crypto/pkcs12/p12_npas.c:122: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, +oo] by call to `alg_get`.
Showing all 17 steps of the trace


crypto/pkcs12/p12_npas.c:136:16: Call
134.   		/* Repack bag in same form with new password */
135.   		if (bagnid == NID_pkcs7_data) p7new = PKCS12_pack_p7data(bags);
136.   		else p7new = PKCS12_pack_p7encdata(pbe_nid, newpass, -1, NULL,
                      ^
137.   						 pbe_saltlen, pbe_iter, bags);
138.   		sk_pop_free(bags, PKCS12_SAFEBAG_free);

crypto/pkcs12/p12_add.c:171:2: Call
  169.   	X509_ALGOR_free(p7->d.encrypted->enc_data->algorithm);
  170.   	p7->d.encrypted->enc_data->algorithm = pbe;
  171.   	M_ASN1_OCTET_STRING_free(p7->d.encrypted->enc_data->enc_data);
          ^
  172.   	if (!(p7->d.encrypted->enc_data->enc_data =
  173.   	PKCS12_i2d_encrypt (pbe, i2d_PKCS12_SAFEBAG, pass, passlen,

crypto/asn1/asn1_lib.c:381:1: Parameter `*a->data`
    379.   	}
    380.   
    381. > void ASN1_STRING_free(ASN1_STRING *a)
    382.   	{
    383.   	if (a == NULL) return;

crypto/pkcs12/p12_npas.c:122:4: Call
120.   		} else if (bagnid == NID_pkcs7_encrypted) {
121.   			bags = M_PKCS12_unpack_p7encdata(p7, oldpass, -1);
122.   			alg_get(p7->d.encrypted->enc_data->algorithm,
          ^
123.   				&pbe_nid, &pbe_iter, &pbe_saltlen);
124.   		} else continue;

crypto/pkcs12/p12_npas.c:201:1: Parameter `*alg->parameter->value.sequence->data`
  199.   }
  200.   
  201. > static int alg_get(X509_ALGOR *alg, int *pnid, int *piter, int *psaltlen)
  202.   {
  203.           PBEPARAM *pbe;

crypto/pkcs12/p12_npas.c:205:9: Assignment
  203.           PBEPARAM *pbe;
  204.           unsigned char *p;
  205.           p = alg->parameter->value.sequence->data;
                 ^
  206.           pbe = d2i_PBEPARAM(NULL, &p, alg->parameter->value.sequence->length);
  207.           *pnid = OBJ_obj2nid(alg->algorithm);

crypto/pkcs12/p12_npas.c:206:15: Call
  204.           unsigned char *p;
  205.           p = alg->parameter->value.sequence->data;
  206.           pbe = d2i_PBEPARAM(NULL, &p, alg->parameter->value.sequence->length);
                       ^
  207.           *pnid = OBJ_obj2nid(alg->algorithm);
  208.   	*piter = ASN1_INTEGER_get(pbe->iter);

crypto/asn1/p5_pbe.c:91:1: Parameter `**pp`
    89.   }
    90.   
    91. > PBEPARAM *d2i_PBEPARAM(PBEPARAM **a, unsigned char **pp, long length)
    92.   {
    93.   	M_ASN1_D2I_vars(a,PBEPARAM *,PBEPARAM_new);

crypto/asn1/p5_pbe.c:94:2: Assignment
    92.   {
    93.   	M_ASN1_D2I_vars(a,PBEPARAM *,PBEPARAM_new);
    94.   	M_ASN1_D2I_Init();
           ^
    95.   	M_ASN1_D2I_start_sequence();
    96.   	M_ASN1_D2I_get (ret->salt, d2i_ASN1_OCTET_STRING);

crypto/asn1/p5_pbe.c:95:2: Call
    93.   	M_ASN1_D2I_vars(a,PBEPARAM *,PBEPARAM_new);
    94.   	M_ASN1_D2I_Init();
    95.   	M_ASN1_D2I_start_sequence();
           ^
    96.   	M_ASN1_D2I_get (ret->salt, d2i_ASN1_OCTET_STRING);
    97.   	M_ASN1_D2I_get (ret->iter, d2i_ASN1_INTEGER);

crypto/asn1/asn1_lib.c:277:1: Parameter `*c->p`
      275.   	}
      276.   
      277. > int asn1_GetSequence(ASN1_CTX *c, long *length)
      278.   	{
      279.   	unsigned char *q;

crypto/asn1/asn1_lib.c:282:9: Call
      280.   
      281.   	q=c->p;
      282.   	c->inf=ASN1_get_object(&(c->p),&(c->slen),&(c->tag),&(c->xclass),
                     ^
      283.   		*length);
      284.   	if (c->inf & 0x80)

crypto/asn1/asn1_lib.c:83:1: <Length trace>
81.   
82.   
83. > int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
84.   	     long omax)
85.   	{

crypto/asn1/asn1_lib.c:83:1: Parameter `**pp`
        81.   
        82.   
        83. > int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
        84.   	     long omax)
        85.   	{

crypto/asn1/asn1_lib.c:88:2: Assignment
        86.   	int i,ret;
        87.   	long l;
        88.   	unsigned char *p= *pp;
               ^
        89.   	int tag,xclass,inf;
        90.   	long max=omax;

crypto/asn1/asn1_lib.c:98:3: Assignment
        96.   	if (i == V_ASN1_PRIMITIVE_TAG)
        97.   		{		/* high-tag */
        98.   		p++;
                 ^
        99.   		if (--max == 0) goto err;
        100.   		l=0;

crypto/asn1/asn1_lib.c:101:10: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `alg_get` 
        99.   		if (--max == 0) goto err;
        100.   		l=0;
        101.   		while (*p&0x80)
                        ^
        102.   			{
        103.   			l<<=7L;
