crypto/pkcs12/p12_decr.c:156: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] Size: [1, +oo] by call to `ASN1_item_d2i`.
Showing all 23 steps of the trace


crypto/pkcs12/p12_decr.c:137:10: Call
135.       int outlen;
136.   
137.       if (!PKCS12_pbe_crypt(algor, pass, passlen, oct->data, oct->length,
                ^
138.                             &out, &outlen, 0)) {
139.           PKCS12err(PKCS12_F_PKCS12_ITEM_DECRYPT_D2I,

crypto/pkcs12/p12_decr.c:74:1: Parameter `**data`
  72.    */
  73.   
  74. > unsigned char *PKCS12_pbe_crypt(X509_ALGOR *algor, const char *pass,
  75.                                   int passlen, unsigned char *in, int inlen,
  76.                                   unsigned char **data, int *datalen, int en_de)

crypto/pkcs12/p12_decr.c:143:5: Assignment
141.           return NULL;
142.       }
143.       p = out;
           ^
144.   #ifdef DEBUG_DECRYPT
145.       {

crypto/pkcs12/p12_decr.c:156:11: Call
154.       }
155.   #endif
156.       ret = ASN1_item_d2i(NULL, &p, outlen, it);
                 ^
157.       if (zbuf)
158.           OPENSSL_cleanse(out, outlen);

crypto/asn1/tasn_dec.c:144:1: Parameter `**in`
  142.    */
  143.   
  144. > ASN1_VALUE *ASN1_item_d2i(ASN1_VALUE **pval,
  145.                             const unsigned char **in, long len,
  146.                             const ASN1_ITEM *it)

crypto/asn1/tasn_dec.c:153:9: Call
  151.           pval = &ptmpval;
  152.       asn1_tlc_clear_nc(&c);
  153.       if (ASN1_item_ex_d2i(pval, in, len, it, -1, 0, 0, &c) > 0)
                 ^
  154.           return *pval;
  155.       return NULL;

crypto/asn1/tasn_dec.c:158:1: Parameter `**in`
    156.   }
    157.   
    158. > int ASN1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in, long len,
    159.                        const ASN1_ITEM *it,
    160.                        int tag, int aclass, char opt, ASN1_TLC *ctx)

crypto/asn1/tasn_dec.c:163:10: Call
    161.   {
    162.       int rv;
    163.       rv = asn1_item_embed_d2i(pval, in, len, it, tag, aclass, opt, ctx);
                    ^
    164.       if (rv <= 0)
    165.           ASN1_item_ex_free(pval, it);

crypto/asn1/tasn_dec.c:174:1: Parameter `**in`
      172.    */
      173.   
      174. > static int asn1_item_embed_d2i(ASN1_VALUE **pval, const unsigned char **in,
      175.                                  long len, const ASN1_ITEM *it,
      176.                                  int tag, int aclass, char opt, ASN1_TLC *ctx)

crypto/asn1/tasn_dec.c:218:9: Assignment
      216.   
      217.       case ASN1_ITYPE_MSTRING:
      218.           p = *in;
                     ^
      219.           /* Just read in tag and class */
      220.           ret = asn1_check_tlen(NULL, &otag, &oclass, NULL, NULL,

crypto/asn1/tasn_dec.c:220:15: Call
      218.           p = *in;
      219.           /* Just read in tag and class */
      220.           ret = asn1_check_tlen(NULL, &otag, &oclass, NULL, NULL,
                           ^
      221.                                 &p, len, -1, 0, 1, ctx);
      222.           if (!ret) {

crypto/asn1/tasn_dec.c:1098:1: Parameter `**in`
        1096.    */
        1097.   
        1098. > static int asn1_check_tlen(long *olen, int *otag, unsigned char *oclass,
        1099.                              char *inf, char *cst,
        1100.                              const unsigned char **in, long len,

crypto/asn1/tasn_dec.c:1107:5: Assignment
        1105.       long plen;
        1106.       const unsigned char *p, *q;
        1107.       p = *in;
                    ^
        1108.       q = p;
        1109.   

crypto/asn1/tasn_dec.c:1117:13: Call
        1115.           p += ctx->hdrlen;
        1116.       } else {
        1117.           i = ASN1_get_object(&p, &plen, &ptag, &pclass, len);
                            ^
        1118.           if (ctx) {
        1119.               ctx->ret = i;

crypto/asn1/asn1_lib.c:92:1: Parameter `**pp`
          90.   }
          91.   
          92. > int ASN1_get_object(const unsigned char **pp, long *plength, int *ptag,
          93.                       int *pclass, long omax)
          94.   {

crypto/asn1/asn1_lib.c:97:5: Assignment
          95.       int i, ret;
          96.       long l;
          97.       const unsigned char *p = *pp;
                     ^
          98.       int tag, xclass, inf;
          99.       long max = omax;

crypto/asn1/asn1_lib.c:126:9: Assignment
          124.       } else {
          125.           tag = i;
          126.           p++;
                         ^
          127.           if (--max == 0)
          128.               goto err;

crypto/asn1/asn1_lib.c:132:10: Call
          130.       *ptag = tag;
          131.       *pclass = xclass;
          132.       if (!asn1_get_length(&p, &inf, plength, (int)max))
                          ^
          133.           goto err;
          134.   

crypto/asn1/asn1_lib.c:153:1: <Length trace>
151.   }
152.   
153. > static int asn1_get_length(const unsigned char **pp, int *inf, long *rl,
154.                              int max)
155.   {

crypto/asn1/asn1_lib.c:153:1: Parameter `**pp`
            151.   }
            152.   
            153. > static int asn1_get_length(const unsigned char **pp, int *inf, long *rl,
            154.                              int max)
            155.   {

crypto/asn1/asn1_lib.c:156:5: Assignment
            154.                              int max)
            155.   {
            156.       const unsigned char *p = *pp;
                       ^
            157.       unsigned long ret = 0;
            158.       unsigned int i;

crypto/asn1/asn1_lib.c:169:15: Assignment
            167.           *inf = 0;
            168.           i = *p & 0x7f;
            169.           if (*(p++) & 0x80) {
                                 ^
            170.               if (max < (int)i)
            171.                   return 0;

crypto/asn1/asn1_lib.c:173:25: Array access: Offset: [2, +oo] Size: [1, +oo] by call to `ASN1_item_d2i` 
            171.                   return 0;
            172.               /* Skip leading zeroes */
            173.               while (i && *p == 0) {
                                           ^
            174.                   p++;
            175.                   i--;
