crypto/pem/pvkfmt.c:767: error: BUFFER_OVERRUN_L3
  Offset added: [9, +oo] (⇐ [1, +oo] + 8) Size: [8, +oo] by call to `do_PVK_body`.
Showing all 7 steps of the trace


crypto/pem/pvkfmt.c:754:10: Call
752.       p = pvk_hdr;
753.   
754.       if (!do_PVK_header(&p, 24, 0, &saltlen, &keylen))
                ^
755.           return 0;
756.       buflen = (int)keylen + saltlen;

crypto/pem/pvkfmt.c:609:1: Parameter `*psaltlen`
  607.   # ifndef OPENSSL_NO_RC4
  608.   
  609. > static int do_PVK_header(const unsigned char **in, unsigned int length,
  610.                            int skip_magic,
  611.                            unsigned int *psaltlen, unsigned int *pkeylen)

crypto/pem/pvkfmt.c:767:11: Call
765.           goto err;
766.       }
767.       ret = do_PVK_body(&p, saltlen, keylen, cb, u);
                 ^
768.   
769.    err:

crypto/pem/pvkfmt.c:666:1: <Length trace>
664.   }
665.   
666. > static EVP_PKEY *do_PVK_body(const unsigned char **in,
667.                                unsigned int saltlen, unsigned int keylen,
668.                                pem_password_cb *cb, void *u)

crypto/pem/pvkfmt.c:666:1: Parameter `saltlen`
  664.   }
  665.   
  666. > static EVP_PKEY *do_PVK_body(const unsigned char **in,
  667.                                unsigned int saltlen, unsigned int keylen,
  668.                                pem_password_cb *cb, void *u)

crypto/pem/pvkfmt.c:697:9: Assignment
  695.                               (unsigned char *)psbuf, inlen))
  696.               goto err;
  697.           p += saltlen;
                 ^
  698.           /* Copy BLOBHEADER across, decrypt rest */
  699.           memcpy(enctmp, p, 8);

crypto/pem/pvkfmt.c:699:9: Array access: Offset added: [9, +oo] (⇐ [1, +oo] + 8) Size: [8, +oo] by call to `do_PVK_body` 
  697.           p += saltlen;
  698.           /* Copy BLOBHEADER across, decrypt rest */
  699.           memcpy(enctmp, p, 8);
                 ^
  700.           p += 8;
  701.           if (keylen < 8) {
