crypto/rsa/rsa_saos.c:91: error: BUFFER_OVERRUN_S2
  Offset added: [`m_len` + 2, +oo] (⇐ [2, +oo] + `m_len`) Size: [0, +oo] by call to `i2d_ASN1_OCTET_STRING`.
Showing all 17 steps of the trace


crypto/rsa/rsa_saos.c:66:1: Parameter `m_len`
64.   #include <openssl/x509.h>
65.   
66. > int RSA_sign_ASN1_OCTET_STRING(int type, unsigned char *m, unsigned int m_len,
67.   	     unsigned char *sigret, unsigned int *siglen, RSA *rsa)
68.   	{

crypto/rsa/rsa_saos.c:74:2: Assignment
72.   
73.   	sig.type=V_ASN1_OCTET_STRING;
74.   	sig.length=m_len;
       ^
75.   	sig.data=m;
76.   

crypto/rsa/rsa_saos.c:91:2: Call
89.   		}
90.   	p=s;
91.   	i2d_ASN1_OCTET_STRING(&sig,&p);
       ^
92.   	i=RSA_private_encrypt(i,s,sigret,rsa,RSA_PKCS1_PADDING);
93.   	if (i <= 0)

crypto/asn1/a_octet.c:63:1: Parameter `**pp`
  61.   #include <openssl/asn1.h>
  62.   
  63. > int i2d_ASN1_OCTET_STRING(ASN1_OCTET_STRING *a, unsigned char **pp)
  64.   	{
  65.   	return(i2d_ASN1_bytes((ASN1_STRING *)a,pp,

crypto/asn1/a_octet.c:65:9: Call
  63.   int i2d_ASN1_OCTET_STRING(ASN1_OCTET_STRING *a, unsigned char **pp)
  64.   	{
  65.   	return(i2d_ASN1_bytes((ASN1_STRING *)a,pp,
                ^
  66.   		V_ASN1_OCTET_STRING,V_ASN1_UNIVERSAL));
  67.   	}

crypto/asn1/a_bytes.c:141:1: <Offset trace>
139.   	}
140.   
141. > int i2d_ASN1_bytes(ASN1_STRING *a, unsigned char **pp, int tag, int xclass)
142.   	{
143.   	int ret,r,constructed;

crypto/asn1/a_bytes.c:141:1: Parameter `a->length`
    139.   	}
    140.   
    141. > int i2d_ASN1_bytes(ASN1_STRING *a, unsigned char **pp, int tag, int xclass)
    142.   	{
    143.   	int ret,r,constructed;

crypto/asn1/a_bytes.c:141:1: <Length trace>
139.   	}
140.   
141. > int i2d_ASN1_bytes(ASN1_STRING *a, unsigned char **pp, int tag, int xclass)
142.   	{
143.   	int ret,r,constructed;

crypto/asn1/a_bytes.c:141:1: Parameter `**pp`
    139.   	}
    140.   
    141. > int i2d_ASN1_bytes(ASN1_STRING *a, unsigned char **pp, int tag, int xclass)
    142.   	{
    143.   	int ret,r,constructed;

crypto/asn1/a_bytes.c:154:2: Assignment
    152.   	r=ASN1_object_size(0,ret,tag);
    153.   	if (pp == NULL) return(r);
    154.   	p= *pp;
            ^
    155.   
    156.   	if ((tag == V_ASN1_SEQUENCE) || (tag == V_ASN1_SET))

crypto/asn1/a_bytes.c:160:2: Call
    158.   	else
    159.   		constructed=0;
    160.   	ASN1_put_object(&p,constructed,ret,tag,xclass);
            ^
    161.   	memcpy(p,a->data,a->length);
    162.   	p+=a->length;

crypto/asn1/asn1_lib.c:180:1: Parameter `**pp`
      178.   /* class 0 is constructed
      179.    * constructed == 2 for indefinitle length constructed */
      180. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
      181.   	     int xclass)
      182.   	{

crypto/asn1/asn1_lib.c:183:2: Assignment
      181.   	     int xclass)
      182.   	{
      183.   	unsigned char *p= *pp;
              ^
      184.   	int i;
      185.   

crypto/asn1/asn1_lib.c:189:5: Assignment
      187.   	i|=(xclass&V_ASN1_PRIVATE);
      188.   	if (tag < 31)
      189.   		*(p++)=i|(tag&V_ASN1_PRIMATIVE_TAG);
                 ^
      190.   	else
      191.   		{

crypto/asn1/asn1_lib.c:201:5: Assignment
      199.   		}
      200.   	if ((constructed == 2) && (length == 0))
      201.   		*(p++)=0x80; /* der_put_length would output 0 instead */
                 ^
      202.   	else
      203.   		asn1_put_length(&p,length);

crypto/asn1/asn1_lib.c:204:2: Assignment
      202.   	else
      203.   		asn1_put_length(&p,length);
      204.   	*pp=p;
              ^
      205.   	}
      206.   

crypto/asn1/a_bytes.c:161:2: Array access: Offset added: [m_len + 2, +oo] (⇐ [2, +oo] + m_len) Size: [0, +oo] by call to `i2d_ASN1_OCTET_STRING` 
    159.   		constructed=0;
    160.   	ASN1_put_object(&p,constructed,ret,tag,xclass);
    161.   	memcpy(p,a->data,a->length);
            ^
    162.   	p+=a->length;
    163.   	*pp= p;
