ssl/s3_srvr.c:1412: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, +oo] by call to `X509_certificate_type`.
Showing all 23 steps of the trace


ssl/s3_srvr.c:1411:8: Call
1409.   		{
1410.   		peer=s->session->peer;
1411.   		pkey=X509_get_pubkey(peer);
               ^
1412.   		type=X509_certificate_type(peer,pkey);
1413.   		}

crypto/x509/x509_cmp.c:241:9: Call
  239.   	if ((x == NULL) || (x->cert_info == NULL))
  240.   		return(NULL);
  241.   	return(X509_PUBKEY_get(x->cert_info->key));
                 ^
  242.   	}
  243.   

crypto/asn1/x_pubkey.c:239:9: Call
    237.   			p=a->parameter->value.sequence->data;
    238.   			j=a->parameter->value.sequence->length;
    239.   			if (!d2i_DSAparams(&ret->pkey.dsa,&p,(long)j))
                   ^
    240.   				goto err;
    241.   			}

crypto/asn1/d2i_dsap.c:75:2: Call
      73.   	M_ASN1_D2I_Init();
      74.   	M_ASN1_D2I_start_sequence();
      75.   	M_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);
             ^
      76.   	if ((ret->p=BN_bin2bn(bs->data,bs->length,ret->p)) == NULL) goto err_bn;
      77.   	M_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);

crypto/asn1/a_int.c:114:1: Parameter `*(*a)->data`
        112.   	}
        113.   
        114. > ASN1_INTEGER *d2i_ASN1_INTEGER(ASN1_INTEGER **a, unsigned char **pp,
        115.   	     long length)
        116.   	{

ssl/s3_srvr.c:1412:8: Call
1410.   		peer=s->session->peer;
1411.   		pkey=X509_get_pubkey(peer);
1412.   		type=X509_certificate_type(peer,pkey);
               ^
1413.   		}
1414.   	else

crypto/x509/x509type.c:65:1: Parameter `*x->cert_info->key->algor->parameter->value.sequence->data`
  63.   #include <openssl/x509.h>
  64.   
  65. > int X509_certificate_type(X509 *x, EVP_PKEY *pkey)
  66.   	{
  67.   	EVP_PKEY *pk;

crypto/x509/x509type.c:73:6: Call
  71.   
  72.   	if (pkey == NULL)
  73.   		pk=X509_get_pubkey(x);
             ^
  74.   	else
  75.   		pk=pkey;

crypto/x509/x509_cmp.c:237:1: Parameter `*x->cert_info->key->algor->parameter->value.sequence->data`
    235.   	}
    236.   
    237. > EVP_PKEY *X509_get_pubkey(X509 *x)
    238.   	{
    239.   	if ((x == NULL) || (x->cert_info == NULL))

crypto/x509/x509_cmp.c:241:9: Call
    239.   	if ((x == NULL) || (x->cert_info == NULL))
    240.   		return(NULL);
    241.   	return(X509_PUBKEY_get(x->cert_info->key));
                   ^
    242.   	}
    243.   

crypto/asn1/x_pubkey.c:200:1: Parameter `*key->algor->parameter->value.sequence->data`
      198.   	}
      199.   
      200. > EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)
      201.   	{
      202.   	EVP_PKEY *ret=NULL;

crypto/asn1/x_pubkey.c:237:4: Assignment
      235.   			{
      236.   			ret->pkey.dsa->write_params=0;
      237.   			p=a->parameter->value.sequence->data;
                ^
      238.   			j=a->parameter->value.sequence->length;
      239.   			if (!d2i_DSAparams(&ret->pkey.dsa,&p,(long)j))

crypto/asn1/x_pubkey.c:239:9: Call
      237.   			p=a->parameter->value.sequence->data;
      238.   			j=a->parameter->value.sequence->length;
      239.   			if (!d2i_DSAparams(&ret->pkey.dsa,&p,(long)j))
                     ^
      240.   				goto err;
      241.   			}

crypto/asn1/d2i_dsap.c:67:1: Parameter `**pp`
        65.   #include <openssl/asn1_mac.h>
        66.   
        67. > DSA *d2i_DSAparams(DSA **a, unsigned char **pp, long length)
        68.   	{
        69.   	int i=ERR_R_NESTED_ASN1_ERROR;

crypto/asn1/d2i_dsap.c:73:2: Assignment
        71.   	M_ASN1_D2I_vars(a,DSA *,DSA_new);
        72.   
        73.   	M_ASN1_D2I_Init();
               ^
        74.   	M_ASN1_D2I_start_sequence();
        75.   	M_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);

crypto/asn1/d2i_dsap.c:74:2: Call
        72.   
        73.   	M_ASN1_D2I_Init();
        74.   	M_ASN1_D2I_start_sequence();
               ^
        75.   	M_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);
        76.   	if ((ret->p=BN_bin2bn(bs->data,bs->length,ret->p)) == NULL) goto err_bn;

crypto/asn1/asn1_lib.c:277:1: Parameter `*c->p`
          275.   	}
          276.   
          277. > int asn1_GetSequence(ASN1_CTX *c, long *length)
          278.   	{
          279.   	unsigned char *q;

crypto/asn1/asn1_lib.c:282:9: Call
          280.   
          281.   	q=c->p;
          282.   	c->inf=ASN1_get_object(&(c->p),&(c->slen),&(c->tag),&(c->xclass),
                         ^
          283.   		*length);
          284.   	if (c->inf & 0x80)

crypto/asn1/asn1_lib.c:83:1: <Length trace>
81.   
82.   
83. > int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
84.   	     long omax)
85.   	{

crypto/asn1/asn1_lib.c:83:1: Parameter `**pp`
            81.   
            82.   
            83. > int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
            84.   	     long omax)
            85.   	{

crypto/asn1/asn1_lib.c:88:2: Assignment
            86.   	int i,ret;
            87.   	long l;
            88.   	unsigned char *p= *pp;
                   ^
            89.   	int tag,xclass,inf;
            90.   	long max=omax;

crypto/asn1/asn1_lib.c:98:3: Assignment
            96.   	if (i == V_ASN1_PRIMATIVE_TAG)
            97.   		{		/* high-tag */
            98.   		p++;
                     ^
            99.   		if (--max == 0) goto err;
            100.   		l=0;

crypto/asn1/asn1_lib.c:101:10: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `X509_certificate_type` 
            99.   		if (--max == 0) goto err;
            100.   		l=0;
            101.   		while (*p&0x80)
                            ^
            102.   			{
            103.   			l<<=7L;
