crypto/asn1/tasn_dec.c:764: error: BUFFER_OVERRUN_L3
  Offset added: [0, 2147483644] Size: [1, 2147483644] by call to `asn1_collect`.
Showing all 15 steps of the trace


crypto/asn1/tasn_dec.c:756:9: Assignment
754.           }
755.           buf.length = 0;
756.           buf.max = 0;
               ^
757.           buf.data = NULL;
758.           /*

crypto/asn1/tasn_dec.c:764:14: Call
762.            * So instead just check for UNIVERSAL class and ignore the tag.
763.            */
764.           if (!asn1_collect(&buf, &p, plen, inf, -1, V_ASN1_UNIVERSAL, 0)) {
                    ^
765.               free_cont = 1;
766.               goto err;

crypto/asn1/tasn_dec.c:1004:1: Parameter `buf->max`
  1002.   #endif
  1003.   
  1004. > static int asn1_collect(BUF_MEM *buf, const unsigned char **in, long len,
  1005.                           char inf, int tag, int aclass, int depth)
  1006.   {

crypto/asn1/tasn_dec.c:1049:29: Call
  1047.               if (!asn1_collect(buf, &p, plen, ininf, tag, aclass, depth + 1))
  1048.                   return 0;
  1049.           } else if (plen && !collect_data(buf, &p, plen))
                                      ^
  1050.               return 0;
  1051.           len -= p - q;

crypto/asn1/tasn_dec.c:1061:1: Parameter `buf->max`
    1059.   }
    1060.   
    1061. > static int collect_data(BUF_MEM *buf, const unsigned char **p, long plen)
    1062.   {
    1063.       int len;

crypto/asn1/tasn_dec.c:1066:14: Call
    1064.       if (buf) {
    1065.           len = buf->length;
    1066.           if (!BUF_MEM_grow_clean(buf, len + plen)) {
                         ^
    1067.               ASN1err(ASN1_F_COLLECT_DATA, ERR_R_MALLOC_FAILURE);
    1068.               return 0;

crypto/buffer/buffer.c:158:1: Parameter `len`
      156.   }
      157.   
      158. > size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
      159.   {
      160.       char *ret;

crypto/buffer/buffer.c:182:15: Call
      180.           ret = sec_alloc_realloc(str, n);
      181.       else
      182.           ret = OPENSSL_clear_realloc(str->data, str->max, n);
                           ^
      183.       if (ret == NULL) {
      184.           BUFerr(BUF_F_BUF_MEM_GROW_CLEAN, ERR_R_MALLOC_FAILURE);

crypto/mem.c:193:1: <Offset trace>
191.   }
192.   
193. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
194.                              const char *file, int line)
195.   {

crypto/mem.c:193:1: Parameter `num`
        191.   }
        192.   
        193. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
        194.                              const char *file, int line)
        195.   {

crypto/mem.c:193:1: <Length trace>
191.   }
192.   
193. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
194.                              const char *file, int line)
195.   {

crypto/mem.c:193:1: Parameter `num`
        191.   }
        192.   
        193. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
        194.                              const char *file, int line)
        195.   {

crypto/mem.c:225:11: Array declaration
        223.       (void)file;
        224.       (void)line;
        225.       ret = malloc(num);
                         ^
        226.   #endif
        227.   

crypto/mem.c:225:5: Assignment
        223.       (void)file;
        224.       (void)line;
        225.       ret = malloc(num);
                   ^
        226.   #endif
        227.   

crypto/mem.c:229:9: Array access: Offset added: [0, 2147483644] Size: [1, 2147483644] by call to `asn1_collect` 
        227.   
        228.       if (ret)
        229.           memcpy(ret, str, old_len);
                       ^
        230.       CRYPTO_clear_free(str, old_len);
        231.       return ret;
