ssl/ssl_asn1.c:217: error: BUFFER_OVERRUN_L3
  Offset: [0, 7] Size: [0, +oo] by call to `ASN1_INTEGER_get`.
Showing all 8 steps of the trace


ssl/ssl_asn1.c:216:2: Call
214.   
215.   	ai.data=NULL; ai.length=0;
216.   	M_ASN1_D2I_get(aip,d2i_ASN1_INTEGER);
        ^
217.   	version=(int)ASN1_INTEGER_get(aip);
218.   	if (ai.data != NULL) { Free(ai.data); ai.data=NULL; ai.length=0; }

crypto/asn1/a_int.c:117:1: Parameter `*(*a)->data`
  115.   	}
  116.   
  117. > ASN1_INTEGER *d2i_ASN1_INTEGER(ASN1_INTEGER **a, unsigned char **pp,
  118.   	     long length)
  119.   	{

ssl/ssl_asn1.c:217:15: Call
215.   	ai.data=NULL; ai.length=0;
216.   	M_ASN1_D2I_get(aip,d2i_ASN1_INTEGER);
217.   	version=(int)ASN1_INTEGER_get(aip);
                     ^
218.   	if (ai.data != NULL) { Free(ai.data); ai.data=NULL; ai.length=0; }
219.   

crypto/asn1/a_int.c:233:1: <Offset trace>
231.   	}
232.   
233. > long ASN1_INTEGER_get(ASN1_INTEGER *a)
234.   	{
235.   	int neg=0,i;

crypto/asn1/a_int.c:233:1: Parameter `a->length`
  231.   	}
  232.   
  233. > long ASN1_INTEGER_get(ASN1_INTEGER *a)
  234.   	{
  235.   	int neg=0,i;

crypto/asn1/a_int.c:233:1: <Length trace>
231.   	}
232.   
233. > long ASN1_INTEGER_get(ASN1_INTEGER *a)
234.   	{
235.   	int neg=0,i;

crypto/asn1/a_int.c:233:1: Parameter `*a->data`
  231.   	}
  232.   
  233. > long ASN1_INTEGER_get(ASN1_INTEGER *a)
  234.   	{
  235.   	int neg=0,i;

crypto/asn1/a_int.c:256:21: Array access: Offset: [0, 7] Size: [0, +oo] by call to `ASN1_INTEGER_get` 
  254.   		{
  255.   		r<<=8;
  256.   		r|=(unsigned char)a->data[i];
                             ^
  257.   		}
  258.   	if (neg) r= -r;
