crypto/objects/obj_dat.c:460: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] (⇐ [0, +oo] + -1) Size: [3, +oo] by call to `d2i_ASN1_OBJECT`.
Showing all 23 steps of the trace


crypto/objects/obj_dat.c:439:9: Call
437.   
438.       /* Work out size of content octets */
439.       i = a2d_ASN1_OBJECT(NULL, 0, s, -1);
               ^
440.       if (i <= 0) {
441.           /* Don't clear the error */

crypto/asn1/a_object.c:100:9: Assignment
  98.   
  99.       if (num == 0)
  100.           return (0);
                 ^
  101.       else if (num == -1)
  102.           num = strlen(buf);

crypto/objects/obj_dat.c:439:5: Assignment
437.   
438.       /* Work out size of content octets */
439.       i = a2d_ASN1_OBJECT(NULL, 0, s, -1);
           ^
440.       if (i <= 0) {
441.           /* Don't clear the error */

crypto/objects/obj_dat.c:448:9: Call
446.       }
447.       /* Work out total size */
448.       j = ASN1_object_size(0, i, V_ASN1_OBJECT);
               ^
449.   
450.       if ((buf = OPENSSL_malloc(j)) == NULL)

crypto/asn1/asn1_lib.c:256:1: Parameter `length`
  254.   }
  255.   
  256. > int ASN1_object_size(int constructed, int length, int tag)
  257.   {
  258.       int ret;

crypto/asn1/asn1_lib.c:260:5: Assignment
  258.       int ret;
  259.   
  260.       ret = length;
             ^
  261.       ret++;
  262.       if (tag >= 31) {

crypto/asn1/asn1_lib.c:261:5: Assignment
  259.   
  260.       ret = length;
  261.       ret++;
             ^
  262.       if (tag >= 31) {
  263.           while (tag > 0) {

crypto/asn1/asn1_lib.c:269:9: Assignment
  267.       }
  268.       if (constructed == 2)
  269.           return ret + 3;
                 ^
  270.       ret++;
  271.       if (length > 127) {

crypto/objects/obj_dat.c:448:5: Assignment
446.       }
447.       /* Work out total size */
448.       j = ASN1_object_size(0, i, V_ASN1_OBJECT);
           ^
449.   
450.       if ((buf = OPENSSL_malloc(j)) == NULL)

crypto/objects/obj_dat.c:450:16: Call
448.       j = ASN1_object_size(0, i, V_ASN1_OBJECT);
449.   
450.       if ((buf = OPENSSL_malloc(j)) == NULL)
                      ^
451.           return NULL;
452.   

crypto/mem.c:125:9: Assignment
  123.   
  124.       if (num <= 0)
  125.           return NULL;
                 ^
  126.   
  127.       allow_customize = 0;

crypto/objects/obj_dat.c:450:10: Assignment
448.       j = ASN1_object_size(0, i, V_ASN1_OBJECT);
449.   
450.       if ((buf = OPENSSL_malloc(j)) == NULL)
                ^
451.           return NULL;
452.   

crypto/objects/obj_dat.c:459:5: Assignment
457.       a2d_ASN1_OBJECT(p, i, s, -1);
458.   
459.       cp = buf;
           ^
460.       op = d2i_ASN1_OBJECT(NULL, &cp, j);
461.       OPENSSL_free(buf);

crypto/objects/obj_dat.c:460:10: Call
458.   
459.       cp = buf;
460.       op = d2i_ASN1_OBJECT(NULL, &cp, j);
                ^
461.       OPENSSL_free(buf);
462.       return op;

crypto/asn1/a_object.c:243:1: Parameter `**pp`
  241.   }
  242.   
  243. > ASN1_OBJECT *d2i_ASN1_OBJECT(ASN1_OBJECT **a, const unsigned char **pp,
  244.                                long length)
  245.   {

crypto/asn1/a_object.c:251:5: Assignment
  249.       int inf, i;
  250.       ASN1_OBJECT *ret = NULL;
  251.       p = *pp;
             ^
  252.       inf = ASN1_get_object(&p, &len, &tag, &xclass, length);
  253.       if (inf & 0x80) {

crypto/asn1/a_object.c:252:11: Call
  250.       ASN1_OBJECT *ret = NULL;
  251.       p = *pp;
  252.       inf = ASN1_get_object(&p, &len, &tag, &xclass, length);
                   ^
  253.       if (inf & 0x80) {
  254.           i = ASN1_R_BAD_OBJECT_HEADER;

crypto/asn1/asn1_lib.c:92:1: Parameter `**pp`
    90.   }
    91.   
    92. > int ASN1_get_object(const unsigned char **pp, long *plength, int *ptag,
    93.                       int *pclass, long omax)
    94.   {

crypto/asn1/a_object.c:262:11: Call
  260.           goto err;
  261.       }
  262.       ret = c2i_ASN1_OBJECT(a, &p, len);
                   ^
  263.       if (ret)
  264.           *pp = p;

crypto/asn1/a_object.c:271:1: <Length trace>
269.   }
270.   
271. > ASN1_OBJECT *c2i_ASN1_OBJECT(ASN1_OBJECT **a, const unsigned char **pp,
272.                                long len)
273.   {

crypto/asn1/a_object.c:271:1: Parameter `**pp`
    269.   }
    270.   
    271. > ASN1_OBJECT *c2i_ASN1_OBJECT(ASN1_OBJECT **a, const unsigned char **pp,
    272.                                long len)
    273.   {

crypto/asn1/a_object.c:284:53: Assignment
    282.        * see: X.690 8.19.2
    283.        */
    284.       if (len <= 0 || len > INT_MAX || pp == NULL || (p = *pp) == NULL ||
                                                               ^
    285.           p[len - 1] & 0x80) {
    286.           ASN1err(ASN1_F_C2I_ASN1_OBJECT, ASN1_R_INVALID_OBJECT_ENCODING);

crypto/asn1/a_object.c:315:36: Array access: Offset: [-1, +oo] (⇐ [0, +oo] + -1) Size: [3, +oo] by call to `d2i_ASN1_OBJECT` 
    313.       }
    314.       for (i = 0; i < length; i++, p++) {
    315.           if (*p == 0x80 && (!i || !(p[-1] & 0x80))) {
                                              ^
    316.               ASN1err(ASN1_F_C2I_ASN1_OBJECT, ASN1_R_INVALID_OBJECT_ENCODING);
    317.               return NULL;
