ssl/s2_srvr.c:896: error: BUFFER_OVERRUN_L3
  Offset: [7, +oo] Size: [0, +oo] by call to `i2d_X509`.
Showing all 42 steps of the trace


ssl/s2_srvr.c:888:5: Call
886.   		EVP_VerifyUpdate(&ctx,ccd,SSL2_MIN_CERT_CHALLENGE_LENGTH);
887.   
888.   		i=i2d_X509(s->session->cert->pkeys[SSL_PKEY_RSA_ENC].x509,NULL);
           ^
889.   		buf2=(unsigned char *)Malloc((unsigned int)i);
890.   		if (buf2 == NULL)

crypto/asn1/x_x509.c:82:2: Assignment
  80.   int i2d_X509(X509 *a, unsigned char **pp)
  81.   	{
  82.   	M_ASN1_I2D_vars(a);
         ^
  83.   
  84.   	M_ASN1_I2D_len(a->cert_info,	i2d_X509_CINF);

ssl/s2_srvr.c:888:3: Assignment
886.   		EVP_VerifyUpdate(&ctx,ccd,SSL2_MIN_CERT_CHALLENGE_LENGTH);
887.   
888.   		i=i2d_X509(s->session->cert->pkeys[SSL_PKEY_RSA_ENC].x509,NULL);
         ^
889.   		buf2=(unsigned char *)Malloc((unsigned int)i);
890.   		if (buf2 == NULL)

ssl/s2_srvr.c:889:25: Array declaration
887.   
888.   		i=i2d_X509(s->session->cert->pkeys[SSL_PKEY_RSA_ENC].x509,NULL);
889.   		buf2=(unsigned char *)Malloc((unsigned int)i);
                               ^
890.   		if (buf2 == NULL)
891.   			{

ssl/s2_srvr.c:889:3: Assignment
887.   
888.   		i=i2d_X509(s->session->cert->pkeys[SSL_PKEY_RSA_ENC].x509,NULL);
889.   		buf2=(unsigned char *)Malloc((unsigned int)i);
         ^
890.   		if (buf2 == NULL)
891.   			{

ssl/s2_srvr.c:895:3: Assignment
893.   			goto msg_end;
894.   			}
895.   		p2=buf2;
         ^
896.   		i=i2d_X509(s->session->cert->pkeys[SSL_PKEY_RSA_ENC].x509,&p2);
897.   		EVP_VerifyUpdate(&ctx,buf2,(unsigned int)i);

ssl/s2_srvr.c:896:5: Call
894.   			}
895.   		p2=buf2;
896.   		i=i2d_X509(s->session->cert->pkeys[SSL_PKEY_RSA_ENC].x509,&p2);
           ^
897.   		EVP_VerifyUpdate(&ctx,buf2,(unsigned int)i);
898.   		Free(buf2);

crypto/asn1/x_x509.c:80:1: Parameter `**pp`
  78.   	}
  79.   
  80. > int i2d_X509(X509 *a, unsigned char **pp)
  81.   	{
  82.   	M_ASN1_I2D_vars(a);

crypto/asn1/x_x509.c:88:2: Assignment
  86.   	M_ASN1_I2D_len(a->signature,	i2d_ASN1_BIT_STRING);
  87.   
  88.   	M_ASN1_I2D_seq_total();
         ^
  89.   
  90.   	M_ASN1_I2D_put(a->cert_info,	i2d_X509_CINF);

crypto/asn1/x_x509.c:88:2: Call
  86.   	M_ASN1_I2D_len(a->signature,	i2d_ASN1_BIT_STRING);
  87.   
  88.   	M_ASN1_I2D_seq_total();
         ^
  89.   
  90.   	M_ASN1_I2D_put(a->cert_info,	i2d_X509_CINF);

crypto/asn1/asn1_lib.c:186:1: Parameter `**pp`
    184.   /* class 0 is constructed
    185.    * constructed == 2 for indefinitle length constructed */
    186. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
    187.   	     int xclass)
    188.   	{

crypto/asn1/asn1_lib.c:189:2: Assignment
    187.   	     int xclass)
    188.   	{
    189.   	unsigned char *p= *pp;
            ^
    190.   	int i;
    191.   

crypto/asn1/asn1_lib.c:195:5: Assignment
    193.   	i|=(xclass&V_ASN1_PRIVATE);
    194.   	if (tag < 31)
    195.   		*(p++)=i|(tag&V_ASN1_PRIMATIVE_TAG);
               ^
    196.   	else
    197.   		{

crypto/asn1/asn1_lib.c:207:5: Assignment
    205.   		}
    206.   	if ((constructed == 2) && (length == 0))
    207.   		*(p++)=0x80; /* der_put_length would output 0 instead */
               ^
    208.   	else
    209.   		asn1_put_length(&p,length);

crypto/asn1/asn1_lib.c:210:2: Assignment
    208.   	else
    209.   		asn1_put_length(&p,length);
    210.   	*pp=p;
            ^
    211.   	}
    212.   

crypto/asn1/x_x509.c:90:2: Call
  88.   	M_ASN1_I2D_seq_total();
  89.   
  90.   	M_ASN1_I2D_put(a->cert_info,	i2d_X509_CINF);
         ^
  91.   	M_ASN1_I2D_put(a->sig_alg,	i2d_X509_ALGOR);
  92.   	M_ASN1_I2D_put(a->signature,	i2d_ASN1_BIT_STRING);

crypto/asn1/x_cinf.c:68:1: Parameter `**pp`
    66.    */
    67.   
    68. > int i2d_X509_CINF(X509_CINF *a, unsigned char **pp)
    69.   	{
    70.   	int v1=0,v2=0;

crypto/asn1/x_cinf.c:84:2: Assignment
    82.   	M_ASN1_I2D_len_EXP_SEQUENCE_opt(a->extensions,i2d_X509_EXTENSION,3,V_ASN1_SEQUENCE,v2);
    83.   
    84.   	M_ASN1_I2D_seq_total();
           ^
    85.   
    86.   	M_ASN1_I2D_put_EXP_opt(a->version,i2d_ASN1_INTEGER,0,v1);

crypto/asn1/x_cinf.c:84:2: Call
    82.   	M_ASN1_I2D_len_EXP_SEQUENCE_opt(a->extensions,i2d_X509_EXTENSION,3,V_ASN1_SEQUENCE,v2);
    83.   
    84.   	M_ASN1_I2D_seq_total();
           ^
    85.   
    86.   	M_ASN1_I2D_put_EXP_opt(a->version,i2d_ASN1_INTEGER,0,v1);

crypto/asn1/asn1_lib.c:186:1: Parameter `**pp`
      184.   /* class 0 is constructed
      185.    * constructed == 2 for indefinitle length constructed */
      186. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
      187.   	     int xclass)
      188.   	{

crypto/asn1/asn1_lib.c:189:2: Assignment
      187.   	     int xclass)
      188.   	{
      189.   	unsigned char *p= *pp;
              ^
      190.   	int i;
      191.   

crypto/asn1/asn1_lib.c:195:5: Assignment
      193.   	i|=(xclass&V_ASN1_PRIVATE);
      194.   	if (tag < 31)
      195.   		*(p++)=i|(tag&V_ASN1_PRIMATIVE_TAG);
                 ^
      196.   	else
      197.   		{

crypto/asn1/asn1_lib.c:207:5: Assignment
      205.   		}
      206.   	if ((constructed == 2) && (length == 0))
      207.   		*(p++)=0x80; /* der_put_length would output 0 instead */
                 ^
      208.   	else
      209.   		asn1_put_length(&p,length);

crypto/asn1/asn1_lib.c:210:2: Assignment
      208.   	else
      209.   		asn1_put_length(&p,length);
      210.   	*pp=p;
              ^
      211.   	}
      212.   

crypto/asn1/x_cinf.c:86:2: Call
    84.   	M_ASN1_I2D_seq_total();
    85.   
    86.   	M_ASN1_I2D_put_EXP_opt(a->version,i2d_ASN1_INTEGER,0,v1);
           ^
    87.   	M_ASN1_I2D_put(a->serialNumber,		i2d_ASN1_INTEGER);
    88.   	M_ASN1_I2D_put(a->signature,		i2d_X509_ALGOR);

crypto/asn1/asn1_lib.c:186:1: Parameter `**pp`
      184.   /* class 0 is constructed
      185.    * constructed == 2 for indefinitle length constructed */
      186. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
      187.   	     int xclass)
      188.   	{

crypto/asn1/asn1_lib.c:189:2: Assignment
      187.   	     int xclass)
      188.   	{
      189.   	unsigned char *p= *pp;
              ^
      190.   	int i;
      191.   

crypto/asn1/asn1_lib.c:195:5: Assignment
      193.   	i|=(xclass&V_ASN1_PRIVATE);
      194.   	if (tag < 31)
      195.   		*(p++)=i|(tag&V_ASN1_PRIMATIVE_TAG);
                 ^
      196.   	else
      197.   		{

crypto/asn1/asn1_lib.c:207:5: Assignment
      205.   		}
      206.   	if ((constructed == 2) && (length == 0))
      207.   		*(p++)=0x80; /* der_put_length would output 0 instead */
                 ^
      208.   	else
      209.   		asn1_put_length(&p,length);

crypto/asn1/asn1_lib.c:210:2: Assignment
      208.   	else
      209.   		asn1_put_length(&p,length);
      210.   	*pp=p;
              ^
      211.   	}
      212.   

crypto/asn1/x_cinf.c:86:2: Call
    84.   	M_ASN1_I2D_seq_total();
    85.   
    86.   	M_ASN1_I2D_put_EXP_opt(a->version,i2d_ASN1_INTEGER,0,v1);
           ^
    87.   	M_ASN1_I2D_put(a->serialNumber,		i2d_ASN1_INTEGER);
    88.   	M_ASN1_I2D_put(a->signature,		i2d_X509_ALGOR);

crypto/asn1/a_int.c:66:1: Parameter `**pp`
      64.    */
      65.   
      66. > int i2d_ASN1_INTEGER(ASN1_INTEGER *a, unsigned char **pp)
      67.   	{
      68.   	int pad=0,ret,r,i,t;

crypto/asn1/a_int.c:93:2: Assignment
      91.   	r=ASN1_object_size(0,ret,V_ASN1_INTEGER);
      92.   	if (pp == NULL) return(r);
      93.   	p= *pp;
             ^
      94.   
      95.   	ASN1_put_object(&p,0,ret,V_ASN1_INTEGER,V_ASN1_UNIVERSAL);

crypto/asn1/a_int.c:95:2: Call
      93.   	p= *pp;
      94.   
      95.   	ASN1_put_object(&p,0,ret,V_ASN1_INTEGER,V_ASN1_UNIVERSAL);
             ^
      96.   	if (pad) *(p++)=pb;
      97.   	if (a->length == 0)

crypto/asn1/asn1_lib.c:186:1: Parameter `**pp`
        184.   /* class 0 is constructed
        185.    * constructed == 2 for indefinitle length constructed */
        186. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
        187.   	     int xclass)
        188.   	{

crypto/asn1/asn1_lib.c:189:2: Assignment
        187.   	     int xclass)
        188.   	{
        189.   	unsigned char *p= *pp;
                ^
        190.   	int i;
        191.   

crypto/asn1/asn1_lib.c:195:5: Assignment
        193.   	i|=(xclass&V_ASN1_PRIVATE);
        194.   	if (tag < 31)
        195.   		*(p++)=i|(tag&V_ASN1_PRIMATIVE_TAG);
                   ^
        196.   	else
        197.   		{

crypto/asn1/asn1_lib.c:209:3: Call
        207.   		*(p++)=0x80; /* der_put_length would output 0 instead */
        208.   	else
        209.   		asn1_put_length(&p,length);
                 ^
        210.   	*pp=p;
        211.   	}

crypto/asn1/asn1_lib.c:213:1: <Length trace>
211.   	}
212.   
213. > static void asn1_put_length(unsigned char **pp, int length)
214.   	{
215.   	unsigned char *p= *pp;

crypto/asn1/asn1_lib.c:213:1: Parameter `**pp`
          211.   	}
          212.   
          213. > static void asn1_put_length(unsigned char **pp, int length)
          214.   	{
          215.   	unsigned char *p= *pp;

crypto/asn1/asn1_lib.c:215:2: Assignment
          213.   static void asn1_put_length(unsigned char **pp, int length)
          214.   	{
          215.   	unsigned char *p= *pp;
                  ^
          216.   	int i,l;
          217.   	if (length <= 127)

crypto/asn1/asn1_lib.c:224:3: Array access: Offset: [7, +oo] Size: [0, +oo] by call to `i2d_X509` 
          222.   		for (i=0; l > 0; i++)
          223.   			l>>=8;
          224.   		*(p++)=i|0x80;
                   ^
          225.   		l=i;
          226.   		while (i-- > 0)
