crypto/asn1/bio_ndef.c:168: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] (⇐ [2, +oo] + [0, +oo]) Size: [1, +oo] by call to `ASN1_item_ndef_i2d`.
Showing all 29 steps of the trace


crypto/asn1/bio_ndef.c:161:14: Call
159.       ndef_aux = *(NDEF_SUPPORT **)parg;
160.   
161.       derlen = ASN1_item_ndef_i2d(ndef_aux->val, NULL, ndef_aux->it);
                    ^
162.       p = OPENSSL_malloc(derlen);
163.       if (p == NULL)

crypto/asn1/tasn_enc.c:89:12: Call
  87.                          const ASN1_ITEM *it)
  88.   {
  89.       return asn1_item_flags_i2d(val, out, it, ASN1_TFLG_NDEF);
                   ^
  90.   }
  91.   

crypto/asn1/tasn_enc.c:115:13: Assignment
    113.           buf = OPENSSL_malloc(len);
    114.           if (buf == NULL)
    115.               return -1;
                       ^
    116.           p = buf;
    117.           ASN1_item_ex_i2d(&val, &p, it, -1, flags);

crypto/asn1/tasn_enc.c:89:5: Assignment
  87.                          const ASN1_ITEM *it)
  88.   {
  89.       return asn1_item_flags_i2d(val, out, it, ASN1_TFLG_NDEF);
            ^
  90.   }
  91.   

crypto/asn1/bio_ndef.c:161:5: Assignment
159.       ndef_aux = *(NDEF_SUPPORT **)parg;
160.   
161.       derlen = ASN1_item_ndef_i2d(ndef_aux->val, NULL, ndef_aux->it);
           ^
162.       p = OPENSSL_malloc(derlen);
163.       if (p == NULL)

crypto/asn1/bio_ndef.c:162:9: Call
160.   
161.       derlen = ASN1_item_ndef_i2d(ndef_aux->val, NULL, ndef_aux->it);
162.       p = OPENSSL_malloc(derlen);
               ^
163.       if (p == NULL)
164.           return 0;

crypto/mem.c:125:9: Assignment
  123.   
  124.       if (num <= 0)
  125.           return NULL;
                 ^
  126.   
  127.       allow_customize = 0;

crypto/asn1/bio_ndef.c:162:5: Assignment
160.   
161.       derlen = ASN1_item_ndef_i2d(ndef_aux->val, NULL, ndef_aux->it);
162.       p = OPENSSL_malloc(derlen);
           ^
163.       if (p == NULL)
164.           return 0;

crypto/asn1/bio_ndef.c:168:14: Call
166.       ndef_aux->derbuf = p;
167.       *pbuf = p;
168.       derlen = ASN1_item_ndef_i2d(ndef_aux->val, &p, ndef_aux->it);
                    ^
169.   
170.       if (!*ndef_aux->boundary)

crypto/asn1/tasn_enc.c:86:1: Parameter `**out`
  84.    */
  85.   
  86. > int ASN1_item_ndef_i2d(ASN1_VALUE *val, unsigned char **out,
  87.                          const ASN1_ITEM *it)
  88.   {

crypto/asn1/tasn_enc.c:89:12: Call
  87.                          const ASN1_ITEM *it)
  88.   {
  89.       return asn1_item_flags_i2d(val, out, it, ASN1_TFLG_NDEF);
                   ^
  90.   }
  91.   

crypto/asn1/tasn_enc.c:104:1: Parameter `**out`
    102.    */
    103.   
    104. > static int asn1_item_flags_i2d(ASN1_VALUE *val, unsigned char **out,
    105.                                  const ASN1_ITEM *it, int flags)
    106.   {

crypto/asn1/tasn_enc.c:122:12: Call
    120.       }
    121.   
    122.       return ASN1_item_ex_i2d(&val, out, it, -1, flags);
                      ^
    123.   }
    124.   

crypto/asn1/tasn_enc.c:130:1: Parameter `**out`
      128.    */
      129.   
      130. > int ASN1_item_ex_i2d(ASN1_VALUE **pval, unsigned char **out,
      131.                        const ASN1_ITEM *it, int tag, int aclass)
      132.   {

crypto/asn1/tasn_enc.c:154:16: Call
      152.   
      153.       case ASN1_ITYPE_MSTRING:
      154.           return asn1_i2d_ex_primitive(pval, out, it, -1, aclass);
                            ^
      155.   
      156.       case ASN1_ITYPE_CHOICE:

crypto/asn1/tasn_enc.c:472:1: Parameter `**out`
        470.   }
        471.   
        472. > static int asn1_i2d_ex_primitive(ASN1_VALUE **pval, unsigned char **out,
        473.                                    const ASN1_ITEM *it, int tag, int aclass)
        474.   {

crypto/asn1/tasn_enc.c:517:13: Call
        515.       if (out) {
        516.           if (usetag)
        517.               ASN1_put_object(out, ndef, len, tag, aclass);
                           ^
        518.           asn1_ex_i2c(pval, *out, &utype, it);
        519.           if (ndef)

crypto/asn1/asn1_lib.c:196:1: Parameter `**pp`
          194.    * class 0 is constructed constructed == 2 for indefinite length constructed
          195.    */
          196. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
          197.                        int xclass)
          198.   {

crypto/asn1/asn1_lib.c:199:5: Assignment
          197.                        int xclass)
          198.   {
          199.       unsigned char *p = *pp;
                     ^
          200.       int i, ttag;
          201.   

crypto/asn1/asn1_lib.c:205:11: Assignment
          203.       i |= (xclass & V_ASN1_PRIVATE);
          204.       if (tag < 31)
          205.           *(p++) = i | (tag & V_ASN1_PRIMITIVE_TAG);
                           ^
          206.       else {
          207.           *(p++) = i | V_ASN1_PRIMITIVE_TAG;

crypto/asn1/asn1_lib.c:222:9: Call
          220.           *(p++) = 0x80;
          221.       else
          222.           asn1_put_length(&p, length);
                         ^
          223.       *pp = p;
          224.   }

crypto/asn1/asn1_lib.c:243:14: <Offset trace>
241.       else {
242.           l = length;
243.           for (i = 0; l > 0; i++)
                    ^
244.               l >>= 8;
245.           *(p++) = i | 0x80;

crypto/asn1/asn1_lib.c:243:14: Assignment
            241.       else {
            242.           l = length;
            243.           for (i = 0; l > 0; i++)
                                ^
            244.               l >>= 8;
            245.           *(p++) = i | 0x80;

crypto/asn1/asn1_lib.c:247:16: Assignment
            245.           *(p++) = i | 0x80;
            246.           l = i;
            247.           while (i-- > 0) {
                                  ^
            248.               p[i] = length & 0xff;
            249.               length >>= 8;

crypto/asn1/asn1_lib.c:235:1: <Length trace>
233.   }
234.   
235. > static void asn1_put_length(unsigned char **pp, int length)
236.   {
237.       unsigned char *p = *pp;

crypto/asn1/asn1_lib.c:235:1: Parameter `**pp`
            233.   }
            234.   
            235. > static void asn1_put_length(unsigned char **pp, int length)
            236.   {
            237.       unsigned char *p = *pp;

crypto/asn1/asn1_lib.c:237:5: Assignment
            235.   static void asn1_put_length(unsigned char **pp, int length)
            236.   {
            237.       unsigned char *p = *pp;
                       ^
            238.       int i, l;
            239.       if (length <= 127)

crypto/asn1/asn1_lib.c:245:11: Assignment
            243.           for (i = 0; l > 0; i++)
            244.               l >>= 8;
            245.           *(p++) = i | 0x80;
                             ^
            246.           l = i;
            247.           while (i-- > 0) {

crypto/asn1/asn1_lib.c:248:13: Array access: Offset: [2, +oo] (⇐ [2, +oo] + [0, +oo]) Size: [1, +oo] by call to `ASN1_item_ndef_i2d` 
            246.           l = i;
            247.           while (i-- > 0) {
            248.               p[i] = length & 0xff;
                               ^
            249.               length >>= 8;
            250.           }
