crypto/pkcs12/p12_npas.c:122: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] (⇐ [0, +oo] + 1) Size: [0, +oo] by call to `alg_get`.
Showing all 27 steps of the trace


crypto/pkcs12/p12_npas.c:136:16: Call
134.   		/* Repack bag in same form with new password */
135.   		if (bagnid == NID_pkcs7_data) p7new = PKCS12_pack_p7data(bags);
136.   		else p7new = PKCS12_pack_p7encdata(pbe_nid, newpass, -1, NULL,
                      ^
137.   						 pbe_saltlen, pbe_iter, bags);
138.   		sk_pop_free(bags, PKCS12_SAFEBAG_free);

crypto/pkcs12/p12_add.c:171:2: Call
  169.   	X509_ALGOR_free(p7->d.encrypted->enc_data->algorithm);
  170.   	p7->d.encrypted->enc_data->algorithm = pbe;
  171.   	M_ASN1_OCTET_STRING_free(p7->d.encrypted->enc_data->enc_data);
          ^
  172.   	if (!(p7->d.encrypted->enc_data->enc_data =
  173.   	PKCS12_i2d_encrypt (pbe, i2d_PKCS12_SAFEBAG, pass, passlen,

crypto/asn1/asn1_lib.c:381:1: Parameter `*a->data`
    379.   	}
    380.   
    381. > void ASN1_STRING_free(ASN1_STRING *a)
    382.   	{
    383.   	if (a == NULL) return;

crypto/pkcs12/p12_npas.c:122:4: Call
120.   		} else if (bagnid == NID_pkcs7_encrypted) {
121.   			bags = M_PKCS12_unpack_p7encdata(p7, oldpass, -1);
122.   			alg_get(p7->d.encrypted->enc_data->algorithm,
          ^
123.   				&pbe_nid, &pbe_iter, &pbe_saltlen);
124.   		} else continue;

crypto/pkcs12/p12_npas.c:201:1: Parameter `*alg->parameter->value.sequence->data`
  199.   }
  200.   
  201. > static int alg_get(X509_ALGOR *alg, int *pnid, int *piter, int *psaltlen)
  202.   {
  203.           PBEPARAM *pbe;

crypto/pkcs12/p12_npas.c:205:9: Assignment
  203.           PBEPARAM *pbe;
  204.           unsigned char *p;
  205.           p = alg->parameter->value.sequence->data;
                 ^
  206.           pbe = d2i_PBEPARAM(NULL, &p, alg->parameter->value.sequence->length);
  207.           *pnid = OBJ_obj2nid(alg->algorithm);

crypto/pkcs12/p12_npas.c:206:15: Call
  204.           unsigned char *p;
  205.           p = alg->parameter->value.sequence->data;
  206.           pbe = d2i_PBEPARAM(NULL, &p, alg->parameter->value.sequence->length);
                       ^
  207.           *pnid = OBJ_obj2nid(alg->algorithm);
  208.   	*piter = ASN1_INTEGER_get(pbe->iter);

crypto/asn1/p5_pbe.c:91:1: Parameter `**pp`
    89.   }
    90.   
    91. > PBEPARAM *d2i_PBEPARAM(PBEPARAM **a, unsigned char **pp, long length)
    92.   {
    93.   	M_ASN1_D2I_vars(a,PBEPARAM *,PBEPARAM_new);

crypto/asn1/p5_pbe.c:94:2: Assignment
    92.   {
    93.   	M_ASN1_D2I_vars(a,PBEPARAM *,PBEPARAM_new);
    94.   	M_ASN1_D2I_Init();
           ^
    95.   	M_ASN1_D2I_start_sequence();
    96.   	M_ASN1_D2I_get (ret->salt, d2i_ASN1_OCTET_STRING);

crypto/asn1/p5_pbe.c:95:2: Call
    93.   	M_ASN1_D2I_vars(a,PBEPARAM *,PBEPARAM_new);
    94.   	M_ASN1_D2I_Init();
    95.   	M_ASN1_D2I_start_sequence();
           ^
    96.   	M_ASN1_D2I_get (ret->salt, d2i_ASN1_OCTET_STRING);
    97.   	M_ASN1_D2I_get (ret->iter, d2i_ASN1_INTEGER);

crypto/asn1/asn1_lib.c:277:1: Parameter `*c->p`
      275.   	}
      276.   
      277. > int asn1_GetSequence(ASN1_CTX *c, long *length)
      278.   	{
      279.   	unsigned char *q;

crypto/asn1/asn1_lib.c:282:9: Call
      280.   
      281.   	q=c->p;
      282.   	c->inf=ASN1_get_object(&(c->p),&(c->slen),&(c->tag),&(c->xclass),
                     ^
      283.   		*length);
      284.   	if (c->inf & 0x80)

crypto/asn1/asn1_lib.c:83:1: Parameter `**pp`
        81.   
        82.   
        83. > int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
        84.   	     long omax)
        85.   	{

crypto/asn1/p5_pbe.c:96:2: Call
    94.   	M_ASN1_D2I_Init();
    95.   	M_ASN1_D2I_start_sequence();
    96.   	M_ASN1_D2I_get (ret->salt, d2i_ASN1_OCTET_STRING);
           ^
    97.   	M_ASN1_D2I_get (ret->iter, d2i_ASN1_INTEGER);
    98.   	M_ASN1_D2I_Finish(a, PBEPARAM_free, ASN1_F_D2I_PBEPARAM);

crypto/asn1/a_octet.c:81:1: Parameter `**pp`
      79.   { return M_i2d_ASN1_OCTET_STRING(a, pp); }
      80.   
      81. > ASN1_OCTET_STRING *d2i_ASN1_OCTET_STRING(ASN1_OCTET_STRING **a,
      82.   	     unsigned char **pp, long length)
      83.   	{

crypto/asn1/a_octet.c:86:27: Call
      84.   	ASN1_OCTET_STRING *ret=NULL;
      85.   
      86.   	ret=(ASN1_OCTET_STRING *)d2i_ASN1_bytes((ASN1_STRING **)a,
                                      ^
      87.   		pp,length,V_ASN1_OCTET_STRING,V_ASN1_UNIVERSAL);
      88.   	if (ret == NULL)

crypto/asn1/a_bytes.c:167:1: Parameter `**pp`
        165.   	}
        166.   
        167. > ASN1_STRING *d2i_ASN1_bytes(ASN1_STRING **a, unsigned char **pp, long length,
        168.   	     int Ptag, int Pclass)
        169.   	{

crypto/asn1/a_bytes.c:183:2: Assignment
        181.   		ret=(*a);
        182.   
        183.   	p= *pp;
                ^
        184.   	inf=ASN1_get_object(&p,&len,&tag,&xclass,length);
        185.   	if (inf & 0x80)

crypto/asn1/a_bytes.c:184:6: Call
        182.   
        183.   	p= *pp;
        184.   	inf=ASN1_get_object(&p,&len,&tag,&xclass,length);
                    ^
        185.   	if (inf & 0x80)
        186.   		{

crypto/asn1/asn1_lib.c:83:1: Parameter `**pp`
          81.   
          82.   
          83. > int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
          84.   	     long omax)
          85.   	{

crypto/asn1/a_bytes.c:202:3: Assignment
        200.   
        201.   		c.pp=pp;
        202.   		c.p=p;
                 ^
        203.   		c.inf=inf;
        204.   		c.slen=len;

crypto/asn1/a_bytes.c:208:8: Call
        206.   		c.xclass=Pclass;
        207.   		c.max=(length == 0)?0:(p+length);
        208.   		if (!asn1_collate_primative(ret,&c)) 
                      ^
        209.   			goto err; 
        210.   		else

crypto/asn1/a_bytes.c:261:1: Parameter `*c->p`
          259.   /* There have been a few bug fixes for this function from
          260.    * Paul Keogh <paul.keogh@sse.ie>, many thanks to him */
          261. > static int asn1_collate_primative(ASN1_STRING *a, ASN1_CTX *c)
          262.   	{
          263.   	ASN1_STRING *os=NULL;

crypto/asn1/a_bytes.c:282:11: Call
          280.   		if (c->inf & 1)
          281.   			{
          282.   			c->eos=ASN1_check_infinite_end(&c->p,
                           ^
          283.   				(long)(c->max-c->p));
          284.   			if (c->eos) break;

crypto/asn1/asn1_lib.c:68:1: <Length trace>
66.   const char *ASN1_version="ASN.1" OPENSSL_VERSION_PTEXT;
67.   
68. > int ASN1_check_infinite_end(unsigned char **p, long len)
69.   	{
70.   	/* If there is 0 or 1 byte left, the length check should pick

crypto/asn1/asn1_lib.c:68:1: Parameter `**p`
            66.   const char *ASN1_version="ASN.1" OPENSSL_VERSION_PTEXT;
            67.   
            68. > int ASN1_check_infinite_end(unsigned char **p, long len)
            69.   	{
            70.   	/* If there is 0 or 1 byte left, the length check should pick

crypto/asn1/asn1_lib.c:74:44: Array access: Offset: [1, +oo] (⇐ [0, +oo] + 1) Size: [0, +oo] by call to `alg_get` 
            72.   	if (len <= 0)
            73.   		return(1);
            74.   	else if ((len >= 2) && ((*p)[0] == 0) && ((*p)[1] == 0))
                                                             ^
            75.   		{
            76.   		(*p)+=2;
