crypto/pkcs12/p12_crt.c:119: error: BUFFER_OVERRUN_L3
  Offset: [0, 3] Size: [0, +oo] by call to `sk_pop_free`.
Showing all 15 steps of the trace


crypto/pkcs12/p12_crt.c:108:15: Call
106.   		for(i = 0; i < sk_num(ca); i++) {
107.   			tcert = (X509 *)sk_value(ca, i);
108.   			if(!(bag = M_PKCS12_x5092certbag(tcert))) return NULL;
                     ^
109.   			if(!sk_push(bags, (char *)bag)) {
110.   				PKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE);

crypto/pkcs12/p12_add.c:79:18: Call
  77.   		return NULL;
  78.   	}
  79.   	if (!(safebag = PKCS12_SAFEBAG_new ())) {
                         ^
  80.   		PKCS12err(PKCS12_F_PKCS12_PACK_SAFEBAG, ERR_R_MALLOC_FAILURE);
  81.   		return NULL;

crypto/pkcs12/p12_sbag.c:154:2: Call
    152.   	ret->type=NULL;
    153.   	ret->value.other=NULL;
    154.   	M_ASN1_New(ret->attrib, sk_new_null);
            ^
    155.   	ret->rest=NULL;
    156.   	return (ret);

crypto/stack/stack.c:124:26: Array declaration
      122.   	if ((ret=(STACK *)Malloc(sizeof(STACK))) == NULL)
      123.   		goto err0;
      124.   	if ((ret->data=(char **)Malloc(sizeof(char *)*MIN_NODES)) == NULL)
                                      ^
      125.   		goto err1;
      126.   	for (i=0; i<MIN_NODES; i++)

crypto/stack/stack.c:124:7: Assignment
      122.   	if ((ret=(STACK *)Malloc(sizeof(STACK))) == NULL)
      123.   		goto err0;
      124.   	if ((ret->data=(char **)Malloc(sizeof(char *)*MIN_NODES)) == NULL)
                   ^
      125.   		goto err1;
      126.   	for (i=0; i<MIN_NODES; i++)

crypto/pkcs12/p12_crt.c:109:8: Call
107.   			tcert = (X509 *)sk_value(ca, i);
108.   			if(!(bag = M_PKCS12_x5092certbag(tcert))) return NULL;
109.   			if(!sk_push(bags, (char *)bag)) {
              ^
110.   				PKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE);
111.   				return NULL;

crypto/stack/stack.c:239:1: Parameter `*st->data`
  237.   	}
  238.   
  239. > int sk_push(STACK *st, char *data)
  240.   	{
  241.   	return(sk_insert(st,data,st->num));

crypto/stack/stack.c:241:9: Call
  239.   int sk_push(STACK *st, char *data)
  240.   	{
  241.   	return(sk_insert(st,data,st->num));
                 ^
  242.   	}
  243.   

crypto/stack/stack.c:139:1: Parameter `*st->data`
    137.   	}
    138.   
    139. > int sk_insert(STACK *st, char *data, int loc)
    140.   	{
    141.   	char **s;

crypto/pkcs12/p12_crt.c:119:2: Call
117.   	authsafe = PKCS12_pack_p7encdata (nid_cert, pass, -1, NULL, 0,
118.   					  iter, bags);
119.   	sk_pop_free(bags, PKCS12_SAFEBAG_free);
        ^
120.   
121.   	if (!authsafe) return NULL;

crypto/stack/stack.c:271:1: <Offset trace>
269.   	}
270.   
271. > void sk_pop_free(STACK *st, void (*func)())
272.   	{
273.   	int i;

crypto/stack/stack.c:271:1: Parameter `st->num`
  269.   	}
  270.   
  271. > void sk_pop_free(STACK *st, void (*func)())
  272.   	{
  273.   	int i;

crypto/stack/stack.c:271:1: <Length trace>
269.   	}
270.   
271. > void sk_pop_free(STACK *st, void (*func)())
272.   	{
273.   	int i;

crypto/stack/stack.c:271:1: Parameter `*st->data`
  269.   	}
  270.   
  271. > void sk_pop_free(STACK *st, void (*func)())
  272.   	{
  273.   	int i;

crypto/stack/stack.c:277:7: Array access: Offset: [0, 3] Size: [0, +oo] by call to `sk_pop_free` 
  275.   	if (st == NULL) return;
  276.   	for (i=0; i<st->num; i++)
  277.   		if (st->data[i] != NULL)
               ^
  278.   			func(st->data[i]);
  279.   	sk_free(st);
