apps/rsautl.c:307: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] Size: [1, +oo] by call to `ASN1_parse_dump`.
Showing all 27 steps of the trace


apps/rsautl.c:258:15: Call
256.           goto end;
257.   
258.       keysize = RSA_size(rsa);
                     ^
259.   
260.       rsa_in = app_malloc(keysize * 2, "hold rsa key");

crypto/rsa/rsa_crpt.c:73:13: Call
  71.   int RSA_size(const RSA *r)
  72.   {
  73.       return (BN_num_bytes(r->n));
                    ^
  74.   }
  75.   

crypto/bn/bn_lib.c:220:9: Assignment
    218.   
    219.       if (BN_is_zero(a))
    220.           return 0;
                   ^
    221.       return ((i * BN_BITS2) + BN_num_bits_word(a->d[i]));
    222.   }

crypto/rsa/rsa_crpt.c:73:5: Assignment
  71.   int RSA_size(const RSA *r)
  72.   {
  73.       return (BN_num_bytes(r->n));
            ^
  74.   }
  75.   

apps/rsautl.c:258:5: Assignment
256.           goto end;
257.   
258.       keysize = RSA_size(rsa);
           ^
259.   
260.       rsa_in = app_malloc(keysize * 2, "hold rsa key");

apps/rsautl.c:261:15: Call
259.   
260.       rsa_in = app_malloc(keysize * 2, "hold rsa key");
261.       rsa_out = app_malloc(keysize, "output rsa key");
                     ^
262.   
263.       /* Read the input data */

apps/apps.c:976:1: Parameter `sz`
  974.   }
  975.   
  976. > void* app_malloc(int sz, const char *what)
  977.   {
  978.       void *vp = OPENSSL_malloc(sz);

apps/apps.c:978:16: Call
  976.   void* app_malloc(int sz, const char *what)
  977.   {
  978.       void *vp = OPENSSL_malloc(sz);
                        ^
  979.   
  980.       if (vp == NULL) {

crypto/mem.c:124:9: Assignment
    122.   
    123.       if (num <= 0)
    124.           return NULL;
                   ^
    125.   
    126.       allow_customize = 0;

apps/apps.c:978:5: Assignment
  976.   void* app_malloc(int sz, const char *what)
  977.   {
  978.       void *vp = OPENSSL_malloc(sz);
             ^
  979.   
  980.       if (vp == NULL) {

apps/apps.c:986:5: Assignment
  984.           exit(1);
  985.       }
  986.       return vp;
             ^
  987.   }
  988.   

apps/rsautl.c:261:5: Assignment
259.   
260.       rsa_in = app_malloc(keysize * 2, "hold rsa key");
261.       rsa_out = app_malloc(keysize, "output rsa key");
           ^
262.   
263.       /* Read the input data */

apps/rsautl.c:307:14: Call
305.       ret = 0;
306.       if (asn1parse) {
307.           if (!ASN1_parse_dump(out, rsa_out, rsa_outlen, 1, -1)) {
                    ^
308.               ERR_print_errors(bio_err);
309.           }

crypto/asn1/asn1_par.c:111:1: Parameter `*pp`
  109.   }
  110.   
  111. > int ASN1_parse_dump(BIO *bp, const unsigned char *pp, long len, int indent,
  112.                       int dump)
  113.   {

crypto/asn1/asn1_par.c:114:13: Call
  112.                       int dump)
  113.   {
  114.       return (asn1_parse2(bp, &pp, len, 0, 0, indent, dump));
                     ^
  115.   }
  116.   

crypto/asn1/asn1_par.c:117:1: Parameter `**pp`
    115.   }
    116.   
    117. > static int asn1_parse2(BIO *bp, const unsigned char **pp, long length,
    118.                          int offset, int depth, int indent, int dump)
    119.   {

crypto/asn1/asn1_par.c:135:5: Assignment
    133.   
    134.       dump_indent = 6;            /* Because we know BIO_dump_indent() */
    135.       p = *pp;
               ^
    136.       tot = p + length;
    137.       op = p - 1;

crypto/asn1/asn1_par.c:140:13: Call
    138.       while ((p < tot) && (op < p)) {
    139.           op = p;
    140.           j = ASN1_get_object(&p, &len, &tag, &xclass, length);
                       ^
    141.           if (j & 0x80) {
    142.               if (BIO_write(bp, "Error in encoding\n", 18) <= 0)

crypto/asn1/asn1_lib.c:91:1: Parameter `**pp`
      89.   }
      90.   
      91. > int ASN1_get_object(const unsigned char **pp, long *plength, int *ptag,
      92.                       int *pclass, long omax)
      93.   {

crypto/asn1/asn1_lib.c:96:5: Assignment
      94.       int i, ret;
      95.       long l;
      96.       const unsigned char *p = *pp;
                ^
      97.       int tag, xclass, inf;
      98.       long max = omax;

crypto/asn1/asn1_lib.c:125:9: Assignment
      123.       } else {
      124.           tag = i;
      125.           p++;
                     ^
      126.           if (--max == 0)
      127.               goto err;

crypto/asn1/asn1_lib.c:131:10: Call
      129.       *ptag = tag;
      130.       *pclass = xclass;
      131.       if (!asn1_get_length(&p, &inf, plength, (int)max))
                      ^
      132.           goto err;
      133.   

crypto/asn1/asn1_lib.c:152:1: <Length trace>
150.   }
151.   
152. > static int asn1_get_length(const unsigned char **pp, int *inf, long *rl,
153.                              int max)
154.   {

crypto/asn1/asn1_lib.c:152:1: Parameter `**pp`
        150.   }
        151.   
        152. > static int asn1_get_length(const unsigned char **pp, int *inf, long *rl,
        153.                              int max)
        154.   {

crypto/asn1/asn1_lib.c:155:5: Assignment
        153.                              int max)
        154.   {
        155.       const unsigned char *p = *pp;
                   ^
        156.       unsigned long ret = 0;
        157.       unsigned int i;

crypto/asn1/asn1_lib.c:168:15: Assignment
        166.           *inf = 0;
        167.           i = *p & 0x7f;
        168.           if (*(p++) & 0x80) {
                             ^
        169.               if (max < (int)i)
        170.                   return 0;

crypto/asn1/asn1_lib.c:172:25: Array access: Offset: [2, +oo] Size: [1, +oo] by call to `ASN1_parse_dump` 
        170.                   return 0;
        171.               /* Skip leading zeroes */
        172.               while (i && *p == 0) {
                                       ^
        173.                   p++;
        174.                   i--;
