apps/pkcs12.c:493: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, +oo] by call to `dump_certs_pkeys_bag`.
Showing all 16 steps of the trace


apps/pkcs12.c:493:8: Call
491.   	int i;
492.   	for (i = 0; i < sk_num (bags); i++) {
493.   		if (!dump_certs_pkeys_bag (out,
              ^
494.   			 (PKCS12_SAFEBAG *)sk_value (bags, i), pass, passlen,
495.   					 		options)) return 0;

apps/pkcs12.c:500:1: Parameter `bag->value.shkeybag->digest->length`
  498.   }
  499.   
  500. > int dump_certs_pkeys_bag (BIO *out, PKCS12_SAFEBAG *bag, unsigned char *pass,
  501.   	     int passlen, int options)
  502.   {

apps/pkcs12.c:527:14: Call
  525.   		if (options & NOKEYS) return 1;
  526.   		print_attribs (out, bag->attrib, "Bag Attributes");
  527.   		if (!(p8 = M_PKCS12_decrypt_skey (bag, pass, passlen)))
                      ^
  528.   				return 0;
  529.   		if (!(pkey = EVP_PKCS82PKEY (p8))) return 0;

crypto/pkcs12/p12_decr.c:109:1: Parameter `oct->length`
    107.    */
    108.   
    109. > char * PKCS12_decrypt_d2i (X509_ALGOR *algor, char * (*d2i)(),
    110.   	     void (*free_func)(), unsigned char *pass, int passlen,
    111.   	     ASN1_OCTET_STRING *oct, int seq)

crypto/pkcs12/p12_decr.c:117:7: Call
    115.   	int outlen;
    116.   
    117.   	if (!PKCS12_pbe_crypt (algor, pass, passlen, oct->data, oct->length,
                 ^
    118.   				 &out, &outlen, 0)) {
    119.   		PKCS12err(PKCS12_F_PKCS12_DECRYPT_D2I,PKCS12_R_PKCS12_PBE_CRYPT_ERROR);

crypto/pkcs12/p12_decr.c:71:1: Parameter `**data`
      69.    */
      70.   
      71. > unsigned char * PKCS12_pbe_crypt (X509_ALGOR *algor, unsigned char *pass,
      72.   	     int passlen, unsigned char *in, int inlen, unsigned char **data,
      73.   	     int *datalen, int en_de)

crypto/pkcs12/p12_decr.c:122:2: Assignment
    120.   		return NULL;
    121.   	}
    122.   	p = out;
            ^
    123.   #ifdef DEBUG_DECRYPT
    124.   	{

crypto/pkcs12/p12_decr.c:135:30: Call
    133.   	}
    134.   #endif
    135.   	if (seq & 1) ret = (char *) d2i_ASN1_SET(NULL, &p, outlen, d2i,
                                        ^
    136.   				free_func, V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL);
    137.   	else ret = d2i(NULL, &p, outlen);

crypto/asn1/a_set.c:156:1: Parameter `**pp`
      154.           }
      155.   
      156. > STACK *d2i_ASN1_SET(STACK **a, unsigned char **pp, long length,
      157.   	     char *(*func)(), void (*free_func)(), int ex_tag, int ex_class)
      158.   	{

crypto/asn1/a_set.c:167:2: Assignment
      165.   		ret=(*a);
      166.   
      167.   	c.p= *pp;
              ^
      168.   	c.max=(length == 0)?0:(c.p+length);
      169.   

crypto/asn1/a_set.c:170:8: Call
      168.   	c.max=(length == 0)?0:(c.p+length);
      169.   
      170.   	c.inf=ASN1_get_object(&c.p,&c.slen,&c.tag,&c.xclass,c.max-c.p);
                    ^
      171.   	if (c.inf & 0x80) goto err;
      172.   	if (ex_class != c.xclass)

crypto/asn1/asn1_lib.c:89:1: <Length trace>
87.   
88.   
89. > int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
90.   	     long omax)
91.   	{

crypto/asn1/asn1_lib.c:89:1: Parameter `**pp`
        87.   
        88.   
        89. > int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
        90.   	     long omax)
        91.   	{

crypto/asn1/asn1_lib.c:94:2: Assignment
        92.   	int i,ret;
        93.   	long l;
        94.   	unsigned char *p= *pp;
               ^
        95.   	int tag,xclass,inf;
        96.   	long max=omax;

crypto/asn1/asn1_lib.c:104:3: Assignment
        102.   	if (i == V_ASN1_PRIMATIVE_TAG)
        103.   		{		/* high-tag */
        104.   		p++;
                 ^
        105.   		if (--max == 0) goto err;
        106.   		l=0;

crypto/asn1/asn1_lib.c:107:10: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `dump_certs_pkeys_bag` 
        105.   		if (--max == 0) goto err;
        106.   		l=0;
        107.   		while (*p&0x80)
                        ^
        108.   			{
        109.   			l<<=7L;
