crypto/asn1/tasn_dec.c:724: error: BUFFER_OVERRUN_L3
  Offset added: [0, 2147483644] Size: [1, 2147483644] by call to `asn1_collect`.
Showing all 16 steps of the trace


crypto/asn1/tasn_dec.c:631:19: Assignment
629.       char cst, inf, free_cont = 0;
630.       const unsigned char *p;
631.       BUF_MEM buf = { 0, NULL, 0, 0 };
                         ^
632.       const unsigned char *cont = NULL;
633.       long len;

crypto/asn1/tasn_dec.c:724:14: Call
722.            * So instead just check for UNIVERSAL class and ignore the tag.
723.            */
724.           if (!asn1_collect(&buf, &p, plen, inf, -1, V_ASN1_UNIVERSAL, 0)) {
                    ^
725.               goto err;
726.           }

crypto/asn1/tasn_dec.c:966:1: Parameter `buf->max`
  964.   #endif
  965.   
  966. > static int asn1_collect(BUF_MEM *buf, const unsigned char **in, long len,
  967.                           char inf, int tag, int aclass, int depth)
  968.   {

crypto/asn1/tasn_dec.c:1011:29: Call
  1009.               if (!asn1_collect(buf, &p, plen, ininf, tag, aclass, depth + 1))
  1010.                   return 0;
  1011.           } else if (plen && !collect_data(buf, &p, plen))
                                      ^
  1012.               return 0;
  1013.           len -= p - q;

crypto/asn1/tasn_dec.c:1023:1: Parameter `buf->max`
    1021.   }
    1022.   
    1023. > static int collect_data(BUF_MEM *buf, const unsigned char **p, long plen)
    1024.   {
    1025.       int len;

crypto/asn1/tasn_dec.c:1028:14: Call
    1026.       if (buf) {
    1027.           len = buf->length;
    1028.           if (!BUF_MEM_grow_clean(buf, len + plen)) {
                         ^
    1029.               ASN1err(ASN1_F_COLLECT_DATA, ERR_R_MALLOC_FAILURE);
    1030.               return 0;

crypto/buffer/buffer.c:109:1: Parameter `len`
      107.   }
      108.   
      109. > size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
      110.   {
      111.       char *ret;

crypto/buffer/buffer.c:134:15: Call
      132.           ret = sec_alloc_realloc(str, n);
      133.       else
      134.           ret = OPENSSL_clear_realloc(str->data, str->max, n);
                           ^
      135.       if (ret == NULL) {
      136.           BUFerr(BUF_F_BUF_MEM_GROW_CLEAN, ERR_R_MALLOC_FAILURE);

crypto/mem.c:225:1: <Offset trace>
223.   }
224.   
225. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
226.                              const char *file, int line)
227.   {

crypto/mem.c:225:1: Parameter `num`
        223.   }
        224.   
        225. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
        226.                              const char *file, int line)
        227.   {

crypto/mem.c:225:1: <Length trace>
223.   }
224.   
225. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
226.                              const char *file, int line)
227.   {

crypto/mem.c:225:1: Parameter `num`
        223.   }
        224.   
        225. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
        226.                              const char *file, int line)
        227.   {

crypto/mem.c:244:11: Call
        242.       }
        243.   
        244.       ret = CRYPTO_malloc(num, file, line);
                         ^
        245.       if (ret != NULL) {
        246.           memcpy(ret, str, old_len);

crypto/mem.c:165:9: Assignment
          163.   
          164.       if (num <= 0)
          165.           return NULL;
                         ^
          166.   
          167.       FAILTEST();

crypto/mem.c:244:5: Assignment
        242.       }
        243.   
        244.       ret = CRYPTO_malloc(num, file, line);
                   ^
        245.       if (ret != NULL) {
        246.           memcpy(ret, str, old_len);

crypto/mem.c:246:9: Array access: Offset added: [0, 2147483644] Size: [1, 2147483644] by call to `asn1_collect` 
        244.       ret = CRYPTO_malloc(num, file, line);
        245.       if (ret != NULL) {
        246.           memcpy(ret, str, old_len);
                       ^
        247.           CRYPTO_clear_free(str, old_len, file, line);
        248.       }
