crypto/asn1/n_pkey.c:161: error: BUFFER_OVERRUN_L3
  Offset added: [4, +oo] (⇐ [4, +oo] + [0, 1]) Size: [0, +oo] by call to `i2d_RSAPrivateKey`.
Showing all 23 steps of the trace


crypto/asn1/n_pkey.c:122:7: Call
120.   	pkey->algor->parameter->type=V_ASN1_NULL;
121.   
122.   	l[0]=i2d_RSAPrivateKey(a,NULL);
             ^
123.   	pkey->private_key->length=l[0];
124.   

crypto/asn1/i2d_r_pr.c:79:17: Assignment
  77.   	unsigned char *p;
  78.   
  79.   	if (a == NULL) return(0);
                        ^
  80.   
  81.   	num[1]=a->n;

crypto/asn1/n_pkey.c:122:2: Assignment
120.   	pkey->algor->parameter->type=V_ASN1_NULL;
121.   
122.   	l[0]=i2d_RSAPrivateKey(a,NULL);
        ^
123.   	pkey->private_key->length=l[0];
124.   

crypto/asn1/n_pkey.c:155:48: Array declaration
153.   	if (pkey->private_key->data != NULL)
154.   		Free((char *)pkey->private_key->data);
155.   	if ((pkey->private_key->data=(unsigned char *)Malloc(l[0])) == NULL)
                                                      ^
156.   		{
157.   		ASN1err(ASN1_F_I2D_NETSCAPE_RSA,ERR_R_MALLOC_FAILURE);

crypto/asn1/n_pkey.c:155:7: Assignment
153.   	if (pkey->private_key->data != NULL)
154.   		Free((char *)pkey->private_key->data);
155.   	if ((pkey->private_key->data=(unsigned char *)Malloc(l[0])) == NULL)
             ^
156.   		{
157.   		ASN1err(ASN1_F_I2D_NETSCAPE_RSA,ERR_R_MALLOC_FAILURE);

crypto/asn1/n_pkey.c:160:2: Assignment
158.   		goto err;
159.   		}
160.   	zz=pkey->private_key->data;
        ^
161.   	i2d_RSAPrivateKey(a,&zz);
162.   

crypto/asn1/n_pkey.c:161:2: Call
159.   		}
160.   	zz=pkey->private_key->data;
161.   	i2d_RSAPrivateKey(a,&zz);
        ^
162.   
163.   	if ((os2.data=(unsigned char *)Malloc(os2.length)) == NULL)

crypto/asn1/i2d_r_pr.c:90:2: Assignment
  88.   	num[8]=a->iqmp;
  89.   
  90.   	bs.length=1;
         ^
  91.   	bs.data=data;
  92.   	bs.type=V_ASN1_INTEGER;

crypto/asn1/i2d_r_pr.c:95:6: Call
  93.   	data[0]=a->version&0x7f;
  94.   
  95.   	tot=i2d_ASN1_INTEGER(&(bs),NULL);
             ^
  96.   	for (i=1; i<9; i++)
  97.   		{

crypto/asn1/a_int.c:66:1: Parameter `a->length`
    64.    */
    65.   
    66. > int i2d_ASN1_INTEGER(ASN1_INTEGER *a, unsigned char **pp)
    67.   	{
    68.   	int pad=0,ret,r,i,t;

crypto/asn1/i2d_r_pr.c:112:2: Call
  110.   	ASN1_put_object(&p,1,tot,V_ASN1_SEQUENCE,V_ASN1_UNIVERSAL);
  111.   
  112.   	i2d_ASN1_INTEGER(&bs,&p);
          ^
  113.   
  114.   	bs.data=(unsigned char *)Malloc(max+4);

crypto/asn1/a_int.c:66:1: <Offset trace>
64.    */
65.   
66. > int i2d_ASN1_INTEGER(ASN1_INTEGER *a, unsigned char **pp)
67.   	{
68.   	int pad=0,ret,r,i,t;

crypto/asn1/a_int.c:66:1: Parameter `a->length`
    64.    */
    65.   
    66. > int i2d_ASN1_INTEGER(ASN1_INTEGER *a, unsigned char **pp)
    67.   	{
    68.   	int pad=0,ret,r,i,t;

crypto/asn1/a_int.c:66:1: <Length trace>
64.    */
65.   
66. > int i2d_ASN1_INTEGER(ASN1_INTEGER *a, unsigned char **pp)
67.   	{
68.   	int pad=0,ret,r,i,t;

crypto/asn1/a_int.c:66:1: Parameter `**pp`
    64.    */
    65.   
    66. > int i2d_ASN1_INTEGER(ASN1_INTEGER *a, unsigned char **pp)
    67.   	{
    68.   	int pad=0,ret,r,i,t;

crypto/asn1/a_int.c:93:2: Assignment
    91.   	r=ASN1_object_size(0,ret,V_ASN1_INTEGER);
    92.   	if (pp == NULL) return(r);
    93.   	p= *pp;
           ^
    94.   
    95.   	ASN1_put_object(&p,0,ret,V_ASN1_INTEGER,V_ASN1_UNIVERSAL);

crypto/asn1/a_int.c:95:2: Call
    93.   	p= *pp;
    94.   
    95.   	ASN1_put_object(&p,0,ret,V_ASN1_INTEGER,V_ASN1_UNIVERSAL);
           ^
    96.   	if (pad) *(p++)=pb;
    97.   	if (a->length == 0)

crypto/asn1/asn1_lib.c:186:1: Parameter `**pp`
      184.   /* class 0 is constructed
      185.    * constructed == 2 for indefinitle length constructed */
      186. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
      187.   	     int xclass)
      188.   	{

crypto/asn1/asn1_lib.c:189:2: Assignment
      187.   	     int xclass)
      188.   	{
      189.   	unsigned char *p= *pp;
              ^
      190.   	int i;
      191.   

crypto/asn1/asn1_lib.c:195:5: Assignment
      193.   	i|=(xclass&V_ASN1_PRIVATE);
      194.   	if (tag < 31)
      195.   		*(p++)=i|(tag&V_ASN1_PRIMATIVE_TAG);
                 ^
      196.   	else
      197.   		{

crypto/asn1/asn1_lib.c:207:5: Assignment
      205.   		}
      206.   	if ((constructed == 2) && (length == 0))
      207.   		*(p++)=0x80; /* der_put_length would output 0 instead */
                 ^
      208.   	else
      209.   		asn1_put_length(&p,length);

crypto/asn1/asn1_lib.c:210:2: Assignment
      208.   	else
      209.   		asn1_put_length(&p,length);
      210.   	*pp=p;
              ^
      211.   	}
      212.   

crypto/asn1/a_int.c:101:3: Array access: Offset added: [4, +oo] (⇐ [4, +oo] + [0, 1]) Size: [0, +oo] by call to `i2d_RSAPrivateKey` 
    99.   	else if (t == V_ASN1_INTEGER)
    100.   		{
    101.   		memcpy(p,a->data,(unsigned int)a->length);
             ^
    102.   		p+=a->length;
    103.   		}
