apps/ca.c:1404: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, +oo] by call to `X509_to_X509_REQ`.
Showing all 23 steps of the trace


apps/ca.c:1382:13: Call
1380.   	BIO_printf(bio_err,"Check that the request matches the signature\n");
1381.   
1382.   	if ((pktmp=X509_get_pubkey(req)) == NULL)
                    ^
1383.   		{
1384.   		BIO_printf(bio_err,"error unpacking public key\n");

crypto/x509/x509_cmp.c:241:9: Call
  239.   	if ((x == NULL) || (x->cert_info == NULL))
  240.   		return(NULL);
  241.   	return(X509_PUBKEY_get(x->cert_info->key));
                 ^
  242.   	}
  243.   

crypto/asn1/x_pubkey.c:244:9: Call
    242.   			p=a->parameter->value.sequence->data;
    243.   			j=a->parameter->value.sequence->length;
    244.   			if (!d2i_DSAparams(&ret->pkey.dsa,&p,(long)j))
                   ^
    245.   				goto err;
    246.   			}

crypto/asn1/d2i_dsap.c:79:2: Call
      77.   	M_ASN1_D2I_Init();
      78.   	M_ASN1_D2I_start_sequence();
      79.   	M_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);
             ^
      80.   	if ((ret->p=BN_bin2bn(bs->data,bs->length,ret->p)) == NULL) goto err_bn;
      81.   	M_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);

crypto/asn1/a_int.c:117:1: Parameter `*(*a)->data`
        115.   	}
        116.   
        117. > ASN1_INTEGER *d2i_ASN1_INTEGER(ASN1_INTEGER **a, unsigned char **pp,
        118.   	     long length)
        119.   	{

apps/ca.c:1404:12: Call
1402.   		BIO_printf(bio_err,"Signature ok\n");
1403.   
1404.   	if ((rreq=X509_to_X509_REQ(req,NULL,EVP_md5())) == NULL)
                   ^
1405.   		goto err;
1406.   

crypto/x509/x509_req.c:69:1: Parameter `*x->cert_info->key->algor->parameter->value.sequence->data`
  67.   #include "pem.h"
  68.   
  69. > X509_REQ *X509_to_X509_REQ(X509 *x, EVP_PKEY *pkey, EVP_MD *md)
  70.   	{
  71.   	X509_REQ *ret;

crypto/x509/x509_req.c:93:10: Call
  91.   		goto err;
  92.   
  93.   	pktmp = X509_get_pubkey(x);
                 ^
  94.   	i=X509_REQ_set_pubkey(ret,pktmp);
  95.   	EVP_PKEY_free(pktmp);

crypto/x509/x509_cmp.c:237:1: Parameter `*x->cert_info->key->algor->parameter->value.sequence->data`
    235.   	}
    236.   
    237. > EVP_PKEY *X509_get_pubkey(X509 *x)
    238.   	{
    239.   	if ((x == NULL) || (x->cert_info == NULL))

crypto/x509/x509_cmp.c:241:9: Call
    239.   	if ((x == NULL) || (x->cert_info == NULL))
    240.   		return(NULL);
    241.   	return(X509_PUBKEY_get(x->cert_info->key));
                   ^
    242.   	}
    243.   

crypto/asn1/x_pubkey.c:205:1: Parameter `*key->algor->parameter->value.sequence->data`
      203.   	}
      204.   
      205. > EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)
      206.   	{
      207.   	EVP_PKEY *ret=NULL;

crypto/asn1/x_pubkey.c:242:4: Assignment
      240.   			{
      241.   			ret->pkey.dsa->write_params=0;
      242.   			p=a->parameter->value.sequence->data;
                ^
      243.   			j=a->parameter->value.sequence->length;
      244.   			if (!d2i_DSAparams(&ret->pkey.dsa,&p,(long)j))

crypto/asn1/x_pubkey.c:244:9: Call
      242.   			p=a->parameter->value.sequence->data;
      243.   			j=a->parameter->value.sequence->length;
      244.   			if (!d2i_DSAparams(&ret->pkey.dsa,&p,(long)j))
                     ^
      245.   				goto err;
      246.   			}

crypto/asn1/d2i_dsap.c:71:1: Parameter `**pp`
        69.    */
        70.   
        71. > DSA *d2i_DSAparams(DSA **a, unsigned char **pp, long length)
        72.   	{
        73.   	int i=ERR_R_NESTED_ASN1_ERROR;

crypto/asn1/d2i_dsap.c:77:2: Assignment
        75.   	M_ASN1_D2I_vars(a,DSA *,DSA_new);
        76.   
        77.   	M_ASN1_D2I_Init();
               ^
        78.   	M_ASN1_D2I_start_sequence();
        79.   	M_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);

crypto/asn1/d2i_dsap.c:78:2: Call
        76.   
        77.   	M_ASN1_D2I_Init();
        78.   	M_ASN1_D2I_start_sequence();
               ^
        79.   	M_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);
        80.   	if ((ret->p=BN_bin2bn(bs->data,bs->length,ret->p)) == NULL) goto err_bn;

crypto/asn1/asn1_lib.c:283:1: Parameter `*c->p`
          281.   	}
          282.   
          283. > int asn1_GetSequence(ASN1_CTX *c, long *length)
          284.   	{
          285.   	unsigned char *q;

crypto/asn1/asn1_lib.c:288:9: Call
          286.   
          287.   	q=c->p;
          288.   	c->inf=ASN1_get_object(&(c->p),&(c->slen),&(c->tag),&(c->xclass),
                         ^
          289.   		*length);
          290.   	if (c->inf & 0x80)

crypto/asn1/asn1_lib.c:89:1: <Length trace>
87.   
88.   
89. > int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
90.   	     long omax)
91.   	{

crypto/asn1/asn1_lib.c:89:1: Parameter `**pp`
            87.   
            88.   
            89. > int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
            90.   	     long omax)
            91.   	{

crypto/asn1/asn1_lib.c:94:2: Assignment
            92.   	int i,ret;
            93.   	long l;
            94.   	unsigned char *p= *pp;
                   ^
            95.   	int tag,xclass,inf;
            96.   	long max=omax;

crypto/asn1/asn1_lib.c:104:3: Assignment
            102.   	if (i == V_ASN1_PRIMATIVE_TAG)
            103.   		{		/* high-tag */
            104.   		p++;
                     ^
            105.   		if (--max == 0) goto err;
            106.   		l=0;

crypto/asn1/asn1_lib.c:107:10: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `X509_to_X509_REQ` 
            105.   		if (--max == 0) goto err;
            106.   		l=0;
            107.   		while (*p&0x80)
                            ^
            108.   			{
            109.   			l<<=7L;
