apps/ca.c:1300: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, +oo] by call to `X509_REQ_get_pubkey`.
Showing all 22 steps of the trace


apps/ca.c:1296:3: Call
1294.   		}
1295.   	if (verbose)
1296.   		X509_REQ_print(bio_err,req);
          ^
1297.   
1298.   	BIO_printf(bio_err,"Check that the request matches the signature\n");

crypto/asn1/t_req.c:118:7: Call
  116.   	if (BIO_puts(bp,str) <= 0) goto err;
  117.   
  118.   	pkey=X509_REQ_get_pubkey(x);
               ^
  119.   #ifndef NO_RSA
  120.   	if (pkey->type == EVP_PKEY_RSA)

crypto/x509/x509_req.c:113:9: Call
    111.   	if ((req == NULL) || (req->req_info == NULL))
    112.   		return(NULL);
    113.   	return(X509_PUBKEY_get(req->req_info->pubkey));
                   ^
    114.   	}
    115.   

crypto/asn1/x_pubkey.c:239:9: Call
      237.   			p=a->parameter->value.sequence->data;
      238.   			j=a->parameter->value.sequence->length;
      239.   			if (!d2i_DSAparams(&ret->pkey.dsa,&p,(long)j))
                     ^
      240.   				goto err;
      241.   			}

crypto/asn1/d2i_dsap.c:75:2: Call
        73.   	M_ASN1_D2I_Init();
        74.   	M_ASN1_D2I_start_sequence();
        75.   	M_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);
               ^
        76.   	if ((ret->p=BN_bin2bn(bs->data,bs->length,ret->p)) == NULL) goto err_bn;
        77.   	M_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);

crypto/asn1/a_int.c:114:1: Parameter `*(*a)->data`
          112.   	}
          113.   
          114. > ASN1_INTEGER *d2i_ASN1_INTEGER(ASN1_INTEGER **a, unsigned char **pp,
          115.   	     long length)
          116.   	{

apps/ca.c:1300:13: Call
1298.   	BIO_printf(bio_err,"Check that the request matches the signature\n");
1299.   
1300.   	if ((pktmp=X509_REQ_get_pubkey(req)) == NULL)
                    ^
1301.   		{
1302.   		BIO_printf(bio_err,"error unpacking public key\n");

crypto/x509/x509_req.c:109:1: Parameter `*req->req_info->pubkey->algor->parameter->value.sequence->data`
  107.   	}
  108.   
  109. > EVP_PKEY *X509_REQ_get_pubkey(X509_REQ *req)
  110.   	{
  111.   	if ((req == NULL) || (req->req_info == NULL))

crypto/x509/x509_req.c:113:9: Call
  111.   	if ((req == NULL) || (req->req_info == NULL))
  112.   		return(NULL);
  113.   	return(X509_PUBKEY_get(req->req_info->pubkey));
                 ^
  114.   	}
  115.   

crypto/asn1/x_pubkey.c:200:1: Parameter `*key->algor->parameter->value.sequence->data`
    198.   	}
    199.   
    200. > EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)
    201.   	{
    202.   	EVP_PKEY *ret=NULL;

crypto/asn1/x_pubkey.c:237:4: Assignment
    235.   			{
    236.   			ret->pkey.dsa->write_params=0;
    237.   			p=a->parameter->value.sequence->data;
              ^
    238.   			j=a->parameter->value.sequence->length;
    239.   			if (!d2i_DSAparams(&ret->pkey.dsa,&p,(long)j))

crypto/asn1/x_pubkey.c:239:9: Call
    237.   			p=a->parameter->value.sequence->data;
    238.   			j=a->parameter->value.sequence->length;
    239.   			if (!d2i_DSAparams(&ret->pkey.dsa,&p,(long)j))
                   ^
    240.   				goto err;
    241.   			}

crypto/asn1/d2i_dsap.c:67:1: Parameter `**pp`
      65.   #include <openssl/asn1_mac.h>
      66.   
      67. > DSA *d2i_DSAparams(DSA **a, unsigned char **pp, long length)
      68.   	{
      69.   	int i=ERR_R_NESTED_ASN1_ERROR;

crypto/asn1/d2i_dsap.c:73:2: Assignment
      71.   	M_ASN1_D2I_vars(a,DSA *,DSA_new);
      72.   
      73.   	M_ASN1_D2I_Init();
             ^
      74.   	M_ASN1_D2I_start_sequence();
      75.   	M_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);

crypto/asn1/d2i_dsap.c:74:2: Call
      72.   
      73.   	M_ASN1_D2I_Init();
      74.   	M_ASN1_D2I_start_sequence();
             ^
      75.   	M_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);
      76.   	if ((ret->p=BN_bin2bn(bs->data,bs->length,ret->p)) == NULL) goto err_bn;

crypto/asn1/asn1_lib.c:277:1: Parameter `*c->p`
        275.   	}
        276.   
        277. > int asn1_GetSequence(ASN1_CTX *c, long *length)
        278.   	{
        279.   	unsigned char *q;

crypto/asn1/asn1_lib.c:282:9: Call
        280.   
        281.   	q=c->p;
        282.   	c->inf=ASN1_get_object(&(c->p),&(c->slen),&(c->tag),&(c->xclass),
                       ^
        283.   		*length);
        284.   	if (c->inf & 0x80)

crypto/asn1/asn1_lib.c:83:1: <Length trace>
81.   
82.   
83. > int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
84.   	     long omax)
85.   	{

crypto/asn1/asn1_lib.c:83:1: Parameter `**pp`
          81.   
          82.   
          83. > int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
          84.   	     long omax)
          85.   	{

crypto/asn1/asn1_lib.c:88:2: Assignment
          86.   	int i,ret;
          87.   	long l;
          88.   	unsigned char *p= *pp;
                 ^
          89.   	int tag,xclass,inf;
          90.   	long max=omax;

crypto/asn1/asn1_lib.c:98:3: Assignment
          96.   	if (i == V_ASN1_PRIMATIVE_TAG)
          97.   		{		/* high-tag */
          98.   		p++;
                   ^
          99.   		if (--max == 0) goto err;
          100.   		l=0;

crypto/asn1/asn1_lib.c:101:10: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `X509_REQ_get_pubkey` 
          99.   		if (--max == 0) goto err;
          100.   		l=0;
          101.   		while (*p&0x80)
                          ^
          102.   			{
          103.   			l<<=7L;
