crypto/x509/x509_vfy.c:478: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, +oo] by call to `X509_get_pubkey`.
Showing all 21 steps of the trace


crypto/x509/x509_vfy.c:478:8: Call
476.   	for (i=0; i<sk_num(chain); i++)
477.   		{
478.   		ktmp=X509_get_pubkey((X509 *)sk_value(chain,i));
              ^
479.   		if (ktmp == NULL)
480.   			{

crypto/x509/x509_cmp.c:241:9: Call
  239.   	if ((x == NULL) || (x->cert_info == NULL))
  240.   		return(NULL);
  241.   	return(X509_PUBKEY_get(x->cert_info->key));
                 ^
  242.   	}
  243.   

crypto/asn1/x_pubkey.c:244:9: Call
    242.   			p=a->parameter->value.sequence->data;
    243.   			j=a->parameter->value.sequence->length;
    244.   			if (!d2i_DSAparams(&ret->pkey.dsa,&p,(long)j))
                   ^
    245.   				goto err;
    246.   			}

crypto/asn1/d2i_dsap.c:79:2: Call
      77.   	M_ASN1_D2I_Init();
      78.   	M_ASN1_D2I_start_sequence();
      79.   	M_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);
             ^
      80.   	if ((ret->p=BN_bin2bn(bs->data,bs->length,ret->p)) == NULL) goto err_bn;
      81.   	M_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);

crypto/asn1/a_int.c:117:1: Parameter `*(*a)->data`
        115.   	}
        116.   
        117. > ASN1_INTEGER *d2i_ASN1_INTEGER(ASN1_INTEGER **a, unsigned char **pp,
        118.   	     long length)
        119.   	{

crypto/x509/x509_vfy.c:478:8: Call
476.   	for (i=0; i<sk_num(chain); i++)
477.   		{
478.   		ktmp=X509_get_pubkey((X509 *)sk_value(chain,i));
              ^
479.   		if (ktmp == NULL)
480.   			{

crypto/x509/x509_cmp.c:237:1: Parameter `*x->cert_info->key->algor->parameter->value.sequence->data`
  235.   	}
  236.   
  237. > EVP_PKEY *X509_get_pubkey(X509 *x)
  238.   	{
  239.   	if ((x == NULL) || (x->cert_info == NULL))

crypto/x509/x509_cmp.c:241:9: Call
  239.   	if ((x == NULL) || (x->cert_info == NULL))
  240.   		return(NULL);
  241.   	return(X509_PUBKEY_get(x->cert_info->key));
                 ^
  242.   	}
  243.   

crypto/asn1/x_pubkey.c:205:1: Parameter `*key->algor->parameter->value.sequence->data`
    203.   	}
    204.   
    205. > EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)
    206.   	{
    207.   	EVP_PKEY *ret=NULL;

crypto/asn1/x_pubkey.c:242:4: Assignment
    240.   			{
    241.   			ret->pkey.dsa->write_params=0;
    242.   			p=a->parameter->value.sequence->data;
              ^
    243.   			j=a->parameter->value.sequence->length;
    244.   			if (!d2i_DSAparams(&ret->pkey.dsa,&p,(long)j))

crypto/asn1/x_pubkey.c:244:9: Call
    242.   			p=a->parameter->value.sequence->data;
    243.   			j=a->parameter->value.sequence->length;
    244.   			if (!d2i_DSAparams(&ret->pkey.dsa,&p,(long)j))
                   ^
    245.   				goto err;
    246.   			}

crypto/asn1/d2i_dsap.c:71:1: Parameter `**pp`
      69.    */
      70.   
      71. > DSA *d2i_DSAparams(DSA **a, unsigned char **pp, long length)
      72.   	{
      73.   	int i=ERR_R_NESTED_ASN1_ERROR;

crypto/asn1/d2i_dsap.c:77:2: Assignment
      75.   	M_ASN1_D2I_vars(a,DSA *,DSA_new);
      76.   
      77.   	M_ASN1_D2I_Init();
             ^
      78.   	M_ASN1_D2I_start_sequence();
      79.   	M_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);

crypto/asn1/d2i_dsap.c:78:2: Call
      76.   
      77.   	M_ASN1_D2I_Init();
      78.   	M_ASN1_D2I_start_sequence();
             ^
      79.   	M_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);
      80.   	if ((ret->p=BN_bin2bn(bs->data,bs->length,ret->p)) == NULL) goto err_bn;

crypto/asn1/asn1_lib.c:283:1: Parameter `*c->p`
        281.   	}
        282.   
        283. > int asn1_GetSequence(ASN1_CTX *c, long *length)
        284.   	{
        285.   	unsigned char *q;

crypto/asn1/asn1_lib.c:288:9: Call
        286.   
        287.   	q=c->p;
        288.   	c->inf=ASN1_get_object(&(c->p),&(c->slen),&(c->tag),&(c->xclass),
                       ^
        289.   		*length);
        290.   	if (c->inf & 0x80)

crypto/asn1/asn1_lib.c:89:1: <Length trace>
87.   
88.   
89. > int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
90.   	     long omax)
91.   	{

crypto/asn1/asn1_lib.c:89:1: Parameter `**pp`
          87.   
          88.   
          89. > int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
          90.   	     long omax)
          91.   	{

crypto/asn1/asn1_lib.c:94:2: Assignment
          92.   	int i,ret;
          93.   	long l;
          94.   	unsigned char *p= *pp;
                 ^
          95.   	int tag,xclass,inf;
          96.   	long max=omax;

crypto/asn1/asn1_lib.c:104:3: Assignment
          102.   	if (i == V_ASN1_PRIMATIVE_TAG)
          103.   		{		/* high-tag */
          104.   		p++;
                   ^
          105.   		if (--max == 0) goto err;
          106.   		l=0;

crypto/asn1/asn1_lib.c:107:10: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `X509_get_pubkey` 
          105.   		if (--max == 0) goto err;
          106.   		l=0;
          107.   		while (*p&0x80)
                          ^
          108.   			{
          109.   			l<<=7L;
