ssl/s2_srvr.c:896: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, +oo] by call to `i2d_X509`.
Showing all 15 steps of the trace


ssl/s2_srvr.c:888:5: Call
886.   		EVP_VerifyUpdate(&ctx,ccd,SSL2_MIN_CERT_CHALLENGE_LENGTH);
887.   
888.   		i=i2d_X509(s->session->cert->pkeys[SSL_PKEY_RSA_ENC].x509,NULL);
           ^
889.   		buf2=(unsigned char *)Malloc((unsigned int)i);
890.   		if (buf2 == NULL)

crypto/asn1/x_x509.c:82:2: Assignment
  80.   int i2d_X509(X509 *a, unsigned char **pp)
  81.   	{
  82.   	M_ASN1_I2D_vars(a);
         ^
  83.   
  84.   	M_ASN1_I2D_len(a->cert_info,	i2d_X509_CINF);

ssl/s2_srvr.c:888:3: Assignment
886.   		EVP_VerifyUpdate(&ctx,ccd,SSL2_MIN_CERT_CHALLENGE_LENGTH);
887.   
888.   		i=i2d_X509(s->session->cert->pkeys[SSL_PKEY_RSA_ENC].x509,NULL);
         ^
889.   		buf2=(unsigned char *)Malloc((unsigned int)i);
890.   		if (buf2 == NULL)

ssl/s2_srvr.c:889:25: Array declaration
887.   
888.   		i=i2d_X509(s->session->cert->pkeys[SSL_PKEY_RSA_ENC].x509,NULL);
889.   		buf2=(unsigned char *)Malloc((unsigned int)i);
                               ^
890.   		if (buf2 == NULL)
891.   			{

ssl/s2_srvr.c:889:3: Assignment
887.   
888.   		i=i2d_X509(s->session->cert->pkeys[SSL_PKEY_RSA_ENC].x509,NULL);
889.   		buf2=(unsigned char *)Malloc((unsigned int)i);
         ^
890.   		if (buf2 == NULL)
891.   			{

ssl/s2_srvr.c:895:3: Assignment
893.   			goto msg_end;
894.   			}
895.   		p2=buf2;
         ^
896.   		i=i2d_X509(s->session->cert->pkeys[SSL_PKEY_RSA_ENC].x509,&p2);
897.   		EVP_VerifyUpdate(&ctx,buf2,(unsigned int)i);

ssl/s2_srvr.c:896:5: Call
894.   			}
895.   		p2=buf2;
896.   		i=i2d_X509(s->session->cert->pkeys[SSL_PKEY_RSA_ENC].x509,&p2);
           ^
897.   		EVP_VerifyUpdate(&ctx,buf2,(unsigned int)i);
898.   		Free(buf2);

crypto/asn1/x_x509.c:80:1: Parameter `**pp`
  78.   	}
  79.   
  80. > int i2d_X509(X509 *a, unsigned char **pp)
  81.   	{
  82.   	M_ASN1_I2D_vars(a);

crypto/asn1/x_x509.c:88:2: Assignment
  86.   	M_ASN1_I2D_len(a->signature,	i2d_ASN1_BIT_STRING);
  87.   
  88.   	M_ASN1_I2D_seq_total();
         ^
  89.   
  90.   	M_ASN1_I2D_put(a->cert_info,	i2d_X509_CINF);

crypto/asn1/x_x509.c:88:2: Call
  86.   	M_ASN1_I2D_len(a->signature,	i2d_ASN1_BIT_STRING);
  87.   
  88.   	M_ASN1_I2D_seq_total();
         ^
  89.   
  90.   	M_ASN1_I2D_put(a->cert_info,	i2d_X509_CINF);

crypto/asn1/asn1_lib.c:186:1: <Length trace>
184.   /* class 0 is constructed
185.    * constructed == 2 for indefinitle length constructed */
186. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
187.   	     int xclass)
188.   	{

crypto/asn1/asn1_lib.c:186:1: Parameter `**pp`
    184.   /* class 0 is constructed
    185.    * constructed == 2 for indefinitle length constructed */
    186. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
    187.   	     int xclass)
    188.   	{

crypto/asn1/asn1_lib.c:189:2: Assignment
    187.   	     int xclass)
    188.   	{
    189.   	unsigned char *p= *pp;
            ^
    190.   	int i;
    191.   

crypto/asn1/asn1_lib.c:198:5: Assignment
    196.   	else
    197.   		{
    198.   		*(p++)=i|V_ASN1_PRIMATIVE_TAG;
               ^
    199.   		while (tag > 0x7f)
    200.   			{

crypto/asn1/asn1_lib.c:204:3: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `i2d_X509` 
    202.   			tag>>=7;
    203.   			}
    204.   		*(p++)=(tag&0x7f);
             ^
    205.   		}
    206.   	if ((constructed == 2) && (length == 0))
