apps/cms.c:1015: error: BUFFER_OVERRUN_L3
  Offset added: [1, +oo] Size: [0, +oo] by call to `CMS_decrypt`.
Showing all 25 steps of the trace


apps/cms.c:1002:18: Call
1000.           /* If not streaming or resigning finalize structure */
1001.           if ((operation == SMIME_SIGN) && !(flags & CMS_STREAM)) {
1002.               if (!CMS_final(cms, in, NULL, flags))
                         ^
1003.                   goto end;
1004.           }

crypto/cms/cms_smime.c:801:1: Parameter `*cms->d.envelopedData->encryptedContentInfo->key`
  799.   }
  800.   
  801. > int CMS_final(CMS_ContentInfo *cms, BIO *data, BIO *dcont, unsigned int flags)
  802.   {
  803.       BIO *cmsbio;

crypto/cms/cms_smime.c:806:19: Call
  804.       int ret = 0;
  805.   
  806.       if ((cmsbio = CMS_dataInit(cms, dcont)) == NULL) {
                           ^
  807.           CMSerr(CMS_F_CMS_FINAL, CMS_R_CMS_LIB);
  808.           return 0;

crypto/cms/cms_lib.c:101:1: Parameter `*cms->d.envelopedData->encryptedContentInfo->key`
    99.   }
    100.   
    101. > BIO *CMS_dataInit(CMS_ContentInfo *cms, BIO *icont)
    102.   {
    103.       BIO *cmsbio, *cont;

apps/cms.c:1015:13: Call
1013.       if (operation == SMIME_DECRYPT) {
1014.           if (flags & CMS_DEBUG_DECRYPT)
1015.               CMS_decrypt(cms, NULL, NULL, NULL, NULL, flags);
                    ^
1016.   
1017.           if (secret_key) {

crypto/cms/cms_smime.c:774:1: Parameter `*cms->d.envelopedData->encryptedContentInfo->key`
  772.   }
  773.   
  774. > int CMS_decrypt(CMS_ContentInfo *cms, EVP_PKEY *pk, X509 *cert,
  775.                   BIO *dcont, BIO *out, unsigned int flags)
  776.   {

crypto/cms/cms_smime.c:793:12: Call
  791.       if (pk && !CMS_decrypt_set1_pkey(cms, pk, cert))
  792.           return 0;
  793.       cont = CMS_dataInit(cms, dcont);
                    ^
  794.       if (!cont)
  795.           return 0;

crypto/cms/cms_lib.c:101:1: Parameter `*cms->d.envelopedData->encryptedContentInfo->key`
    99.   }
    100.   
    101. > BIO *CMS_dataInit(CMS_ContentInfo *cms, BIO *icont)
    102.   {
    103.       BIO *cmsbio, *cont;

crypto/cms/cms_lib.c:135:18: Call
    133.   
    134.       case NID_pkcs7_enveloped:
    135.           cmsbio = cms_EnvelopedData_init_bio(cms);
                            ^
    136.           break;
    137.   

crypto/cms/cms_env.c:897:11: Call
      895.   
      896.       ec = cms->d.envelopedData->encryptedContentInfo;
      897.       ret = cms_EncryptedContent_init_bio(ec);
                       ^
      898.   
      899.       /* If error or no cipher end of processing */

crypto/cms/cms_enc.c:68:1: Parameter `ec->keylen`
        66.   /* Return BIO based on EncryptedContentInfo and key */
        67.   
        68. > BIO *cms_EncryptedContent_init_bio(CMS_EncryptedContentInfo *ec)
        69.   {
        70.       BIO *b;

crypto/cms/cms_env.c:910:13: Call
      908.       for (i = 0; i < sk_CMS_RecipientInfo_num(rinfos); i++) {
      909.           ri = sk_CMS_RecipientInfo_value(rinfos, i);
      910.           if (CMS_RecipientInfo_encrypt(cms, ri) <= 0) {
                         ^
      911.               CMSerr(CMS_F_CMS_ENVELOPEDDATA_INIT_BIO,
      912.                      CMS_R_ERROR_SETTING_RECIPIENTINFO);

crypto/cms/cms_env.c:801:1: Parameter `*cms->d.envelopedData->encryptedContentInfo->key`
        799.   }
        800.   
        801. > int CMS_RecipientInfo_encrypt(CMS_ContentInfo *cms, CMS_RecipientInfo *ri)
        802.   {
        803.       switch (ri->type) {

crypto/cms/cms_env.c:808:16: Call
        806.   
        807.       case CMS_RECIPINFO_AGREE:
        808.           return cms_RecipientInfo_kari_encrypt(cms, ri);
                              ^
        809.   
        810.       case CMS_RECIPINFO_KEK:

crypto/cms/cms_kari.c:405:1: Parameter `*cms->d.envelopedData->encryptedContentInfo->key`
          403.   /* Encrypt content key in key agreement recipient info */
          404.   
          405. > int cms_RecipientInfo_kari_encrypt(CMS_ContentInfo *cms,
          406.                                      CMS_RecipientInfo *ri)
          407.   {

crypto/cms/cms_kari.c:445:14: Call
          443.           if (EVP_PKEY_derive_set_peer(kari->pctx, rek->pkey) <= 0)
          444.               return 0;
          445.           if (!cms_kek_cipher(&enckey, &enckeylen, ec->key, ec->keylen,
                              ^
          446.                               kari, 1))
          447.               return 0;

crypto/cms/cms_kari.c:232:1: Parameter `inlen`
            230.    */
            231.   
            232. > static int cms_kek_cipher(unsigned char **pout, size_t *poutlen,
            233.                             const unsigned char *in, size_t inlen,
            234.                             CMS_KeyAgreeRecipientInfo *kari, int enc)

crypto/cms/cms_kari.c:252:10: Call
            250.           goto err;
            251.       /* obtain output length of ciphered key */
            252.       if (!EVP_CipherUpdate(&kari->ctx, NULL, &outlen, in, inlen))
                            ^
            253.           goto err;
            254.       out = OPENSSL_malloc(outlen);

crypto/evp/evp_enc.c:238:1: Parameter `inl`
              236.   }
              237.   
              238. > int EVP_CipherUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,
              239.                        const unsigned char *in, int inl)
              240.   {

crypto/evp/evp_enc.c:242:16: Call
              240.   {
              241.       if (ctx->encrypt)
              242.           return EVP_EncryptUpdate(ctx, out, outl, in, inl);
                                    ^
              243.       else
              244.           return EVP_DecryptUpdate(ctx, out, outl, in, inl);

crypto/evp/evp_enc.c:289:1: <Offset trace>
287.   }
288.   
289. > int EVP_EncryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,
290.                         const unsigned char *in, int inl)
291.   {

crypto/evp/evp_enc.c:289:1: Parameter `inl`
                287.   }
                288.   
                289. > int EVP_EncryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,
                290.                         const unsigned char *in, int inl)
                291.   {

crypto/evp/evp_enc.c:289:1: <Length trace>
287.   }
288.   
289. > int EVP_EncryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,
290.                         const unsigned char *in, int inl)
291.   {

crypto/evp/evp_enc.c:289:1: Parameter `*in`
                287.   }
                288.   
                289. > int EVP_EncryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,
                290.                         const unsigned char *in, int inl)
                291.   {

crypto/evp/evp_enc.c:322:13: Array access: Offset added: [1, +oo] Size: [0, +oo] by call to `CMS_decrypt` 
                320.       if (i != 0) {
                321.           if (i + inl < bl) {
                322.               memcpy(&(ctx->buf[i]), in, inl);
                                   ^
                323.               ctx->buf_len += inl;
                324.               *outl = 0;
