crypto/ts/ts_rsp_sign.c:870: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] (⇐ [2, +oo] + [0, +oo]) Size: [1, +oo] by call to `i2d_ESS_SIGNING_CERT`.
Showing all 34 steps of the trace


crypto/ts/ts_rsp_sign.c:864:11: Call
862.       int len;
863.   
864.       len = i2d_ESS_SIGNING_CERT(sc, NULL);
                 ^
865.       if ((pp = OPENSSL_malloc(len)) == NULL) {
866.           TSerr(TS_F_ESS_ADD_SIGNING_CERT, ERR_R_MALLOC_FAILURE);

crypto/ts/ts_asn1.c:274:1: Call
  272.   } static_ASN1_SEQUENCE_END(ESS_SIGNING_CERT)
  273.   
  274. > IMPLEMENT_ASN1_FUNCTIONS_const(ESS_SIGNING_CERT)
  275.   IMPLEMENT_ASN1_DUP_FUNCTION(ESS_SIGNING_CERT)
  276.   

crypto/asn1/tasn_enc.c:94:12: Call
    92.   int ASN1_item_i2d(ASN1_VALUE *val, unsigned char **out, const ASN1_ITEM *it)
    93.   {
    94.       return asn1_item_flags_i2d(val, out, it, 0);
                     ^
    95.   }
    96.   

crypto/asn1/tasn_enc.c:115:13: Assignment
      113.           buf = OPENSSL_malloc(len);
      114.           if (buf == NULL)
      115.               return -1;
                         ^
      116.           p = buf;
      117.           ASN1_item_ex_i2d(&val, &p, it, -1, flags);

crypto/asn1/tasn_enc.c:94:5: Assignment
    92.   int ASN1_item_i2d(ASN1_VALUE *val, unsigned char **out, const ASN1_ITEM *it)
    93.   {
    94.       return asn1_item_flags_i2d(val, out, it, 0);
              ^
    95.   }
    96.   

crypto/ts/ts_asn1.c:274:1: Assignment
  272.   } static_ASN1_SEQUENCE_END(ESS_SIGNING_CERT)
  273.   
  274. > IMPLEMENT_ASN1_FUNCTIONS_const(ESS_SIGNING_CERT)
  275.   IMPLEMENT_ASN1_DUP_FUNCTION(ESS_SIGNING_CERT)
  276.   

crypto/ts/ts_rsp_sign.c:864:5: Assignment
862.       int len;
863.   
864.       len = i2d_ESS_SIGNING_CERT(sc, NULL);
           ^
865.       if ((pp = OPENSSL_malloc(len)) == NULL) {
866.           TSerr(TS_F_ESS_ADD_SIGNING_CERT, ERR_R_MALLOC_FAILURE);

crypto/ts/ts_rsp_sign.c:865:15: Call
863.   
864.       len = i2d_ESS_SIGNING_CERT(sc, NULL);
865.       if ((pp = OPENSSL_malloc(len)) == NULL) {
                     ^
866.           TSerr(TS_F_ESS_ADD_SIGNING_CERT, ERR_R_MALLOC_FAILURE);
867.           goto err;

crypto/mem.c:125:9: Assignment
  123.   
  124.       if (num <= 0)
  125.           return NULL;
                 ^
  126.   
  127.       allow_customize = 0;

crypto/ts/ts_rsp_sign.c:865:10: Assignment
863.   
864.       len = i2d_ESS_SIGNING_CERT(sc, NULL);
865.       if ((pp = OPENSSL_malloc(len)) == NULL) {
                ^
866.           TSerr(TS_F_ESS_ADD_SIGNING_CERT, ERR_R_MALLOC_FAILURE);
867.           goto err;

crypto/ts/ts_rsp_sign.c:869:5: Assignment
867.           goto err;
868.       }
869.       p = pp;
           ^
870.       i2d_ESS_SIGNING_CERT(sc, &p);
871.       if ((seq = ASN1_STRING_new()) == NULL || !ASN1_STRING_set(seq, pp, len)) {

crypto/ts/ts_rsp_sign.c:870:5: Call
868.       }
869.       p = pp;
870.       i2d_ESS_SIGNING_CERT(sc, &p);
           ^
871.       if ((seq = ASN1_STRING_new()) == NULL || !ASN1_STRING_set(seq, pp, len)) {
872.           TSerr(TS_F_ESS_ADD_SIGNING_CERT, ERR_R_MALLOC_FAILURE);

crypto/ts/ts_asn1.c:274:1: Parameter `**out`
  272.   } static_ASN1_SEQUENCE_END(ESS_SIGNING_CERT)
  273.   
  274. > IMPLEMENT_ASN1_FUNCTIONS_const(ESS_SIGNING_CERT)
  275.   IMPLEMENT_ASN1_DUP_FUNCTION(ESS_SIGNING_CERT)
  276.   

crypto/ts/ts_asn1.c:274:1: Call
  272.   } static_ASN1_SEQUENCE_END(ESS_SIGNING_CERT)
  273.   
  274. > IMPLEMENT_ASN1_FUNCTIONS_const(ESS_SIGNING_CERT)
  275.   IMPLEMENT_ASN1_DUP_FUNCTION(ESS_SIGNING_CERT)
  276.   

crypto/asn1/tasn_enc.c:92:1: Parameter `**out`
    90.   }
    91.   
    92. > int ASN1_item_i2d(ASN1_VALUE *val, unsigned char **out, const ASN1_ITEM *it)
    93.   {
    94.       return asn1_item_flags_i2d(val, out, it, 0);

crypto/asn1/tasn_enc.c:94:12: Call
    92.   int ASN1_item_i2d(ASN1_VALUE *val, unsigned char **out, const ASN1_ITEM *it)
    93.   {
    94.       return asn1_item_flags_i2d(val, out, it, 0);
                     ^
    95.   }
    96.   

crypto/asn1/tasn_enc.c:104:1: Parameter `**out`
      102.    */
      103.   
      104. > static int asn1_item_flags_i2d(ASN1_VALUE *val, unsigned char **out,
      105.                                  const ASN1_ITEM *it, int flags)
      106.   {

crypto/asn1/tasn_enc.c:122:12: Call
      120.       }
      121.   
      122.       return ASN1_item_ex_i2d(&val, out, it, -1, flags);
                        ^
      123.   }
      124.   

crypto/asn1/tasn_enc.c:130:1: Parameter `**out`
        128.    */
        129.   
        130. > int ASN1_item_ex_i2d(ASN1_VALUE **pval, unsigned char **out,
        131.                        const ASN1_ITEM *it, int tag, int aclass)
        132.   {

crypto/asn1/tasn_enc.c:154:16: Call
        152.   
        153.       case ASN1_ITYPE_MSTRING:
        154.           return asn1_i2d_ex_primitive(pval, out, it, -1, aclass);
                              ^
        155.   
        156.       case ASN1_ITYPE_CHOICE:

crypto/asn1/tasn_enc.c:472:1: Parameter `**out`
          470.   }
          471.   
          472. > static int asn1_i2d_ex_primitive(ASN1_VALUE **pval, unsigned char **out,
          473.                                    const ASN1_ITEM *it, int tag, int aclass)
          474.   {

crypto/asn1/tasn_enc.c:517:13: Call
          515.       if (out) {
          516.           if (usetag)
          517.               ASN1_put_object(out, ndef, len, tag, aclass);
                             ^
          518.           asn1_ex_i2c(pval, *out, &utype, it);
          519.           if (ndef)

crypto/asn1/asn1_lib.c:196:1: Parameter `**pp`
            194.    * class 0 is constructed constructed == 2 for indefinite length constructed
            195.    */
            196. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
            197.                        int xclass)
            198.   {

crypto/asn1/asn1_lib.c:199:5: Assignment
            197.                        int xclass)
            198.   {
            199.       unsigned char *p = *pp;
                       ^
            200.       int i, ttag;
            201.   

crypto/asn1/asn1_lib.c:205:11: Assignment
            203.       i |= (xclass & V_ASN1_PRIVATE);
            204.       if (tag < 31)
            205.           *(p++) = i | (tag & V_ASN1_PRIMITIVE_TAG);
                             ^
            206.       else {
            207.           *(p++) = i | V_ASN1_PRIMITIVE_TAG;

crypto/asn1/asn1_lib.c:222:9: Call
            220.           *(p++) = 0x80;
            221.       else
            222.           asn1_put_length(&p, length);
                           ^
            223.       *pp = p;
            224.   }

crypto/asn1/asn1_lib.c:243:14: <Offset trace>
241.       else {
242.           l = length;
243.           for (i = 0; l > 0; i++)
                    ^
244.               l >>= 8;
245.           *(p++) = i | 0x80;

crypto/asn1/asn1_lib.c:243:14: Assignment
              241.       else {
              242.           l = length;
              243.           for (i = 0; l > 0; i++)
                                  ^
              244.               l >>= 8;
              245.           *(p++) = i | 0x80;

crypto/asn1/asn1_lib.c:247:16: Assignment
              245.           *(p++) = i | 0x80;
              246.           l = i;
              247.           while (i-- > 0) {
                                    ^
              248.               p[i] = length & 0xff;
              249.               length >>= 8;

crypto/asn1/asn1_lib.c:235:1: <Length trace>
233.   }
234.   
235. > static void asn1_put_length(unsigned char **pp, int length)
236.   {
237.       unsigned char *p = *pp;

crypto/asn1/asn1_lib.c:235:1: Parameter `**pp`
              233.   }
              234.   
              235. > static void asn1_put_length(unsigned char **pp, int length)
              236.   {
              237.       unsigned char *p = *pp;

crypto/asn1/asn1_lib.c:237:5: Assignment
              235.   static void asn1_put_length(unsigned char **pp, int length)
              236.   {
              237.       unsigned char *p = *pp;
                         ^
              238.       int i, l;
              239.       if (length <= 127)

crypto/asn1/asn1_lib.c:245:11: Assignment
              243.           for (i = 0; l > 0; i++)
              244.               l >>= 8;
              245.           *(p++) = i | 0x80;
                               ^
              246.           l = i;
              247.           while (i-- > 0) {

crypto/asn1/asn1_lib.c:248:13: Array access: Offset: [2, +oo] (⇐ [2, +oo] + [0, +oo]) Size: [1, +oo] by call to `i2d_ESS_SIGNING_CERT` 
              246.           l = i;
              247.           while (i-- > 0) {
              248.               p[i] = length & 0xff;
                                 ^
              249.               length >>= 8;
              250.           }
