apps/pkcs12.c:474: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, +oo] by call to `PKCS12_decrypt_d2i`.
Showing all 14 steps of the trace


apps/pkcs12.c:474:11: Call
472.   					p7->d.encrypted->enc_data->algorithm);
473.   			}
474.   			bags = M_PKCS12_unpack_p7encdata (p7, pass, passlen);
                 ^
475.   		} else continue;
476.   		if (!bags) return 0;

crypto/pkcs12/p12_decr.c:109:1: Parameter `oct->length`
  107.    */
  108.   
  109. > char * PKCS12_decrypt_d2i (X509_ALGOR *algor, char * (*d2i)(),
  110.   	     void (*free_func)(), const char *pass, int passlen,
  111.   	     ASN1_OCTET_STRING *oct, int seq)

crypto/pkcs12/p12_decr.c:117:7: Call
  115.   	int outlen;
  116.   
  117.   	if (!PKCS12_pbe_crypt (algor, pass, passlen, oct->data, oct->length,
               ^
  118.   			       &out, &outlen, 0)) {
  119.   		PKCS12err(PKCS12_F_PKCS12_DECRYPT_D2I,PKCS12_R_PKCS12_PBE_CRYPT_ERROR);

crypto/pkcs12/p12_decr.c:71:1: Parameter `**data`
    69.    */
    70.   
    71. > unsigned char * PKCS12_pbe_crypt (X509_ALGOR *algor, const char *pass,
    72.   	     int passlen, unsigned char *in, int inlen, unsigned char **data,
    73.   	     int *datalen, int en_de)

crypto/pkcs12/p12_decr.c:122:2: Assignment
  120.   		return NULL;
  121.   	}
  122.   	p = out;
          ^
  123.   #ifdef DEBUG_DECRYPT
  124.   	{

crypto/pkcs12/p12_decr.c:135:30: Call
  133.   	}
  134.   #endif
  135.   	if (seq & 1) ret = (char *) d2i_ASN1_SET(NULL, &p, outlen, d2i,
                                      ^
  136.   				free_func, V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL);
  137.   	else ret = d2i(NULL, &p, outlen);

crypto/asn1/a_set.c:156:1: Parameter `**pp`
    154.           }
    155.   
    156. > STACK *d2i_ASN1_SET(STACK **a, unsigned char **pp, long length,
    157.   	     char *(*func)(), void (*free_func)(), int ex_tag, int ex_class)
    158.   	{

crypto/asn1/a_set.c:167:2: Assignment
    165.   		ret=(*a);
    166.   
    167.   	c.p= *pp;
            ^
    168.   	c.max=(length == 0)?0:(c.p+length);
    169.   

crypto/asn1/a_set.c:170:8: Call
    168.   	c.max=(length == 0)?0:(c.p+length);
    169.   
    170.   	c.inf=ASN1_get_object(&c.p,&c.slen,&c.tag,&c.xclass,c.max-c.p);
                  ^
    171.   	if (c.inf & 0x80) goto err;
    172.   	if (ex_class != c.xclass)

crypto/asn1/asn1_lib.c:89:1: <Length trace>
87.   
88.   
89. > int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
90.   	     long omax)
91.   	{

crypto/asn1/asn1_lib.c:89:1: Parameter `**pp`
      87.   
      88.   
      89. > int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
      90.   	     long omax)
      91.   	{

crypto/asn1/asn1_lib.c:94:2: Assignment
      92.   	int i,ret;
      93.   	long l;
      94.   	unsigned char *p= *pp;
             ^
      95.   	int tag,xclass,inf;
      96.   	long max=omax;

crypto/asn1/asn1_lib.c:104:3: Assignment
      102.   	if (i == V_ASN1_PRIMATIVE_TAG)
      103.   		{		/* high-tag */
      104.   		p++;
               ^
      105.   		if (--max == 0) goto err;
      106.   		l=0;

crypto/asn1/asn1_lib.c:107:10: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `PKCS12_decrypt_d2i` 
      105.   		if (--max == 0) goto err;
      106.   		l=0;
      107.   		while (*p&0x80)
                      ^
      108.   			{
      109.   			l<<=7L;
