crypto/rsa/rsa_eay.c:116: error: BUFFER_OVERRUN_L3
  Offset: 1 Size: [0, +oo] by call to `RSA_padding_add_PKCS1_type_2`.
Showing all 11 steps of the trace


crypto/rsa/rsa_eay.c:106:6: Call
104.   	BN_init(&ret);
105.   	if ((ctx=BN_CTX_new()) == NULL) goto err;
106.   	num=BN_num_bytes(rsa->n);
            ^
107.   	if ((buf=(unsigned char *)Malloc(num)) == NULL)
108.   		{

crypto/bn/bn_lib.c:245:19: Assignment
  243.   	bn_check_top(a);
  244.   
  245.   	if (a->top == 0) return(0);
                           ^
  246.   	l=a->d[a->top-1];
  247.   	i=(a->top-1)*BN_BITS2;

crypto/rsa/rsa_eay.c:106:2: Assignment
104.   	BN_init(&ret);
105.   	if ((ctx=BN_CTX_new()) == NULL) goto err;
106.   	num=BN_num_bytes(rsa->n);
        ^
107.   	if ((buf=(unsigned char *)Malloc(num)) == NULL)
108.   		{

crypto/rsa/rsa_eay.c:107:28: Array declaration
105.   	if ((ctx=BN_CTX_new()) == NULL) goto err;
106.   	num=BN_num_bytes(rsa->n);
107.   	if ((buf=(unsigned char *)Malloc(num)) == NULL)
                                  ^
108.   		{
109.   		RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT,ERR_R_MALLOC_FAILURE);

crypto/rsa/rsa_eay.c:107:7: Assignment
105.   	if ((ctx=BN_CTX_new()) == NULL) goto err;
106.   	num=BN_num_bytes(rsa->n);
107.   	if ((buf=(unsigned char *)Malloc(num)) == NULL)
             ^
108.   		{
109.   		RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT,ERR_R_MALLOC_FAILURE);

crypto/rsa/rsa_eay.c:116:5: Call
114.   		{
115.   	case RSA_PKCS1_PADDING:
116.   		i=RSA_padding_add_PKCS1_type_2(buf,num,from,flen);
           ^
117.   		break;
118.   #ifndef NO_SHA

crypto/rsa/rsa_pk1.c:138:1: <Length trace>
136.   	}
137.   
138. > int RSA_padding_add_PKCS1_type_2(unsigned char *to, int tlen,
139.   	     unsigned char *from, int flen)
140.   	{

crypto/rsa/rsa_pk1.c:138:1: Parameter `*to`
  136.   	}
  137.   
  138. > int RSA_padding_add_PKCS1_type_2(unsigned char *to, int tlen,
  139.   	     unsigned char *from, int flen)
  140.   	{

crypto/rsa/rsa_pk1.c:150:2: Assignment
  148.   		}
  149.   	
  150.   	p=(unsigned char *)to;
          ^
  151.   
  152.   	*(p++)=0;

crypto/rsa/rsa_pk1.c:152:4: Assignment
  150.   	p=(unsigned char *)to;
  151.   
  152.   	*(p++)=0;
            ^
  153.   	*(p++)=2; /* Public Key BT (Block Type) */
  154.   

crypto/rsa/rsa_pk1.c:153:2: Array access: Offset: 1 Size: [0, +oo] by call to `RSA_padding_add_PKCS1_type_2` 
  151.   
  152.   	*(p++)=0;
  153.   	*(p++)=2; /* Public Key BT (Block Type) */
          ^
  154.   
  155.   	/* pad out with non-zero random data */
