crypto/x509/x509spki.c:92: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] Size: [1, +oo] by call to `EVP_DecodeBlock`.
Showing all 10 steps of the trace


crypto/x509/x509spki.c:80:1: Parameter `len`
78.   /* Load a Netscape SPKI from a base64 encoded string */
79.   
80. > NETSCAPE_SPKI *NETSCAPE_SPKI_b64_decode(const char *str, int len)
81.   {
82.       unsigned char *spki_der;

crypto/x509/x509spki.c:88:21: Call
86.       if (len <= 0)
87.           len = strlen(str);
88.       if ((spki_der = OPENSSL_malloc(len + 1)) == NULL) {
                          ^
89.           X509err(X509_F_NETSCAPE_SPKI_B64_DECODE, ERR_R_MALLOC_FAILURE);
90.           return NULL;

crypto/mem.c:125:9: Assignment
  123.   
  124.       if (num <= 0)
  125.           return NULL;
                 ^
  126.   
  127.       allow_customize = 0;

crypto/x509/x509spki.c:88:10: Assignment
86.       if (len <= 0)
87.           len = strlen(str);
88.       if ((spki_der = OPENSSL_malloc(len + 1)) == NULL) {
               ^
89.           X509err(X509_F_NETSCAPE_SPKI_B64_DECODE, ERR_R_MALLOC_FAILURE);
90.           return NULL;

crypto/x509/x509spki.c:92:16: Call
90.           return NULL;
91.       }
92.       spki_len = EVP_DecodeBlock(spki_der, (const unsigned char *)str, len);
                     ^
93.       if (spki_len < 0) {
94.           X509err(X509_F_NETSCAPE_SPKI_B64_DECODE, X509_R_BASE64_DECODE_ERROR);

crypto/evp/encode.c:384:1: <Length trace>
382.   }
383.   
384. > int EVP_DecodeBlock(unsigned char *t, const unsigned char *f, int n)
385.   {
386.       int i, ret = 0, a, b, c, d;

crypto/evp/encode.c:384:1: Parameter `*t`
  382.   }
  383.   
  384. > int EVP_DecodeBlock(unsigned char *t, const unsigned char *f, int n)
  385.   {
  386.       int i, ret = 0, a, b, c, d;

crypto/evp/encode.c:415:11: Assignment
  413.                (((unsigned long)b) << 12L) |
  414.                (((unsigned long)c) << 6L) | (((unsigned long)d)));
  415.           *(t++) = (unsigned char)(l >> 16L) & 0xff;
                   ^
  416.           *(t++) = (unsigned char)(l >> 8L) & 0xff;
  417.           *(t++) = (unsigned char)(l) & 0xff;

crypto/evp/encode.c:416:11: Assignment
  414.                (((unsigned long)c) << 6L) | (((unsigned long)d)));
  415.           *(t++) = (unsigned char)(l >> 16L) & 0xff;
  416.           *(t++) = (unsigned char)(l >> 8L) & 0xff;
                   ^
  417.           *(t++) = (unsigned char)(l) & 0xff;
  418.           ret += 3;

crypto/evp/encode.c:417:9: Array access: Offset: [2, +oo] Size: [1, +oo] by call to `EVP_DecodeBlock` 
  415.           *(t++) = (unsigned char)(l >> 16L) & 0xff;
  416.           *(t++) = (unsigned char)(l >> 8L) & 0xff;
  417.           *(t++) = (unsigned char)(l) & 0xff;
                 ^
  418.           ret += 3;
  419.       }
