crypto/rsa/rsa_sign.c:110: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, +oo] by call to `i2d_X509_SIG`.
Showing all 15 steps of the trace


crypto/rsa/rsa_sign.c:96:4: Call
94.   	sig.digest->length=m_len;
95.   
96.   	i=i2d_X509_SIG(&sig,NULL);
         ^
97.   	j=RSA_size(rsa);
98.   	if ((i-RSA_PKCS1_PADDING) > j)

crypto/asn1/x_sig.c:66:2: Assignment
  64.   int i2d_X509_SIG(X509_SIG *a, unsigned char **pp)
  65.   	{
  66.   	M_ASN1_I2D_vars(a);
         ^
  67.   
  68.   	M_ASN1_I2D_len(a->algor,	i2d_X509_ALGOR);

crypto/rsa/rsa_sign.c:96:2: Assignment
94.   	sig.digest->length=m_len;
95.   
96.   	i=i2d_X509_SIG(&sig,NULL);
       ^
97.   	j=RSA_size(rsa);
98.   	if ((i-RSA_PKCS1_PADDING) > j)

crypto/rsa/rsa_sign.c:103:21: Array declaration
101.   		return(0);
102.   		}
103.   	s=(unsigned char *)Malloc((unsigned int)j+1);
                           ^
104.   	if (s == NULL)
105.   		{

crypto/rsa/rsa_sign.c:103:2: Assignment
101.   		return(0);
102.   		}
103.   	s=(unsigned char *)Malloc((unsigned int)j+1);
        ^
104.   	if (s == NULL)
105.   		{

crypto/rsa/rsa_sign.c:109:2: Assignment
107.   		return(0);
108.   		}
109.   	p=s;
        ^
110.   	i2d_X509_SIG(&sig,&p);
111.   	i=RSA_private_encrypt(i,s,sigret,rsa,RSA_PKCS1_PADDING);

crypto/rsa/rsa_sign.c:110:2: Call
108.   		}
109.   	p=s;
110.   	i2d_X509_SIG(&sig,&p);
        ^
111.   	i=RSA_private_encrypt(i,s,sigret,rsa,RSA_PKCS1_PADDING);
112.   	if (i <= 0)

crypto/asn1/x_sig.c:64:1: Parameter `**pp`
  62.   #include <openssl/x509.h>
  63.   
  64. > int i2d_X509_SIG(X509_SIG *a, unsigned char **pp)
  65.   	{
  66.   	M_ASN1_I2D_vars(a);

crypto/asn1/x_sig.c:71:2: Assignment
  69.   	M_ASN1_I2D_len(a->digest,	i2d_ASN1_OCTET_STRING);
  70.   
  71.   	M_ASN1_I2D_seq_total();
         ^
  72.   
  73.   	M_ASN1_I2D_put(a->algor,	i2d_X509_ALGOR);

crypto/asn1/x_sig.c:71:2: Call
  69.   	M_ASN1_I2D_len(a->digest,	i2d_ASN1_OCTET_STRING);
  70.   
  71.   	M_ASN1_I2D_seq_total();
         ^
  72.   
  73.   	M_ASN1_I2D_put(a->algor,	i2d_X509_ALGOR);

crypto/asn1/asn1_lib.c:180:1: <Length trace>
178.   /* class 0 is constructed
179.    * constructed == 2 for indefinitle length constructed */
180. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
181.   	     int xclass)
182.   	{

crypto/asn1/asn1_lib.c:180:1: Parameter `**pp`
    178.   /* class 0 is constructed
    179.    * constructed == 2 for indefinitle length constructed */
    180. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
    181.   	     int xclass)
    182.   	{

crypto/asn1/asn1_lib.c:183:2: Assignment
    181.   	     int xclass)
    182.   	{
    183.   	unsigned char *p= *pp;
            ^
    184.   	int i;
    185.   

crypto/asn1/asn1_lib.c:192:5: Assignment
    190.   	else
    191.   		{
    192.   		*(p++)=i|V_ASN1_PRIMITIVE_TAG;
               ^
    193.   		while (tag > 0x7f)
    194.   			{

crypto/asn1/asn1_lib.c:198:3: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `i2d_X509_SIG` 
    196.   			tag>>=7;
    197.   			}
    198.   		*(p++)=(tag&0x7f);
             ^
    199.   		}
    200.   	if ((constructed == 2) && (length == 0))
