crypto/cms/cms_smime.c:763: error: BUFFER_OVERRUN_L3
  Offset: 6 Size: [1, +oo] by call to `CMS_RecipientInfo_decrypt`.
Showing all 13 steps of the trace


crypto/cms/cms_smime.c:763:13: Call
761.               continue;
762.           CMS_RecipientInfo_set0_password(ri, pass, passlen);
763.           r = CMS_RecipientInfo_decrypt(cms, ri);
                   ^
764.           CMS_RecipientInfo_set0_password(ri, NULL, 0);
765.           if (r > 0)

crypto/cms/cms_env.c:782:1: Parameter `ri->d.pwri->encryptedKey->length`
  780.   }
  781.   
  782. > int CMS_RecipientInfo_decrypt(CMS_ContentInfo *cms, CMS_RecipientInfo *ri)
  783.   {
  784.       switch (ri->type) {

crypto/cms/cms_smime.c:763:13: Call
761.               continue;
762.           CMS_RecipientInfo_set0_password(ri, pass, passlen);
763.           r = CMS_RecipientInfo_decrypt(cms, ri);
                   ^
764.           CMS_RecipientInfo_set0_password(ri, NULL, 0);
765.           if (r > 0)

crypto/cms/cms_env.c:782:1: Parameter `ri->d.pwri->encryptedKey->length`
  780.   }
  781.   
  782. > int CMS_RecipientInfo_decrypt(CMS_ContentInfo *cms, CMS_RecipientInfo *ri)
  783.   {
  784.       switch (ri->type) {

crypto/cms/cms_env.c:792:16: Call
  790.   
  791.       case CMS_RECIPINFO_PASS:
  792.           return cms_RecipientInfo_pwri_crypt(cms, ri, 0);
                        ^
  793.   
  794.       default:

crypto/cms/cms_pwri.c:319:1: Parameter `ri->d.pwri->encryptedKey->length`
    317.   /* Encrypt/Decrypt content key in PWRI recipient info */
    318.   
    319. > int cms_RecipientInfo_pwri_crypt(CMS_ContentInfo *cms, CMS_RecipientInfo *ri,
    320.                                    int en_de)
    321.   {

crypto/cms/cms_pwri.c:408:14: Call
    406.               goto err;
    407.           }
    408.           if (!kek_unwrap_key(key, &keylen,
                        ^
    409.                               pwri->encryptedKey->data,
    410.                               pwri->encryptedKey->length, &kekctx)) {

crypto/cms/cms_pwri.c:220:1: <Length trace>
218.    */
219.   
220. > static int kek_unwrap_key(unsigned char *out, size_t *outlen,
221.                             const unsigned char *in, size_t inlen,
222.                             EVP_CIPHER_CTX *ctx)

crypto/cms/cms_pwri.c:220:1: Parameter `inlen`
      218.    */
      219.   
      220. > static int kek_unwrap_key(unsigned char *out, size_t *outlen,
      221.                             const unsigned char *in, size_t inlen,
      222.                             EVP_CIPHER_CTX *ctx)

crypto/cms/cms_pwri.c:235:11: Call
      233.           return 0;
      234.       }
      235.       tmp = OPENSSL_malloc(inlen);
                       ^
      236.       if (tmp == NULL)
      237.           return 0;

crypto/mem.c:125:9: Assignment
        123.   
        124.       if (num <= 0)
        125.           return NULL;
                       ^
        126.   
        127.       allow_customize = 0;

crypto/cms/cms_pwri.c:235:5: Assignment
      233.           return 0;
      234.       }
      235.       tmp = OPENSSL_malloc(inlen);
                 ^
      236.       if (tmp == NULL)
      237.           return 0;

crypto/cms/cms_pwri.c:257:60: Array access: Offset: 6 Size: [1, +oo] by call to `CMS_RecipientInfo_decrypt` 
      255.           goto err;
      256.       /* Check check bytes */
      257.       if (((tmp[1] ^ tmp[4]) & (tmp[2] ^ tmp[5]) & (tmp[3] ^ tmp[6])) != 0xff) {
                                                                        ^
      258.           /* Check byte failure */
      259.           goto err;
