apps/pkeyutl.c:315: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] Size: [1, +oo] by call to `ASN1_parse_dump`.
Showing all 16 steps of the trace


apps/pkeyutl.c:124:5: Assignment
122.       char *infile = NULL, *outfile = NULL, *sigfile = NULL, *passinarg = NULL;
123.       char hexdump = 0, asn1parse = 0, rev = 0, *prog;
124.       unsigned char *buf_in = NULL, *buf_out = NULL, *sig = NULL;
           ^
125.       OPTION_CHOICE o;
126.       int buf_inlen = 0, siglen = -1, keyform = FORMAT_PEM, peerform =

apps/pkeyutl.c:315:14: Call
313.   
314.       if (asn1parse) {
315.           if (!ASN1_parse_dump(out, buf_out, buf_outlen, 1, -1))
                    ^
316.               ERR_print_errors(bio_err);
317.       } else if (hexdump)

crypto/asn1/asn1_par.c:111:1: Parameter `*pp`
  109.   }
  110.   
  111. > int ASN1_parse_dump(BIO *bp, const unsigned char *pp, long len, int indent,
  112.                       int dump)
  113.   {

crypto/asn1/asn1_par.c:114:13: Call
  112.                       int dump)
  113.   {
  114.       return (asn1_parse2(bp, &pp, len, 0, 0, indent, dump));
                     ^
  115.   }
  116.   

crypto/asn1/asn1_par.c:117:1: Parameter `**pp`
    115.   }
    116.   
    117. > static int asn1_parse2(BIO *bp, const unsigned char **pp, long length,
    118.                          int offset, int depth, int indent, int dump)
    119.   {

crypto/asn1/asn1_par.c:135:5: Assignment
    133.   
    134.       dump_indent = 6;            /* Because we know BIO_dump_indent() */
    135.       p = *pp;
               ^
    136.       tot = p + length;
    137.       op = p - 1;

crypto/asn1/asn1_par.c:140:13: Call
    138.       while ((p < tot) && (op < p)) {
    139.           op = p;
    140.           j = ASN1_get_object(&p, &len, &tag, &xclass, length);
                       ^
    141.           if (j & 0x80) {
    142.               if (BIO_write(bp, "Error in encoding\n", 18) <= 0)

crypto/asn1/asn1_lib.c:91:1: Parameter `**pp`
      89.   }
      90.   
      91. > int ASN1_get_object(const unsigned char **pp, long *plength, int *ptag,
      92.                       int *pclass, long omax)
      93.   {

crypto/asn1/asn1_lib.c:96:5: Assignment
      94.       int i, ret;
      95.       long l;
      96.       const unsigned char *p = *pp;
                ^
      97.       int tag, xclass, inf;
      98.       long max = omax;

crypto/asn1/asn1_lib.c:125:9: Assignment
      123.       } else {
      124.           tag = i;
      125.           p++;
                     ^
      126.           if (--max == 0)
      127.               goto err;

crypto/asn1/asn1_lib.c:131:10: Call
      129.       *ptag = tag;
      130.       *pclass = xclass;
      131.       if (!asn1_get_length(&p, &inf, plength, (int)max))
                      ^
      132.           goto err;
      133.   

crypto/asn1/asn1_lib.c:152:1: <Length trace>
150.   }
151.   
152. > static int asn1_get_length(const unsigned char **pp, int *inf, long *rl,
153.                              int max)
154.   {

crypto/asn1/asn1_lib.c:152:1: Parameter `**pp`
        150.   }
        151.   
        152. > static int asn1_get_length(const unsigned char **pp, int *inf, long *rl,
        153.                              int max)
        154.   {

crypto/asn1/asn1_lib.c:155:5: Assignment
        153.                              int max)
        154.   {
        155.       const unsigned char *p = *pp;
                   ^
        156.       unsigned long ret = 0;
        157.       unsigned int i;

crypto/asn1/asn1_lib.c:168:15: Assignment
        166.           *inf = 0;
        167.           i = *p & 0x7f;
        168.           if (*(p++) & 0x80) {
                             ^
        169.               if (max < (int)i)
        170.                   return 0;

crypto/asn1/asn1_lib.c:172:25: Array access: Offset: [2, +oo] Size: [1, +oo] by call to `ASN1_parse_dump` 
        170.                   return 0;
        171.               /* Skip leading zeroes */
        172.               while (i && *p == 0) {
                                       ^
        173.                   p++;
        174.                   i--;
