crypto/pkcs7/pk7_doit.c:410: error: BUFFER_OVERRUN_L3
  Offset: [0, 127] Size: [0, +oo] by call to `RC2_set_key`.
Showing all 11 steps of the trace


crypto/pkcs7/pk7_doit.c:380:6: Call
378.   		}
379.   
380.   		jj=EVP_PKEY_size(pkey);
            ^
381.   		tmp=(unsigned char *)Malloc(jj+10);
382.   		if (tmp == NULL)

crypto/evp/p_lib.c:84:3: Assignment
  82.   	{
  83.   	if (pkey == NULL)
  84.   		return(0);
          ^
  85.   #ifndef NO_RSA
  86.   	if (pkey->type == EVP_PKEY_RSA)

crypto/pkcs7/pk7_doit.c:380:3: Assignment
378.   		}
379.   
380.   		jj=EVP_PKEY_size(pkey);
         ^
381.   		tmp=(unsigned char *)Malloc(jj+10);
382.   		if (tmp == NULL)

crypto/pkcs7/pk7_doit.c:381:24: Array declaration
379.   
380.   		jj=EVP_PKEY_size(pkey);
381.   		tmp=(unsigned char *)Malloc(jj+10);
                              ^
382.   		if (tmp == NULL)
383.   			{

crypto/pkcs7/pk7_doit.c:381:3: Assignment
379.   
380.   		jj=EVP_PKEY_size(pkey);
381.   		tmp=(unsigned char *)Malloc(jj+10);
         ^
382.   		if (tmp == NULL)
383.   			{

crypto/pkcs7/pk7_doit.c:410:15: Call
408.   			 * interface.
409.   			 */
410.   			if(is_rc2) RC2_set_key(&(evp_ctx->c.rc2_ks),jj, tmp,
                     ^
411.   					EVP_CIPHER_CTX_key_length(evp_ctx)*8);
412.   			else {

crypto/rc2/rc2_skey.c:93:1: <Offset trace>
91.    * the same as specifying 1024 for the 'bits' parameter.  Bsafe uses
92.    * a version where the bits parameter is the same as len*8 */
93. > void RC2_set_key(RC2_KEY *key, int len, unsigned char *data, int bits)
94.   	{
95.   	int i,j;

crypto/rc2/rc2_skey.c:93:1: Parameter `len`
  91.    * the same as specifying 1024 for the 'bits' parameter.  Bsafe uses
  92.    * a version where the bits parameter is the same as len*8 */
  93. > void RC2_set_key(RC2_KEY *key, int len, unsigned char *data, int bits)
  94.   	{
  95.   	int i,j;

crypto/rc2/rc2_skey.c:93:1: <Length trace>
91.    * the same as specifying 1024 for the 'bits' parameter.  Bsafe uses
92.    * a version where the bits parameter is the same as len*8 */
93. > void RC2_set_key(RC2_KEY *key, int len, unsigned char *data, int bits)
94.   	{
95.   	int i,j;

crypto/rc2/rc2_skey.c:93:1: Parameter `*data`
  91.    * the same as specifying 1024 for the 'bits' parameter.  Bsafe uses
  92.    * a version where the bits parameter is the same as len*8 */
  93. > void RC2_set_key(RC2_KEY *key, int len, unsigned char *data, int bits)
  94.   	{
  95.   	int i,j;

crypto/rc2/rc2_skey.c:108:8: Array access: Offset: [0, 127] Size: [0, +oo] by call to `RC2_set_key` 
  106.   
  107.   	for (i=0; i<len; i++)
  108.   		k[i]=data[i];
                ^
  109.   
  110.   	/* expand table */
