crypto/x509v3/v3_scts.c:174: error: BUFFER_OVERRUN_L3
  Offset: [3, +oo] (⇐ [2, +oo] + 1) Size: [1, +oo].
Showing all 9 steps of the trace


crypto/x509v3/v3_scts.c:159:9: <Length trace>
157.       const unsigned char *q = *pp;
158.   
159.       if (d2i_ASN1_OCTET_STRING(&oct, &q, length) == NULL)
               ^
160.           return NULL;
161.       if (oct->length < 2)

crypto/x509v3/v3_scts.c:159:9: Call
157.       const unsigned char *q = *pp;
158.   
159.       if (d2i_ASN1_OCTET_STRING(&oct, &q, length) == NULL)
               ^
160.           return NULL;
161.       if (oct->length < 2)

crypto/asn1/tasn_typ.c:76:1: Call
  74.   }
  75.   
  76. > IMPLEMENT_ASN1_STRING_FUNCTIONS(ASN1_OCTET_STRING)
  77.   IMPLEMENT_ASN1_STRING_FUNCTIONS(ASN1_INTEGER)
  78.   IMPLEMENT_ASN1_STRING_FUNCTIONS(ASN1_ENUMERATED)

crypto/asn1/tasn_dec.c:152:9: Call
    150.           pval = &ptmpval;
    151.       asn1_tlc_clear_nc(&c);
    152.       if (ASN1_item_ex_d2i(pval, in, len, it, -1, 0, 0, &c) > 0)
                   ^
    153.           return *pval;
    154.       return NULL;

crypto/asn1/tasn_dec.c:162:10: Call
      160.   {
      161.       int rv;
      162.       rv = asn1_item_embed_d2i(pval, in, len, it, tag, aclass, opt, ctx);
                      ^
      163.       if (rv <= 0)
      164.           ASN1_item_ex_free(pval, it);

crypto/asn1/tasn_dec.c:173:1: Parameter `(*pval)->data`
        171.    */
        172.   
        173. > static int asn1_item_embed_d2i(ASN1_VALUE **pval, const unsigned char **in,
        174.                                  long len, const ASN1_ITEM *it,
        175.                                  int tag, int aclass, char opt, ASN1_TLC *ctx)

crypto/x509v3/v3_scts.c:163:5: Assignment
161.       if (oct->length < 2)
162.           goto done;
163.       p = oct->data;
           ^
164.       n2s(p, listlen);
165.       if (listlen != oct->length - 2)

crypto/x509v3/v3_scts.c:164:5: Assignment
162.           goto done;
163.       p = oct->data;
164.       n2s(p, listlen);
           ^
165.       if (listlen != oct->length - 2)
166.           goto done;

crypto/x509v3/v3_scts.c:174:9: Array access: Offset: [3, +oo] (⇐ [2, +oo] + 1) Size: [1, +oo]
172.           if (listlen < 2)
173.               goto err;
174.           n2s(p, sctlen);
               ^
175.           listlen -= 2;
176.   
