crypto/x509v3/v3_conf.c:323: error: BUFFER_OVERRUN_L3
  Offset: [0, +oo] Size: [0, +oo] by call to `X509_REQ_add_extensions`.
Showing all 25 steps of the trace


crypto/x509v3/v3_conf.c:320:26: Call
318.   		if(!(ext = X509V3_EXT_conf(conf, ctx, val->name, val->value)))
319.   								return 0;
320.   		if(!extlist) extlist = sk_X509_EXTENSION_new_null();
                                ^
321.   		sk_X509_EXTENSION_push(extlist, ext);
322.   	}

crypto/x509/x509_ext.c:173:1: Call
  171.   	}
  172.   
  173. > IMPLEMENT_STACK_OF(X509_EXTENSION)
  174.   IMPLEMENT_ASN1_SET_OF(X509_EXTENSION)

crypto/stack/stack.c:125:2: Assignment
    123.   	ret->comp=c;
    124.   	ret->num_alloc=MIN_NODES;
    125.   	ret->num=0;
            ^
    126.   	ret->sorted=0;
    127.   	return(ret);

crypto/x509v3/v3_conf.c:321:3: Call
319.   								return 0;
320.   		if(!extlist) extlist = sk_X509_EXTENSION_new_null();
321.   		sk_X509_EXTENSION_push(extlist, ext);
         ^
322.   	}
323.   	if(req) i = X509_REQ_add_extensions(req, extlist);

crypto/x509/x509_ext.c:173:1: Parameter `sk->num`
  171.   	}
  172.   
  173. > IMPLEMENT_STACK_OF(X509_EXTENSION)
  174.   IMPLEMENT_ASN1_SET_OF(X509_EXTENSION)

crypto/x509/x509_ext.c:173:1: Call
  171.   	}
  172.   
  173. > IMPLEMENT_STACK_OF(X509_EXTENSION)
  174.   IMPLEMENT_ASN1_SET_OF(X509_EXTENSION)

crypto/stack/stack.c:233:1: Parameter `st->num`
    231.   	}
    232.   
    233. > int sk_push(STACK *st, char *data)
    234.   	{
    235.   	return(sk_insert(st,data,st->num));

crypto/stack/stack.c:235:9: Call
    233.   int sk_push(STACK *st, char *data)
    234.   	{
    235.   	return(sk_insert(st,data,st->num));
                   ^
    236.   	}
    237.   

crypto/stack/stack.c:134:1: Parameter `st->num`
      132.   	}
      133.   
      134. > int sk_insert(STACK *st, char *data, int loc)
      135.   	{
      136.   	char **s;

crypto/x509v3/v3_conf.c:323:14: Call
321.   		sk_X509_EXTENSION_push(extlist, ext);
322.   	}
323.   	if(req) i = X509_REQ_add_extensions(req, extlist);
                    ^
324.   	else i = 1;
325.   	sk_X509_EXTENSION_pop_free(extlist, X509_EXTENSION_free);

crypto/x509/x509_req.c:213:1: Parameter `exts->num`
  211.   }
  212.   /* This is the normal usage: use the "official" OID */
  213. > int X509_REQ_add_extensions(X509_REQ *req, STACK_OF(X509_EXTENSION) *exts)
  214.   {
  215.   	return X509_REQ_add_extensions_nid(req, exts, NID_ext_req);

crypto/x509/x509_req.c:215:9: Call
  213.   int X509_REQ_add_extensions(X509_REQ *req, STACK_OF(X509_EXTENSION) *exts)
  214.   {
  215.   	return X509_REQ_add_extensions_nid(req, exts, NID_ext_req);
                 ^
  216.   }

crypto/x509/x509_req.c:177:1: Parameter `exts->num`
    175.    */
    176.   
    177. > int X509_REQ_add_extensions_nid(X509_REQ *req, STACK_OF(X509_EXTENSION) *exts,
    178.   				int nid)
    179.   {

crypto/x509/x509_req.c:189:8: Call
    187.   	at->type = V_ASN1_SEQUENCE;
    188.   	/* Generate encoding of extensions */
    189.   	len = i2d_ASN1_SET_OF_X509_EXTENSION(exts, NULL, i2d_X509_EXTENSION,
                  ^
    190.   			V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL, IS_SEQUENCE);
    191.   	if(!(p = Malloc(len))) goto err;

crypto/x509/x509_ext.c:174:1: Parameter `a->num`
      172.   
      173.   IMPLEMENT_STACK_OF(X509_EXTENSION)
      174. > IMPLEMENT_ASN1_SET_OF(X509_EXTENSION)

crypto/x509/x509_ext.c:174:1: Call
      172.   
      173.   IMPLEMENT_STACK_OF(X509_EXTENSION)
      174. > IMPLEMENT_ASN1_SET_OF(X509_EXTENSION)

crypto/asn1/a_set.c:122:14: <Offset trace>
120.   we will store the SET blobs */
121.   
122.           for (i=0; i<sk_num(a); i++)
                    ^
123.   	        {
124.                   rgSetBlob[i].pbData = p;  /* catch each set encode blob */

crypto/asn1/a_set.c:122:14: Assignment
        120.   we will store the SET blobs */
        121.   
        122.           for (i=0; i<sk_num(a); i++)
                            ^
        123.   	        {
        124.                   rgSetBlob[i].pbData = p;  /* catch each set encode blob */

crypto/asn1/a_set.c:86:1: <Length trace>
84.   
85.   /* int is_set:  if TRUE, then sort the contents (i.e. it isn't a SEQUENCE)    */
86. > int i2d_ASN1_SET(STACK *a, unsigned char **pp, int (*func)(), int ex_tag,
87.   	     int ex_class, int is_set)
88.   	{

crypto/asn1/a_set.c:86:1: Parameter `a->num`
        84.   
        85.   /* int is_set:  if TRUE, then sort the contents (i.e. it isn't a SEQUENCE)    */
        86. > int i2d_ASN1_SET(STACK *a, unsigned char **pp, int (*func)(), int ex_tag,
        87.   	     int ex_class, int is_set)
        88.   	{

crypto/asn1/a_set.c:119:39: Call
        117.   
        118.           pStart  = p; /* Catch the beg of Setblobs*/
        119.           rgSetBlob = (MYBLOB *)Malloc( sk_num(a) * sizeof(MYBLOB)); /* In this array
                                                     ^
        120.   we will store the SET blobs */
        121.   

crypto/stack/stack.c:285:17: Assignment
          283.   int sk_num(STACK *st)
          284.   {
          285.   	if(st == NULL) return -1;
                                 ^
          286.   	return st->num;
          287.   }

crypto/asn1/a_set.c:119:31: Array declaration
        117.   
        118.           pStart  = p; /* Catch the beg of Setblobs*/
        119.           rgSetBlob = (MYBLOB *)Malloc( sk_num(a) * sizeof(MYBLOB)); /* In this array
                                             ^
        120.   we will store the SET blobs */
        121.   

crypto/asn1/a_set.c:119:9: Assignment
        117.   
        118.           pStart  = p; /* Catch the beg of Setblobs*/
        119.           rgSetBlob = (MYBLOB *)Malloc( sk_num(a) * sizeof(MYBLOB)); /* In this array
                       ^
        120.   we will store the SET blobs */
        121.   

crypto/asn1/a_set.c:124:17: Array access: Offset: [0, +oo] Size: [0, +oo] by call to `X509_REQ_add_extensions` 
        122.           for (i=0; i<sk_num(a); i++)
        123.   	        {
        124.                   rgSetBlob[i].pbData = p;  /* catch each set encode blob */
                               ^
        125.                   func(sk_value(a,i),&p);
        126.                   rgSetBlob[i].cbData = p - rgSetBlob[i].pbData; /* Length of this
