]) & (tmp[2] ^ tmp[5]) & (tmp[3] ^ tmp[6])) != 0xff) {
                                                                        ^
      259.           /* Check byte failure */
      260.           goto err;
