crypto/pkcs12/p12_kiss.c:162: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] (⇐ [0, +oo] + 1) Size: [0, +oo] by call to `parse_bag`.
Showing all 15 steps of the trace


crypto/pkcs12/p12_kiss.c:162:8: Call
160.   	int i;
161.   	for (i = 0; i < sk_num (bags); i++) {
162.   		if (!parse_bag ((PKCS12_SAFEBAG *)sk_value (bags, i),
              ^
163.   			 pass, passlen, pkey, cert, ca, keyid,
164.   							 keymatch)) return 0;

crypto/pkcs12/p12_kiss.c:173:1: Parameter `bag->value.shkeybag->digest->length`
  171.   #define MATCH_ALL  0x3
  172.   
  173. > static int parse_bag (PKCS12_SAFEBAG *bag, const char *pass, int passlen,
  174.   		      EVP_PKEY **pkey, X509 **cert, STACK **ca,
  175.   		      ASN1_OCTET_STRING **keyid,

crypto/pkcs12/p12_kiss.c:209:14: Call
  207.   	case NID_pkcs8ShroudedKeyBag:
  208.   		if (!lkey || !pkey) return 1;	
  209.   		if (!(p8 = M_PKCS12_decrypt_skey (bag, pass, passlen)))
                      ^
  210.   				return 0;
  211.   		*pkey = EVP_PKCS82PKEY (p8);

crypto/pkcs12/p12_decr.c:109:1: Parameter `oct->length`
    107.    */
    108.   
    109. > char * PKCS12_decrypt_d2i (X509_ALGOR *algor, char * (*d2i)(),
    110.   	     void (*free_func)(), const char *pass, int passlen,
    111.   	     ASN1_OCTET_STRING *oct, int seq)

crypto/pkcs12/p12_decr.c:117:7: Call
    115.   	int outlen;
    116.   
    117.   	if (!PKCS12_pbe_crypt (algor, pass, passlen, oct->data, oct->length,
                 ^
    118.   			       &out, &outlen, 0)) {
    119.   		PKCS12err(PKCS12_F_PKCS12_DECRYPT_D2I,PKCS12_R_PKCS12_PBE_CRYPT_ERROR);

crypto/pkcs12/p12_decr.c:71:1: Parameter `**data`
      69.    */
      70.   
      71. > unsigned char * PKCS12_pbe_crypt (X509_ALGOR *algor, const char *pass,
      72.   	     int passlen, unsigned char *in, int inlen, unsigned char **data,
      73.   	     int *datalen, int en_de)

crypto/pkcs12/p12_decr.c:122:2: Assignment
    120.   		return NULL;
    121.   	}
    122.   	p = out;
            ^
    123.   #ifdef DEBUG_DECRYPT
    124.   	{

crypto/pkcs12/p12_decr.c:135:30: Call
    133.   	}
    134.   #endif
    135.   	if (seq & 1) ret = (char *) d2i_ASN1_SET(NULL, &p, outlen, d2i,
                                        ^
    136.   				free_func, V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL);
    137.   	else ret = d2i(NULL, &p, outlen);

crypto/asn1/a_set.c:154:1: Parameter `length`
      152.           }
      153.   
      154. > STACK *d2i_ASN1_SET(STACK **a, unsigned char **pp, long length,
      155.   	     char *(*func)(), void (*free_func)(), int ex_tag, int ex_class)
      156.   	{

crypto/asn1/a_set.c:188:3: Assignment
      186.   	 * as the amount of data passed to us */
      187.   	if (c.inf == (V_ASN1_CONSTRUCTED+1))
      188.   		c.slen=length+ *pp-c.p;
               ^
      189.   	c.max=c.p+c.slen;
      190.   

crypto/asn1/a_set.c:189:2: Assignment
      187.   	if (c.inf == (V_ASN1_CONSTRUCTED+1))
      188.   		c.slen=length+ *pp-c.p;
      189.   	c.max=c.p+c.slen;
              ^
      190.   
      191.   	while (c.p < c.max)

crypto/asn1/a_set.c:195:7: Call
      193.   		char *s;
      194.   
      195.   		if (M_ASN1_D2I_end_sequence()) break;
                   ^
      196.   		if ((s=func(NULL,&c.p,c.slen,c.max-c.p)) == NULL)
      197.   			{

crypto/asn1/asn1_lib.c:68:1: <Length trace>
66.   const char *ASN1_version="ASN.1" OPENSSL_VERSION_PTEXT;
67.   
68. > int ASN1_check_infinite_end(unsigned char **p, long len)
69.   	{
70.   	/* If there is 0 or 1 byte left, the length check should pick

crypto/asn1/asn1_lib.c:68:1: Parameter `**p`
        66.   const char *ASN1_version="ASN.1" OPENSSL_VERSION_PTEXT;
        67.   
        68. > int ASN1_check_infinite_end(unsigned char **p, long len)
        69.   	{
        70.   	/* If there is 0 or 1 byte left, the length check should pick

crypto/asn1/asn1_lib.c:74:44: Array access: Offset: [1, +oo] (⇐ [0, +oo] + 1) Size: [0, +oo] by call to `parse_bag` 
        72.   	if (len <= 0)
        73.   		return(1);
        74.   	else if ((len >= 2) && ((*p)[0] == 0) && ((*p)[1] == 0))
                                                         ^
        75.   		{
        76.   		(*p)+=2;
