crypto/x509v3/v3_scts.c:193: error: BUFFER_OVERRUN_L3
  Offset added: [5, +oo] (⇐ [4, +oo] + [1, +oo]) Size: [1, +oo].
Showing all 17 steps of the trace


crypto/x509v3/v3_scts.c:160:9: <Offset trace>
158.       const unsigned char *q = *pp;
159.   
160.       if (d2i_ASN1_OCTET_STRING(&oct, &q, length) == NULL)
               ^
161.           return NULL;
162.       if (oct->length < 2)

crypto/x509v3/v3_scts.c:160:9: Call
158.       const unsigned char *q = *pp;
159.   
160.       if (d2i_ASN1_OCTET_STRING(&oct, &q, length) == NULL)
               ^
161.           return NULL;
162.       if (oct->length < 2)

crypto/asn1/tasn_typ.c:77:1: Call
  75.   }
  76.   
  77. > IMPLEMENT_ASN1_STRING_FUNCTIONS(ASN1_OCTET_STRING)
  78.   IMPLEMENT_ASN1_STRING_FUNCTIONS(ASN1_INTEGER)
  79.   IMPLEMENT_ASN1_STRING_FUNCTIONS(ASN1_ENUMERATED)

crypto/asn1/tasn_dec.c:153:9: Call
    151.           pval = &ptmpval;
    152.       asn1_tlc_clear_nc(&c);
    153.       if (ASN1_item_ex_d2i(pval, in, len, it, -1, 0, 0, &c) > 0)
                   ^
    154.           return *pval;
    155.       return NULL;

crypto/asn1/tasn_dec.c:163:10: Call
      161.   {
      162.       int rv;
      163.       rv = asn1_item_embed_d2i(pval, in, len, it, tag, aclass, opt, ctx);
                      ^
      164.       if (rv <= 0)
      165.           ASN1_item_ex_free(pval, it);

crypto/asn1/tasn_dec.c:174:1: Parameter `**pval`
        172.    */
        173.   
        174. > static int asn1_item_embed_d2i(ASN1_VALUE **pval, const unsigned char **in,
        175.                                  long len, const ASN1_ITEM *it,
        176.                                  int tag, int aclass, char opt, ASN1_TLC *ctx)

crypto/x509v3/v3_scts.c:175:9: Assignment
173.           if (listlen < 2)
174.               goto err;
175.           n2s(p, sctlen);
               ^
176.           listlen -= 2;
177.   

crypto/x509v3/v3_scts.c:160:9: <Length trace>
158.       const unsigned char *q = *pp;
159.   
160.       if (d2i_ASN1_OCTET_STRING(&oct, &q, length) == NULL)
               ^
161.           return NULL;
162.       if (oct->length < 2)

crypto/x509v3/v3_scts.c:160:9: Call
158.       const unsigned char *q = *pp;
159.   
160.       if (d2i_ASN1_OCTET_STRING(&oct, &q, length) == NULL)
               ^
161.           return NULL;
162.       if (oct->length < 2)

crypto/asn1/tasn_typ.c:77:1: Call
  75.   }
  76.   
  77. > IMPLEMENT_ASN1_STRING_FUNCTIONS(ASN1_OCTET_STRING)
  78.   IMPLEMENT_ASN1_STRING_FUNCTIONS(ASN1_INTEGER)
  79.   IMPLEMENT_ASN1_STRING_FUNCTIONS(ASN1_ENUMERATED)

crypto/asn1/tasn_dec.c:153:9: Call
    151.           pval = &ptmpval;
    152.       asn1_tlc_clear_nc(&c);
    153.       if (ASN1_item_ex_d2i(pval, in, len, it, -1, 0, 0, &c) > 0)
                   ^
    154.           return *pval;
    155.       return NULL;

crypto/asn1/tasn_dec.c:163:10: Call
      161.   {
      162.       int rv;
      163.       rv = asn1_item_embed_d2i(pval, in, len, it, tag, aclass, opt, ctx);
                      ^
      164.       if (rv <= 0)
      165.           ASN1_item_ex_free(pval, it);

crypto/asn1/tasn_dec.c:174:1: Parameter `**pval`
        172.    */
        173.   
        174. > static int asn1_item_embed_d2i(ASN1_VALUE **pval, const unsigned char **in,
        175.                                  long len, const ASN1_ITEM *it,
        176.                                  int tag, int aclass, char opt, ASN1_TLC *ctx)

crypto/x509v3/v3_scts.c:175:9: Assignment
173.           if (listlen < 2)
174.               goto err;
175.           n2s(p, sctlen);
               ^
176.           listlen -= 2;
177.   

crypto/x509v3/v3_scts.c:195:9: Assignment
193.           memcpy(sct->sct, p, sctlen);
194.           sct->sct_len = sctlen;
195.           p += sctlen;
               ^
196.           p2 = sct->sct;
197.   

crypto/x509v3/v3_scts.c:175:9: Assignment
173.           if (listlen < 2)
174.               goto err;
175.           n2s(p, sctlen);
               ^
176.           listlen -= 2;
177.   

crypto/x509v3/v3_scts.c:193:9: Array access: Offset added: [5, +oo] (⇐ [4, +oo] + [1, +oo]) Size: [1, +oo]
191.           if (sct->sct == NULL)
192.               goto err;
193.           memcpy(sct->sct, p, sctlen);
               ^
194.           sct->sct_len = sctlen;
195.           p += sctlen;
