crypto/asn1/a_d2i_fp.c:70: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] Size: [1, 2147483644] by call to `ASN1_item_d2i`.
Showing all 26 steps of the trace


crypto/asn1/a_d2i_fp.c:65:11: Call
63.       int len;
64.   
65.       len = asn1_d2i_read_bio(in, &b);
                ^
66.       if (len < 0)
67.           goto err;

crypto/asn1/a_d2i_fp.c:120:38: Call
  118.               want -= (len - off);
  119.   
  120.               if (len + want < len || !BUF_MEM_grow_clean(b, len + want)) {
                                              ^
  121.                   ASN1err(ASN1_F_ASN1_D2I_READ_BIO, ERR_R_MALLOC_FAILURE);
  122.                   goto err;

crypto/buffer/buffer.c:109:1: Parameter `*str->data`
    107.   }
    108.   
    109. > size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
    110.   {
    111.       char *ret;

crypto/asn1/a_d2i_fp.c:69:5: Assignment
67.           goto err;
68.   
69.       p = (const unsigned char *)b->data;
          ^
70.       ret = ASN1_item_d2i(x, &p, len, it);
71.    err:

crypto/asn1/a_d2i_fp.c:70:11: Call
68.   
69.       p = (const unsigned char *)b->data;
70.       ret = ASN1_item_d2i(x, &p, len, it);
                ^
71.    err:
72.       BUF_MEM_free(b);

crypto/asn1/tasn_dec.c:95:1: Parameter `**in`
  93.    */
  94.   
  95. > ASN1_VALUE *ASN1_item_d2i(ASN1_VALUE **pval,
  96.                             const unsigned char **in, long len,
  97.                             const ASN1_ITEM *it)

crypto/asn1/tasn_dec.c:104:9: Call
  102.           pval = &ptmpval;
  103.       asn1_tlc_clear_nc(&c);
  104.       if (ASN1_item_ex_d2i(pval, in, len, it, -1, 0, 0, &c) > 0)
                 ^
  105.           return *pval;
  106.       return NULL;

crypto/asn1/tasn_dec.c:109:1: Parameter `**in`
    107.   }
    108.   
    109. > int ASN1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in, long len,
    110.                        const ASN1_ITEM *it,
    111.                        int tag, int aclass, char opt, ASN1_TLC *ctx)

crypto/asn1/tasn_dec.c:114:10: Call
    112.   {
    113.       int rv;
    114.       rv = asn1_item_embed_d2i(pval, in, len, it, tag, aclass, opt, ctx);
                    ^
    115.       if (rv <= 0)
    116.           ASN1_item_ex_free(pval, it);

crypto/asn1/tasn_dec.c:125:1: Parameter `**in`
      123.    */
      124.   
      125. > static int asn1_item_embed_d2i(ASN1_VALUE **pval, const unsigned char **in,
      126.                                  long len, const ASN1_ITEM *it,
      127.                                  int tag, int aclass, char opt, ASN1_TLC *ctx)

crypto/asn1/tasn_dec.c:162:20: Call
      160.                   goto err;
      161.               }
      162.               return asn1_template_ex_d2i(pval, in, len,
                                ^
      163.                                           it->templates, opt, ctx);
      164.           }

crypto/asn1/tasn_dec.c:420:1: Parameter `**in`
        418.    */
        419.   
        420. > static int asn1_template_ex_d2i(ASN1_VALUE **val,
        421.                                   const unsigned char **in, long inlen,
        422.                                   const ASN1_TEMPLATE *tt, char opt,

crypto/asn1/tasn_dec.c:435:5: Assignment
        433.       aclass = flags & ASN1_TFLG_TAG_CLASS;
        434.   
        435.       p = *in;
                   ^
        436.   
        437.       /* Check if EXPLICIT tag expected */

crypto/asn1/tasn_dec.c:444:15: Call
        442.            * where it starts: so read in EXPLICIT header to get the info.
        443.            */
        444.           ret = asn1_check_tlen(&len, NULL, NULL, &exp_eoc, &cst,
                             ^
        445.                                 &p, inlen, tt->tag, aclass, opt, ctx);
        446.           q = p;

crypto/asn1/tasn_dec.c:1060:1: Parameter `**in`
          1058.    */
          1059.   
          1060. > static int asn1_check_tlen(long *olen, int *otag, unsigned char *oclass,
          1061.                              char *inf, char *cst,
          1062.                              const unsigned char **in, long len,

crypto/asn1/tasn_dec.c:1069:5: Assignment
          1067.       long plen;
          1068.       const unsigned char *p, *q;
          1069.       p = *in;
                      ^
          1070.       q = p;
          1071.   

crypto/asn1/tasn_dec.c:1079:13: Call
          1077.           p += ctx->hdrlen;
          1078.       } else {
          1079.           i = ASN1_get_object(&p, &plen, &ptag, &pclass, len);
                              ^
          1080.           if (ctx) {
          1081.               ctx->ret = i;

crypto/asn1/asn1_lib.c:43:1: Parameter `**pp`
            41.   }
            42.   
            43. > int ASN1_get_object(const unsigned char **pp, long *plength, int *ptag,
            44.                       int *pclass, long omax)
            45.   {

crypto/asn1/asn1_lib.c:48:5: Assignment
            46.       int i, ret;
            47.       long l;
            48.       const unsigned char *p = *pp;
                      ^
            49.       int tag, xclass, inf;
            50.       long max = omax;

crypto/asn1/asn1_lib.c:77:9: Assignment
            75.       } else {
            76.           tag = i;
            77.           p++;
                          ^
            78.           if (--max == 0)
            79.               goto err;

crypto/asn1/asn1_lib.c:83:10: Call
            81.       *ptag = tag;
            82.       *pclass = xclass;
            83.       if (!asn1_get_length(&p, &inf, plength, max))
                           ^
            84.           goto err;
            85.   

crypto/asn1/asn1_lib.c:104:1: <Length trace>
102.   }
103.   
104. > static int asn1_get_length(const unsigned char **pp, int *inf, long *rl,
105.                              long max)
106.   {

crypto/asn1/asn1_lib.c:104:1: Parameter `**pp`
              102.   }
              103.   
              104. > static int asn1_get_length(const unsigned char **pp, int *inf, long *rl,
              105.                              long max)
              106.   {

crypto/asn1/asn1_lib.c:107:5: Assignment
              105.                              long max)
              106.   {
              107.       const unsigned char *p = *pp;
                         ^
              108.       unsigned long ret = 0;
              109.       unsigned long i;

crypto/asn1/asn1_lib.c:120:15: Assignment
              118.           *inf = 0;
              119.           i = *p & 0x7f;
              120.           if (*(p++) & 0x80) {
                                   ^
              121.               if (max < (long)i + 1)
              122.                   return 0;

crypto/asn1/asn1_lib.c:124:25: Array access: Offset: [2, +oo] Size: [1, 2147483644] by call to `ASN1_item_d2i` 
              122.                   return 0;
              123.               /* Skip leading zeroes */
              124.               while (i && *p == 0) {
                                             ^
              125.                   p++;
              126.                   i--;
