crypto/pkcs12/p12_crt.c:152: error: BUFFER_OVERRUN_L3
  Offset: [0, 1] Size: [0, +oo] by call to `sk_pop_free`.
Showing all 18 steps of the trace


crypto/pkcs12/p12_crt.c:136:14: Call
134.           if (name && !PKCS12_add_friendlyname (bag, name, -1)) return NULL;
135.   	if(!PKCS12_add_localkeyid (bag, keyid, keyidlen)) return NULL;
136.   	if(!(bags = sk_new(NULL)) || !sk_push (bags, (char *)bag)) {
                    ^
137.   		PKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE);
138.   		return NULL;

crypto/stack/stack.c:125:2: Assignment
  123.   	ret->comp=c;
  124.   	ret->num_alloc=MIN_NODES;
  125.   	ret->num=0;
          ^
  126.   	ret->sorted=0;
  127.   	return(ret);

crypto/pkcs12/p12_crt.c:136:32: Call
134.           if (name && !PKCS12_add_friendlyname (bag, name, -1)) return NULL;
135.   	if(!PKCS12_add_localkeyid (bag, keyid, keyidlen)) return NULL;
136.   	if(!(bags = sk_new(NULL)) || !sk_push (bags, (char *)bag)) {
                                      ^
137.   		PKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE);
138.   		return NULL;

crypto/stack/stack.c:237:1: Parameter `st->num`
  235.   	}
  236.   
  237. > int sk_push(STACK *st, char *data)
  238.   	{
  239.   	return(sk_insert(st,data,st->num));

crypto/stack/stack.c:239:9: Call
  237.   int sk_push(STACK *st, char *data)
  238.   	{
  239.   	return(sk_insert(st,data,st->num));
                 ^
  240.   	}
  241.   

crypto/stack/stack.c:134:1: Parameter `st->num`
    132.   	}
    133.   
    134. > int sk_insert(STACK *st, char *data, int loc)
    135.   	{
    136.   	char **s;

crypto/pkcs12/p12_crt.c:142:2: Call
140.   	/* Turn it into unencrypted safe bag */
141.   	if(!(authsafe = PKCS12_pack_p7data (bags))) return NULL;
142.   	sk_pop_free(bags, PKCS12_SAFEBAG_free);
        ^
143.   	if(!sk_push(safes, (char *)authsafe)) {
144.   		PKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE);

crypto/stack/stack.c:269:1: Parameter `st->num`
  267.   	}
  268.   
  269. > void sk_pop_free(STACK *st, void (*func)())
  270.   	{
  271.   	int i;

crypto/pkcs12/p12_crt.c:143:6: Call
141.   	if(!(authsafe = PKCS12_pack_p7data (bags))) return NULL;
142.   	sk_pop_free(bags, PKCS12_SAFEBAG_free);
143.   	if(!sk_push(safes, (char *)authsafe)) {
            ^
144.   		PKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE);
145.   		return NULL;

crypto/stack/stack.c:237:1: Parameter `st->num`
  235.   	}
  236.   
  237. > int sk_push(STACK *st, char *data)
  238.   	{
  239.   	return(sk_insert(st,data,st->num));

crypto/stack/stack.c:239:9: Call
  237.   int sk_push(STACK *st, char *data)
  238.   	{
  239.   	return(sk_insert(st,data,st->num));
                 ^
  240.   	}
  241.   

crypto/stack/stack.c:134:1: Parameter `st->num`
    132.   	}
    133.   
    134. > int sk_insert(STACK *st, char *data, int loc)
    135.   	{
    136.   	char **s;

crypto/pkcs12/p12_crt.c:152:2: Call
150.   	if(!M_PKCS12_pack_authsafes (p12, safes)) return NULL;
151.   
152.   	sk_pop_free(safes, PKCS7_free);
        ^
153.   
154.   	if(!PKCS12_set_mac (p12, pass, -1, NULL, 0, mac_iter, NULL))

crypto/stack/stack.c:269:1: <Offset trace>
267.   	}
268.   
269. > void sk_pop_free(STACK *st, void (*func)())
270.   	{
271.   	int i;

crypto/stack/stack.c:269:1: Parameter `st->num`
  267.   	}
  268.   
  269. > void sk_pop_free(STACK *st, void (*func)())
  270.   	{
  271.   	int i;

crypto/stack/stack.c:269:1: <Length trace>
267.   	}
268.   
269. > void sk_pop_free(STACK *st, void (*func)())
270.   	{
271.   	int i;

crypto/stack/stack.c:269:1: Parameter `*st->data`
  267.   	}
  268.   
  269. > void sk_pop_free(STACK *st, void (*func)())
  270.   	{
  271.   	int i;

crypto/stack/stack.c:275:7: Array access: Offset: [0, 1] Size: [0, +oo] by call to `sk_pop_free` 
  273.   	if (st == NULL) return;
  274.   	for (i=0; i<st->num; i++)
  275.   		if (st->data[i] != NULL)
               ^
  276.   			func(st->data[i]);
  277.   	sk_free(st);
