crypto/cms/cms_env.c:866: error: BUFFER_OVERRUN_L3
  Offset: 6 Size: [1, +oo] by call to `CMS_RecipientInfo_encrypt`.
Showing all 13 steps of the trace


crypto/cms/cms_env.c:866:13: Call
864.       for (i = 0; i < sk_CMS_RecipientInfo_num(rinfos); i++) {
865.           ri = sk_CMS_RecipientInfo_value(rinfos, i);
866.           if (CMS_RecipientInfo_encrypt(cms, ri) <= 0) {
                   ^
867.               CMSerr(CMS_F_CMS_ENVELOPEDDATA_INIT_BIO,
868.                      CMS_R_ERROR_SETTING_RECIPIENTINFO);

crypto/cms/cms_env.c:757:1: Parameter `ri->d.pwri->encryptedKey->length`
  755.   }
  756.   
  757. > int CMS_RecipientInfo_encrypt(CMS_ContentInfo *cms, CMS_RecipientInfo *ri)
  758.   {
  759.       switch (ri->type) {

crypto/cms/cms_env.c:866:13: Call
864.       for (i = 0; i < sk_CMS_RecipientInfo_num(rinfos); i++) {
865.           ri = sk_CMS_RecipientInfo_value(rinfos, i);
866.           if (CMS_RecipientInfo_encrypt(cms, ri) <= 0) {
                   ^
867.               CMSerr(CMS_F_CMS_ENVELOPEDDATA_INIT_BIO,
868.                      CMS_R_ERROR_SETTING_RECIPIENTINFO);

crypto/cms/cms_env.c:757:1: Parameter `ri->d.pwri->encryptedKey->length`
  755.   }
  756.   
  757. > int CMS_RecipientInfo_encrypt(CMS_ContentInfo *cms, CMS_RecipientInfo *ri)
  758.   {
  759.       switch (ri->type) {

crypto/cms/cms_env.c:770:16: Call
  768.   
  769.       case CMS_RECIPINFO_PASS:
  770.           return cms_RecipientInfo_pwri_crypt(cms, ri, 1);
                        ^
  771.   
  772.       default:

crypto/cms/cms_pwri.c:275:1: Parameter `ri->d.pwri->encryptedKey->length`
    273.   /* Encrypt/Decrypt content key in PWRI recipient info */
    274.   
    275. > int cms_RecipientInfo_pwri_crypt(CMS_ContentInfo *cms, CMS_RecipientInfo *ri,
    276.                                    int en_de)
    277.   {

crypto/cms/cms_pwri.c:368:14: Call
    366.               goto err;
    367.           }
    368.           if (!kek_unwrap_key(key, &keylen,
                        ^
    369.                               pwri->encryptedKey->data,
    370.                               pwri->encryptedKey->length, kekctx)) {

crypto/cms/cms_pwri.c:176:1: <Length trace>
174.    */
175.   
176. > static int kek_unwrap_key(unsigned char *out, size_t *outlen,
177.                             const unsigned char *in, size_t inlen,
178.                             EVP_CIPHER_CTX *ctx)

crypto/cms/cms_pwri.c:176:1: Parameter `inlen`
      174.    */
      175.   
      176. > static int kek_unwrap_key(unsigned char *out, size_t *outlen,
      177.                             const unsigned char *in, size_t inlen,
      178.                             EVP_CIPHER_CTX *ctx)

crypto/cms/cms_pwri.c:191:11: Call
      189.           return 0;
      190.       }
      191.       tmp = OPENSSL_malloc(inlen);
                       ^
      192.       if (tmp == NULL)
      193.           return 0;

crypto/mem.c:166:9: Assignment
        164.   
        165.       if (num == 0)
        166.           return NULL;
                       ^
        167.   
        168.       FAILTEST();

crypto/cms/cms_pwri.c:191:5: Assignment
      189.           return 0;
      190.       }
      191.       tmp = OPENSSL_malloc(inlen);
                 ^
      192.       if (tmp == NULL)
      193.           return 0;

crypto/cms/cms_pwri.c:213:60: Array access: Offset: 6 Size: [1, +oo] by call to `CMS_RecipientInfo_encrypt` 
      211.           goto err;
      212.       /* Check check bytes */
      213.       if (((tmp[1] ^ tmp[4]) & (tmp[2] ^ tmp[5]) & (tmp[3] ^ tmp[6])) != 0xff) {
                                                                        ^
      214.           /* Check byte failure */
      215.           goto err;
