apps/rsa.c:328: error: BUFFER_OVERRUN_L3
  Offset added: [15, +oo] (⇐ [4, +oo] + 11) Size: [0, +oo] by call to `i2d_Netscape_RSA`.
Showing all 22 steps of the trace


apps/rsa.c:321:8: Call
319.   
320.   		i=1;
321.   		size=i2d_Netscape_RSA(rsa,NULL,NULL);
              ^
322.   		if ((p=(unsigned char *)Malloc(size)) == NULL)
323.   			{

crypto/asn1/n_pkey.c:92:2: Assignment
  90.   	X509_ALGOR *alg=NULL;
  91.   	ASN1_OCTET_STRING os,os2;
  92.   	M_ASN1_I2D_vars(a);
         ^
  93.   
  94.   	if (a == NULL) return(0);

apps/rsa.c:321:3: Assignment
319.   
320.   		i=1;
321.   		size=i2d_Netscape_RSA(rsa,NULL,NULL);
         ^
322.   		if ((p=(unsigned char *)Malloc(size)) == NULL)
323.   			{

apps/rsa.c:322:27: Array declaration
320.   		i=1;
321.   		size=i2d_Netscape_RSA(rsa,NULL,NULL);
322.   		if ((p=(unsigned char *)Malloc(size)) == NULL)
                                 ^
323.   			{
324.   			BIO_printf(bio_err,"Malloc failure\n");

apps/rsa.c:322:8: Assignment
320.   		i=1;
321.   		size=i2d_Netscape_RSA(rsa,NULL,NULL);
322.   		if ((p=(unsigned char *)Malloc(size)) == NULL)
              ^
323.   			{
324.   			BIO_printf(bio_err,"Malloc failure\n");

apps/rsa.c:328:3: Call
326.   			}
327.   		pp=p;
328.   		i2d_Netscape_RSA(rsa,&p,NULL);
         ^
329.   		BIO_write(out,(char *)pp,size);
330.   		Free(pp);

crypto/asn1/n_pkey.c:129:2: Assignment
  127.   	os.data=(unsigned char *)"private-key";
  128.   #endif
  129.   	os.length=11;
          ^
  130.   	l[4]=i2d_ASN1_OCTET_STRING(&os,NULL);
  131.   

crypto/asn1/n_pkey.c:179:2: Call
  177.   	p= *pp;
  178.   	ASN1_put_object(&p,1,l[4]+l[3],V_ASN1_SEQUENCE,V_ASN1_UNIVERSAL);
  179.   	i2d_ASN1_OCTET_STRING(&os,&p);
          ^
  180.   	ASN1_put_object(&p,1,l[2]+l[1],V_ASN1_SEQUENCE,V_ASN1_UNIVERSAL);
  181.   	i2d_X509_ALGOR(alg,&p);

crypto/asn1/a_octet.c:78:1: Parameter `**pp`
    76.   { return M_ASN1_OCTET_STRING_set(x, d, len); }
    77.   
    78. > int i2d_ASN1_OCTET_STRING(ASN1_OCTET_STRING *a, unsigned char **pp)
    79.   { return M_i2d_ASN1_OCTET_STRING(a, pp); }
    80.   

crypto/asn1/a_octet.c:79:10: Call
    77.   
    78.   int i2d_ASN1_OCTET_STRING(ASN1_OCTET_STRING *a, unsigned char **pp)
    79.   { return M_i2d_ASN1_OCTET_STRING(a, pp); }
                   ^
    80.   
    81.   ASN1_OCTET_STRING *d2i_ASN1_OCTET_STRING(ASN1_OCTET_STRING **a,

crypto/asn1/a_bytes.c:141:1: <Offset trace>
139.   	}
140.   
141. > int i2d_ASN1_bytes(ASN1_STRING *a, unsigned char **pp, int tag, int xclass)
142.   	{
143.   	int ret,r,constructed;

crypto/asn1/a_bytes.c:141:1: Parameter `a->length`
      139.   	}
      140.   
      141. > int i2d_ASN1_bytes(ASN1_STRING *a, unsigned char **pp, int tag, int xclass)
      142.   	{
      143.   	int ret,r,constructed;

crypto/asn1/a_bytes.c:141:1: <Length trace>
139.   	}
140.   
141. > int i2d_ASN1_bytes(ASN1_STRING *a, unsigned char **pp, int tag, int xclass)
142.   	{
143.   	int ret,r,constructed;

crypto/asn1/a_bytes.c:141:1: Parameter `**pp`
      139.   	}
      140.   
      141. > int i2d_ASN1_bytes(ASN1_STRING *a, unsigned char **pp, int tag, int xclass)
      142.   	{
      143.   	int ret,r,constructed;

crypto/asn1/a_bytes.c:154:2: Assignment
      152.   	r=ASN1_object_size(0,ret,tag);
      153.   	if (pp == NULL) return(r);
      154.   	p= *pp;
              ^
      155.   
      156.   	if ((tag == V_ASN1_SEQUENCE) || (tag == V_ASN1_SET))

crypto/asn1/a_bytes.c:160:2: Call
      158.   	else
      159.   		constructed=0;
      160.   	ASN1_put_object(&p,constructed,ret,tag,xclass);
              ^
      161.   	memcpy(p,a->data,a->length);
      162.   	p+=a->length;

crypto/asn1/asn1_lib.c:180:1: Parameter `**pp`
        178.   /* class 0 is constructed
        179.    * constructed == 2 for indefinitle length constructed */
        180. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
        181.   	     int xclass)
        182.   	{

crypto/asn1/asn1_lib.c:183:2: Assignment
        181.   	     int xclass)
        182.   	{
        183.   	unsigned char *p= *pp;
                ^
        184.   	int i;
        185.   

crypto/asn1/asn1_lib.c:189:5: Assignment
        187.   	i|=(xclass&V_ASN1_PRIVATE);
        188.   	if (tag < 31)
        189.   		*(p++)=i|(tag&V_ASN1_PRIMITIVE_TAG);
                   ^
        190.   	else
        191.   		{

crypto/asn1/asn1_lib.c:201:5: Assignment
        199.   		}
        200.   	if ((constructed == 2) && (length == 0))
        201.   		*(p++)=0x80; /* der_put_length would output 0 instead */
                   ^
        202.   	else
        203.   		asn1_put_length(&p,length);

crypto/asn1/asn1_lib.c:204:2: Assignment
        202.   	else
        203.   		asn1_put_length(&p,length);
        204.   	*pp=p;
                ^
        205.   	}
        206.   

crypto/asn1/a_bytes.c:161:2: Array access: Offset added: [15, +oo] (⇐ [4, +oo] + 11) Size: [0, +oo] by call to `i2d_Netscape_RSA` 
      159.   		constructed=0;
      160.   	ASN1_put_object(&p,constructed,ret,tag,xclass);
      161.   	memcpy(p,a->data,a->length);
              ^
      162.   	p+=a->length;
      163.   	*pp= p;
