crypto/pkcs7/pk7_doit.c:693: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, +oo] by call to `PKCS7_signatureVerify`.
Showing all 25 steps of the trace


crypto/pkcs7/pk7_doit.c:685:4: Call
683.   	X509_STORE_CTX_init(ctx,cert_store,x509,cert);
684.   	X509_STORE_CTX_set_purpose(ctx, X509_PURPOSE_SMIME_SIGN);
685.   	i=X509_verify_cert(ctx);
          ^
686.   	if (i <= 0) 
687.   		{

crypto/x509/x509_vfy.c:200:32: Call
  198.   			 */
  199.   			ok=X509_STORE_get_by_subject(ctx,X509_LU_X509,xn,&obj);
  200.   			if ((ok != X509_LU_X509) || X509_cmp(x, obj.data.x509)) 
                                        ^
  201.   				{
  202.   				ctx->error=X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT;

crypto/x509/x509_cmp.c:142:1: Parameter `*b->cert_info->version->data`
    140.    * this to work.
    141.    */
    142. > int X509_cmp(X509 *a, X509 *b)
    143.   {
    144.   	/* ensure hash is valid */

crypto/x509/x509_cmp.c:146:2: Call
    144.   	/* ensure hash is valid */
    145.   	X509_check_purpose(a, -1, 0);
    146.   	X509_check_purpose(b, -1, 0);
            ^
    147.   	return memcmp(a->sha1_hash, b->sha1_hash, SHA_DIGEST_LENGTH);
    148.   }

crypto/x509v3/v3_purp.c:98:1: Parameter `*x->cert_info->version->data`
      96.   }
      97.   
      98. > int X509_check_purpose(X509 *x, int id, int ca)
      99.   {
      100.   	int idx;

crypto/x509/x509_vfy.c:246:5: Call
  244.   			if (ok == X509_LU_RETRY)
  245.   				{
  246.   				X509_OBJECT_free_contents(&obj);
             ^
  247.   				X509err(X509_F_X509_VERIFY_CERT,X509_R_SHOULD_RETRY);
  248.   				return(ok);

crypto/x509/x509_lu.c:341:1: Parameter `a->data.x509->aux->other->value.ptr->data`
    339.   	}
    340.   
    341. > void X509_OBJECT_free_contents(X509_OBJECT *a)
    342.   	{
    343.   	switch (a->type)

crypto/pkcs7/pk7_doit.c:693:9: Call
691.   	X509_STORE_CTX_cleanup(ctx);
692.   
693.   	return PKCS7_signatureVerify(bio, p7, si, x509);
               ^
694.   	err:
695.   	return ret;

crypto/pkcs7/pk7_doit.c:698:1: Parameter `*x509->cert_info->key->algor->parameter->value.sequence->data`
  696.   	}
  697.   
  698. > int PKCS7_signatureVerify(BIO *bio, PKCS7 *p7, PKCS7_SIGNER_INFO *si,
  699.   								X509 *x509)
  700.   	{

crypto/pkcs7/pk7_doit.c:794:9: Call
  792.   
  793.   	os=si->enc_digest;
  794.   	pkey = X509_get_pubkey(x509);
                 ^
  795.   	if(pkey->type == EVP_PKEY_DSA) mdc_tmp.digest=EVP_dss1();
  796.   

crypto/x509/x509_cmp.c:250:1: Parameter `*x->cert_info->key->algor->parameter->value.sequence->data`
    248.   	}
    249.   
    250. > EVP_PKEY *X509_get_pubkey(X509 *x)
    251.   	{
    252.   	if ((x == NULL) || (x->cert_info == NULL))

crypto/x509/x509_cmp.c:254:9: Call
    252.   	if ((x == NULL) || (x->cert_info == NULL))
    253.   		return(NULL);
    254.   	return(X509_PUBKEY_get(x->cert_info->key));
                   ^
    255.   	}
    256.   

crypto/asn1/x_pubkey.c:201:1: Parameter `*key->algor->parameter->value.sequence->data`
      199.   	}
      200.   
      201. > EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)
      202.   	{
      203.   	EVP_PKEY *ret=NULL;

crypto/asn1/x_pubkey.c:238:4: Assignment
      236.   			{
      237.   			ret->pkey.dsa->write_params=0;
      238.   			p=a->parameter->value.sequence->data;
                ^
      239.   			j=a->parameter->value.sequence->length;
      240.   			if (!d2i_DSAparams(&ret->pkey.dsa,&p,(long)j))

crypto/asn1/x_pubkey.c:240:9: Call
      238.   			p=a->parameter->value.sequence->data;
      239.   			j=a->parameter->value.sequence->length;
      240.   			if (!d2i_DSAparams(&ret->pkey.dsa,&p,(long)j))
                     ^
      241.   				goto err;
      242.   			}

crypto/asn1/d2i_dsap.c:71:1: Parameter `**pp`
        69.   #endif
        70.   
        71. > DSA *d2i_DSAparams(DSA **a, unsigned char **pp, long length)
        72.   	{
        73.   	int i=ERR_R_NESTED_ASN1_ERROR;

crypto/asn1/d2i_dsap.c:77:2: Assignment
        75.   	M_ASN1_D2I_vars(a,DSA *,DSA_new);
        76.   
        77.   	M_ASN1_D2I_Init();
               ^
        78.   	M_ASN1_D2I_start_sequence();
        79.   	M_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);

crypto/asn1/d2i_dsap.c:78:2: Call
        76.   
        77.   	M_ASN1_D2I_Init();
        78.   	M_ASN1_D2I_start_sequence();
               ^
        79.   	M_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);
        80.   	if ((ret->p=BN_bin2bn(bs->data,bs->length,ret->p)) == NULL) goto err_bn;

crypto/asn1/asn1_lib.c:277:1: Parameter `*c->p`
          275.   	}
          276.   
          277. > int asn1_GetSequence(ASN1_CTX *c, long *length)
          278.   	{
          279.   	unsigned char *q;

crypto/asn1/asn1_lib.c:282:9: Call
          280.   
          281.   	q=c->p;
          282.   	c->inf=ASN1_get_object(&(c->p),&(c->slen),&(c->tag),&(c->xclass),
                         ^
          283.   		*length);
          284.   	if (c->inf & 0x80)

crypto/asn1/asn1_lib.c:83:1: <Length trace>
81.   
82.   
83. > int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
84.   	     long omax)
85.   	{

crypto/asn1/asn1_lib.c:83:1: Parameter `**pp`
            81.   
            82.   
            83. > int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
            84.   	     long omax)
            85.   	{

crypto/asn1/asn1_lib.c:88:2: Assignment
            86.   	int i,ret;
            87.   	long l;
            88.   	unsigned char *p= *pp;
                   ^
            89.   	int tag,xclass,inf;
            90.   	long max=omax;

crypto/asn1/asn1_lib.c:98:3: Assignment
            96.   	if (i == V_ASN1_PRIMITIVE_TAG)
            97.   		{		/* high-tag */
            98.   		p++;
                     ^
            99.   		if (--max == 0) goto err;
            100.   		l=0;

crypto/asn1/asn1_lib.c:101:10: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `PKCS7_signatureVerify` 
            99.   		if (--max == 0) goto err;
            100.   		l=0;
            101.   		while (*p&0x80)
                            ^
            102.   			{
            103.   			l<<=7L;
