crypto/pkcs12/p12_crt.c:154: error: BUFFER_OVERRUN_L3
  Offset: [0, 7] Size: [0, 8] by call to `PKCS12_set_mac`.
Showing all 13 steps of the trace


crypto/pkcs12/p12_crt.c:154:6: Call
152.   	sk_pop_free(safes, PKCS7_free);
153.   
154.   	if(!PKCS12_set_mac (p12, pass, -1, NULL, 0, mac_iter, NULL)) return NULL;
            ^
155.   
156.   	return p12;

crypto/pkcs12/p12_mutl.c:117:1: Parameter `saltlen`
  115.   /* Set a mac */
  116.   
  117. > int PKCS12_set_mac (PKCS12 *p12, unsigned char *pass, int passlen,
  118.   	     unsigned char *salt, int saltlen, int iter, EVP_MD *md_type)
  119.   {

crypto/pkcs12/p12_mutl.c:123:6: Call
  121.   	int maclen;
  122.   	if (!md_type) md_type = EVP_sha1();
  123.   	if (PKCS12_setup_mac (p12, iter, salt, saltlen, md_type) ==
              ^
  124.   				 	PKCS12_ERROR) {
  125.   		PKCS12err(PKCS12_F_PKCS12_SET_MAC, PKCS12_R_MAC_SETUP_ERROR);

crypto/pkcs12/p12_mutl.c:140:1: Parameter `saltlen`
    138.   
    139.   /* Set up a mac structure */
    140. > int PKCS12_setup_mac (PKCS12 *p12, int iter, unsigned char *salt, int saltlen,
    141.   	     EVP_MD *md_type)
    142.   {

crypto/pkcs12/p12_mutl.c:152:2: Assignment
    150.   	}
    151.   	if (!saltlen) saltlen = PKCS12_SALT_LEN;
    152.   	p12->mac->salt->length = saltlen;
            ^
    153.   	if (!(p12->mac->salt->data = Malloc (saltlen))) {
    154.   		PKCS12err(PKCS12_F_PKCS12_SETUP_MAC, ERR_R_MALLOC_FAILURE);

crypto/pkcs12/p12_mutl.c:128:7: Call
  126.   		return 0;
  127.   	}
  128.   	if (!PKCS12_gen_mac (p12, pass, passlen, mac, &maclen)) {
               ^
  129.   		PKCS12err(PKCS12_F_PKCS12_SET_MAC, PKCS12_R_MAC_GENERATION_ERROR);
  130.   		return 0;

crypto/pkcs12/p12_mutl.c:66:1: Parameter `*p12->mac->iter->data`
    64.   
    65.   /* Generate a MAC */
    66. > int PKCS12_gen_mac (PKCS12 *p12, unsigned char *pass, int passlen,
    67.   	     unsigned char *mac, unsigned int *maclen)
    68.   {

crypto/pkcs12/p12_mutl.c:76:14: Call
    74.   	saltlen = p12->mac->salt->length;
    75.   	if (!p12->mac->iter) iter = 1;
    76.   	else iter = ASN1_INTEGER_get (p12->mac->iter);
                       ^
    77.       	if(!(md_type =
    78.   		 EVP_get_digestbyobj (p12->mac->dinfo->algor->algorithm))) {

crypto/asn1/a_int.c:233:1: <Offset trace>
231.   	}
232.   
233. > long ASN1_INTEGER_get(ASN1_INTEGER *a)
234.   	{
235.   	int neg=0,i;

crypto/asn1/a_int.c:233:1: Parameter `a->length`
      231.   	}
      232.   
      233. > long ASN1_INTEGER_get(ASN1_INTEGER *a)
      234.   	{
      235.   	int neg=0,i;

crypto/asn1/a_int.c:233:1: <Length trace>
231.   	}
232.   
233. > long ASN1_INTEGER_get(ASN1_INTEGER *a)
234.   	{
235.   	int neg=0,i;

crypto/asn1/a_int.c:233:1: Parameter `*a->data`
      231.   	}
      232.   
      233. > long ASN1_INTEGER_get(ASN1_INTEGER *a)
      234.   	{
      235.   	int neg=0,i;

crypto/asn1/a_int.c:256:21: Array access: Offset: [0, 7] Size: [0, 8] by call to `PKCS12_set_mac` 
      254.   		{
      255.   		r<<=8;
      256.   		r|=(unsigned char)a->data[i];
                                 ^
      257.   		}
      258.   	if (neg) r= -r;
