crypto/objects/obj_dat.c:451: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] (⇐ [0, +oo] + -1) Size: [3, +oo] by call to `d2i_ASN1_OBJECT`.
Showing all 23 steps of the trace


crypto/objects/obj_dat.c:430:9: Call
428.   
429.       /* Work out size of content octets */
430.       i = a2d_ASN1_OBJECT(NULL, 0, s, -1);
               ^
431.       if (i <= 0) {
432.           /* Don't clear the error */

crypto/asn1/a_object.c:99:9: Assignment
  97.   
  98.       if (num == 0)
  99.           return (0);
                 ^
  100.       else if (num == -1)
  101.           num = strlen(buf);

crypto/objects/obj_dat.c:430:5: Assignment
428.   
429.       /* Work out size of content octets */
430.       i = a2d_ASN1_OBJECT(NULL, 0, s, -1);
           ^
431.       if (i <= 0) {
432.           /* Don't clear the error */

crypto/objects/obj_dat.c:439:9: Call
437.       }
438.       /* Work out total size */
439.       j = ASN1_object_size(0, i, V_ASN1_OBJECT);
               ^
440.   
441.       if ((buf = OPENSSL_malloc(j)) == NULL)

crypto/asn1/asn1_lib.c:255:1: Parameter `length`
  253.   }
  254.   
  255. > int ASN1_object_size(int constructed, int length, int tag)
  256.   {
  257.       int ret;

crypto/asn1/asn1_lib.c:259:5: Assignment
  257.       int ret;
  258.   
  259.       ret = length;
             ^
  260.       ret++;
  261.       if (tag >= 31) {

crypto/asn1/asn1_lib.c:260:5: Assignment
  258.   
  259.       ret = length;
  260.       ret++;
             ^
  261.       if (tag >= 31) {
  262.           while (tag > 0) {

crypto/asn1/asn1_lib.c:268:9: Assignment
  266.       }
  267.       if (constructed == 2)
  268.           return ret + 3;
                 ^
  269.       ret++;
  270.       if (length > 127) {

crypto/objects/obj_dat.c:439:5: Assignment
437.       }
438.       /* Work out total size */
439.       j = ASN1_object_size(0, i, V_ASN1_OBJECT);
           ^
440.   
441.       if ((buf = OPENSSL_malloc(j)) == NULL)

crypto/objects/obj_dat.c:441:16: Call
439.       j = ASN1_object_size(0, i, V_ASN1_OBJECT);
440.   
441.       if ((buf = OPENSSL_malloc(j)) == NULL)
                      ^
442.           return NULL;
443.   

crypto/mem.c:124:9: Assignment
  122.   
  123.       if (num <= 0)
  124.           return NULL;
                 ^
  125.   
  126.       allow_customize = 0;

crypto/objects/obj_dat.c:441:10: Assignment
439.       j = ASN1_object_size(0, i, V_ASN1_OBJECT);
440.   
441.       if ((buf = OPENSSL_malloc(j)) == NULL)
                ^
442.           return NULL;
443.   

crypto/objects/obj_dat.c:450:5: Assignment
448.       a2d_ASN1_OBJECT(p, i, s, -1);
449.   
450.       cp = buf;
           ^
451.       op = d2i_ASN1_OBJECT(NULL, &cp, j);
452.       OPENSSL_free(buf);

crypto/objects/obj_dat.c:451:10: Call
449.   
450.       cp = buf;
451.       op = d2i_ASN1_OBJECT(NULL, &cp, j);
                ^
452.       OPENSSL_free(buf);
453.       return op;

crypto/asn1/a_object.c:242:1: Parameter `**pp`
  240.   }
  241.   
  242. > ASN1_OBJECT *d2i_ASN1_OBJECT(ASN1_OBJECT **a, const unsigned char **pp,
  243.                                long length)
  244.   {

crypto/asn1/a_object.c:250:5: Assignment
  248.       int inf, i;
  249.       ASN1_OBJECT *ret = NULL;
  250.       p = *pp;
             ^
  251.       inf = ASN1_get_object(&p, &len, &tag, &xclass, length);
  252.       if (inf & 0x80) {

crypto/asn1/a_object.c:251:11: Call
  249.       ASN1_OBJECT *ret = NULL;
  250.       p = *pp;
  251.       inf = ASN1_get_object(&p, &len, &tag, &xclass, length);
                   ^
  252.       if (inf & 0x80) {
  253.           i = ASN1_R_BAD_OBJECT_HEADER;

crypto/asn1/asn1_lib.c:91:1: Parameter `**pp`
    89.   }
    90.   
    91. > int ASN1_get_object(const unsigned char **pp, long *plength, int *ptag,
    92.                       int *pclass, long omax)
    93.   {

crypto/asn1/a_object.c:261:11: Call
  259.           goto err;
  260.       }
  261.       ret = c2i_ASN1_OBJECT(a, &p, len);
                   ^
  262.       if (ret)
  263.           *pp = p;

crypto/asn1/a_object.c:270:1: <Length trace>
268.   }
269.   
270. > ASN1_OBJECT *c2i_ASN1_OBJECT(ASN1_OBJECT **a, const unsigned char **pp,
271.                                long len)
272.   {

crypto/asn1/a_object.c:270:1: Parameter `**pp`
    268.   }
    269.   
    270. > ASN1_OBJECT *c2i_ASN1_OBJECT(ASN1_OBJECT **a, const unsigned char **pp,
    271.                                long len)
    272.   {

crypto/asn1/a_object.c:283:53: Assignment
    281.        * see: X.690 8.19.2
    282.        */
    283.       if (len <= 0 || len > INT_MAX || pp == NULL || (p = *pp) == NULL ||
                                                               ^
    284.           p[len - 1] & 0x80) {
    285.           ASN1err(ASN1_F_C2I_ASN1_OBJECT, ASN1_R_INVALID_OBJECT_ENCODING);

crypto/asn1/a_object.c:314:36: Array access: Offset: [-1, +oo] (⇐ [0, +oo] + -1) Size: [3, +oo] by call to `d2i_ASN1_OBJECT` 
    312.       }
    313.       for (i = 0; i < length; i++, p++) {
    314.           if (*p == 0x80 && (!i || !(p[-1] & 0x80))) {
                                              ^
    315.               ASN1err(ASN1_F_C2I_ASN1_OBJECT, ASN1_R_INVALID_OBJECT_ENCODING);
    316.               return NULL;
