apps/ca.c:809: error: BUFFER_OVERRUN_L3
  Offset added: [-2, +oo] Size: [1, +oo] by call to `ASN1_TIME_set_string_X509`.
Showing all 22 steps of the trace


apps/ca.c:688:13: Call
686.       if (doupdatedb) {
687.           if (verbose)
688.               BIO_printf(bio_err, "Updating %s ...\n", dbfile);
                   ^
689.   
690.           i = do_updatedb(db);

crypto/bio/b_print.c:859:11: Call
  857.       va_start(args, format);
  858.   
  859.       ret = BIO_vprintf(bio, format, args);
                   ^
  860.   
  861.       va_end(args);

crypto/bio/b_print.c:878:10: Call
    876.   
    877.       dynbuf = NULL;
    878.       if (!_dopr(&hugebufp, &dynbuf, &hugebufsize, &retlen, &ignored, format,
                    ^
    879.                   args)) {
    880.           OPENSSL_free(dynbuf);

crypto/bio/b_print.c:114:22: Call
      112.                   state = DP_S_FLAGS;
      113.               else
      114.                   if (!doapr_outch(sbuffer, buffer, &currlen, maxlen, ch))
                                  ^
      115.                       return 0;
      116.               ch = *format++;

crypto/bio/b_print.c:804:1: Parameter `*maxlen`
        802.   #define BUFFER_INC  1024
        803.   
        804. > static int
        805.   doapr_outch(char **sbuffer,
        806.               char **buffer, size_t *currlen, size_t *maxlen, int c)

apps/ca.c:809:35: Call
807.                   ERR_clear_error();
808.           }
809.           if (startdate != NULL && !ASN1_TIME_set_string_X509(NULL, startdate)) {
                                         ^
810.               BIO_printf(bio_err,
811.                          "start date is invalid, it should be YYMMDDHHMMSSZ or YYYYMMDDHHMMSSZ\n");

crypto/asn1/a_time.c:374:1: <Offset trace>
372.   }
373.   
374. > int ASN1_TIME_set_string_X509(ASN1_TIME *s, const char *str)
375.   {
376.       ASN1_TIME t;

crypto/asn1/a_time.c:374:1: Parameter `str->strlen`
  372.   }
  373.   
  374. > int ASN1_TIME_set_string_X509(ASN1_TIME *s, const char *str)
  375.   {
  376.       ASN1_TIME t;

crypto/asn1/a_time.c:380:5: Assignment
  378.       int rv = 0;
  379.   
  380.       t.length = strlen(str);
             ^
  381.       t.data = (unsigned char *)str;
  382.       t.flags = ASN1_STRING_FLAG_X509_TIME;

crypto/asn1/a_time.c:410:13: Assignment
  408.               goto out;
  409.           if (is_utc(tm.tm_year)) {
  410.               t.length -= 2;
                     ^
  411.               /*
  412.                * it's OK to let original t.data go since that's assigned

crypto/asn1/a_time.c:374:1: <Length trace>
372.   }
373.   
374. > int ASN1_TIME_set_string_X509(ASN1_TIME *s, const char *str)
375.   {
376.       ASN1_TIME t;

crypto/asn1/a_time.c:374:1: Parameter `str->strlen`
  372.   }
  373.   
  374. > int ASN1_TIME_set_string_X509(ASN1_TIME *s, const char *str)
  375.   {
  376.       ASN1_TIME t;

crypto/asn1/a_time.c:380:5: Assignment
  378.       int rv = 0;
  379.   
  380.       t.length = strlen(str);
             ^
  381.       t.data = (unsigned char *)str;
  382.       t.flags = ASN1_STRING_FLAG_X509_TIME;

crypto/asn1/a_time.c:410:13: Assignment
  408.               goto out;
  409.           if (is_utc(tm.tm_year)) {
  410.               t.length -= 2;
                     ^
  411.               /*
  412.                * it's OK to let original t.data go since that's assigned

crypto/asn1/a_time.c:416:22: Call
  414.                * new t.data would be freed after ASN1_STRING_copy is done.
  415.                */
  416.               t.data = OPENSSL_zalloc(t.length + 1);
                              ^
  417.               if (t.data == NULL)
  418.                   goto out;

crypto/mem.c:218:1: Parameter `num`
    216.   }
    217.   
    218. > void *CRYPTO_zalloc(size_t num, const char *file, int line)
    219.   {
    220.       void *ret = CRYPTO_malloc(num, file, line);

crypto/mem.c:220:17: Call
    218.   void *CRYPTO_zalloc(size_t num, const char *file, int line)
    219.   {
    220.       void *ret = CRYPTO_malloc(num, file, line);
                           ^
    221.   
    222.       FAILTEST();

crypto/mem.c:198:9: Assignment
      196.   
      197.       if (num == 0)
      198.           return NULL;
                     ^
      199.   
      200.       FAILTEST();

crypto/mem.c:220:5: Assignment
    218.   void *CRYPTO_zalloc(size_t num, const char *file, int line)
    219.   {
    220.       void *ret = CRYPTO_malloc(num, file, line);
               ^
    221.   
    222.       FAILTEST();

crypto/mem.c:225:5: Assignment
    223.       if (ret != NULL)
    224.           memset(ret, 0, num);
    225.       return ret;
               ^
    226.   }
    227.   

crypto/asn1/a_time.c:416:13: Assignment
  414.                * new t.data would be freed after ASN1_STRING_copy is done.
  415.                */
  416.               t.data = OPENSSL_zalloc(t.length + 1);
                     ^
  417.               if (t.data == NULL)
  418.                   goto out;

crypto/asn1/a_time.c:419:13: Array access: Offset added: [-2, +oo] Size: [1, +oo] by call to `ASN1_TIME_set_string_X509` 
  417.               if (t.data == NULL)
  418.                   goto out;
  419.               memcpy(t.data, str + 2, t.length);
                     ^
  420.               t.type = V_ASN1_UTCTIME;
  421.           }
