crypto/x509v3/v3_cpols.c:134: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] Size: [1, +oo] by call to `OBJ_txt2obj`.
Showing all 15 steps of the trace


crypto/x509v3/v3_cpols.c:112:10: Call
110.   	int i;
111.   	pols = sk_POLICYINFO_new_null();
112.   	vals =  X509V3_parse_list(value);
                ^
113.   	for(i = 0; i < sk_num(vals); i++) {
114.   		cnf = (CONF_VALUE *)sk_value(vals, i);

crypto/x509v3/v3_utl.c:238:12: Call
  236.   			} else if(c == ',') {
  237.   				*p = 0;
  238.   				ntmp = strip_spaces(q);
                    ^
  239.   				q = p + 1;
  240.   #ifdef DEBUG

crypto/x509v3/v3_utl.c:303:1: Parameter `name->strlen`
    301.   
    302.   /* Delete leading and trailing spaces from a string */
    303. > static char *strip_spaces(char *name)
    304.   {
    305.   	char *p, *q;

crypto/x509v3/v3_utl.c:247:5: Call
  245.   					goto err;
  246.   				}
  247.   				X509V3_add_value(ntmp, NULL, &values);
             ^
  248.   			}
  249.   			break ;

crypto/x509v3/v3_utl.c:74:2: Assignment
    72.   {
    73.   	CONF_VALUE *vtmp = NULL;
    74.   	char *tname = NULL, *tvalue = NULL;
           ^
    75.   	if(name && !(tname = BUF_strdup(name))) goto err;
    76.   	if(value && !(tvalue = BUF_strdup(value))) goto err;;

crypto/x509v3/v3_utl.c:80:2: Assignment
    78.   	if(!*extlist && !(*extlist = sk_new(NULL))) goto err;
    79.   	vtmp->section = NULL;
    80.   	vtmp->name = tname;
           ^
    81.   	vtmp->value = tvalue;
    82.   	if(!sk_push(*extlist, (char *)vtmp)) goto err;

crypto/x509v3/v3_cpols.c:134:16: Call
132.   			if(!pol) goto err;
133.   		} else {
134.   			if(!(pobj = OBJ_txt2obj(cnf->name, 0))) {
                      ^
135.   				X509V3err(X509V3_F_R2I_CERTPOL,X509V3_R_INVALID_OBJECT_IDENTIFIER);
136.   				X509V3_conf_err(cnf);

crypto/objects/obj_dat.c:391:1: Parameter `*s`
  389.    */
  390.   
  391. > ASN1_OBJECT *OBJ_txt2obj(const char *s, int no_name)
  392.   	{
  393.   	int nid = NID_undef;

crypto/objects/obj_dat.c:405:4: Call
  403.   
  404.   	/* Work out size of content octets */
  405.   	i=a2d_ASN1_OBJECT(NULL,0,s,-1);
            ^
  406.   	if (i <= 0) {
  407.   		/* Clear the error */

crypto/asn1/a_object.c:88:1: <Length trace>
86.   	}
87.   
88. > int a2d_ASN1_OBJECT(unsigned char *out, int olen, const char *buf, int num)
89.   	{
90.   	int i,first,len=0,c;

crypto/asn1/a_object.c:88:1: Parameter `*buf`
    86.   	}
    87.   
    88. > int a2d_ASN1_OBJECT(unsigned char *out, int olen, const char *buf, int num)
    89.   	{
    90.   	int i,first,len=0,c;

crypto/asn1/a_object.c:100:2: Assignment
    98.   		num=strlen(buf);
    99.   
    100.   	p=buf;
            ^
    101.   	c= *(p++);
    102.   	num--;

crypto/asn1/a_object.c:101:7: Assignment
    99.   
    100.   	p=buf;
    101.   	c= *(p++);
                 ^
    102.   	num--;
    103.   	if ((c >= '0') && (c <= '2'))

crypto/asn1/a_object.c:118:7: Assignment
    116.   		goto err;
    117.   		}
    118.   	c= *(p++);
                 ^
    119.   	num--;
    120.   	for (;;)

crypto/asn1/a_object.c:133:7: Array access: Offset: [2, +oo] Size: [1, +oo] by call to `OBJ_txt2obj` 
    131.   			if (num <= 0) break;
    132.   			num--;
    133.   			c= *(p++);
                 ^
    134.   			if ((c == ' ') || (c == '.'))
    135.   				break;
