crypto/pkcs7/pk7_doit.c:738: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, +oo] by call to `i2d_ASN1_SET`.
Showing all 15 steps of the trace


crypto/pkcs7/pk7_doit.c:734:5: Call
732.   		 * This is done by using the IS_SEQUENCE flag.
733.   		 */
734.   		i=i2d_ASN1_SET(sk,NULL,i2d_X509_ATTRIBUTE,
           ^
735.   			V_ASN1_SET,V_ASN1_UNIVERSAL, IS_SEQUENCE);
736.   		pp=(unsigned char *)Malloc(i);

crypto/asn1/a_set.c:96:17: Assignment
  94.           int totSize;
  95.   
  96.   	if (a == NULL) return(0);
                        ^
  97.   	for (i=sk_num(a)-1; i>=0; i--)
  98.   		ret+=func(sk_value(a,i),NULL);

crypto/pkcs7/pk7_doit.c:734:3: Assignment
732.   		 * This is done by using the IS_SEQUENCE flag.
733.   		 */
734.   		i=i2d_ASN1_SET(sk,NULL,i2d_X509_ATTRIBUTE,
         ^
735.   			V_ASN1_SET,V_ASN1_UNIVERSAL, IS_SEQUENCE);
736.   		pp=(unsigned char *)Malloc(i);

crypto/pkcs7/pk7_doit.c:736:23: Array declaration
734.   		i=i2d_ASN1_SET(sk,NULL,i2d_X509_ATTRIBUTE,
735.   			V_ASN1_SET,V_ASN1_UNIVERSAL, IS_SEQUENCE);
736.   		pp=(unsigned char *)Malloc(i);
                             ^
737.   		p=pp;
738.   		i2d_ASN1_SET(sk,&p,i2d_X509_ATTRIBUTE,

crypto/pkcs7/pk7_doit.c:736:3: Assignment
734.   		i=i2d_ASN1_SET(sk,NULL,i2d_X509_ATTRIBUTE,
735.   			V_ASN1_SET,V_ASN1_UNIVERSAL, IS_SEQUENCE);
736.   		pp=(unsigned char *)Malloc(i);
         ^
737.   		p=pp;
738.   		i2d_ASN1_SET(sk,&p,i2d_X509_ATTRIBUTE,

crypto/pkcs7/pk7_doit.c:737:3: Assignment
735.   			V_ASN1_SET,V_ASN1_UNIVERSAL, IS_SEQUENCE);
736.   		pp=(unsigned char *)Malloc(i);
737.   		p=pp;
         ^
738.   		i2d_ASN1_SET(sk,&p,i2d_X509_ATTRIBUTE,
739.   			V_ASN1_SET,V_ASN1_UNIVERSAL, IS_SEQUENCE);

crypto/pkcs7/pk7_doit.c:738:3: Call
736.   		pp=(unsigned char *)Malloc(i);
737.   		p=pp;
738.   		i2d_ASN1_SET(sk,&p,i2d_X509_ATTRIBUTE,
         ^
739.   			V_ASN1_SET,V_ASN1_UNIVERSAL, IS_SEQUENCE);
740.   		EVP_VerifyUpdate(&mdc_tmp,pp,i);

crypto/asn1/a_set.c:86:1: Parameter `**pp`
  84.   
  85.   /* int is_set:  if TRUE, then sort the contents (i.e. it isn't a SEQUENCE)    */
  86. > int i2d_ASN1_SET(STACK *a, unsigned char **pp, int (*func)(), int ex_tag,
  87.   	     int ex_class, int is_set)
  88.   	{

crypto/asn1/a_set.c:102:2: Assignment
  100.   	if (pp == NULL) return(r);
  101.   
  102.   	p= *pp;
          ^
  103.   	ASN1_put_object(&p,1,ret,ex_tag,ex_class);
  104.   

crypto/asn1/a_set.c:103:2: Call
  101.   
  102.   	p= *pp;
  103.   	ASN1_put_object(&p,1,ret,ex_tag,ex_class);
          ^
  104.   
  105.   /* Modified by gp@nsj.co.jp */

crypto/asn1/asn1_lib.c:180:1: <Length trace>
178.   /* class 0 is constructed
179.    * constructed == 2 for indefinitle length constructed */
180. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
181.   	     int xclass)
182.   	{

crypto/asn1/asn1_lib.c:180:1: Parameter `**pp`
    178.   /* class 0 is constructed
    179.    * constructed == 2 for indefinitle length constructed */
    180. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
    181.   	     int xclass)
    182.   	{

crypto/asn1/asn1_lib.c:183:2: Assignment
    181.   	     int xclass)
    182.   	{
    183.   	unsigned char *p= *pp;
            ^
    184.   	int i;
    185.   

crypto/asn1/asn1_lib.c:192:5: Assignment
    190.   	else
    191.   		{
    192.   		*(p++)=i|V_ASN1_PRIMITIVE_TAG;
               ^
    193.   		while (tag > 0x7f)
    194.   			{

crypto/asn1/asn1_lib.c:198:3: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `i2d_ASN1_SET` 
    196.   			tag>>=7;
    197.   			}
    198.   		*(p++)=(tag&0x7f);
             ^
    199.   		}
    200.   	if ((constructed == 2) && (length == 0))
