apps/pkcs12.c:381: error: BUFFER_OVERRUN_L3
  Offset added: [4, +oo] (⇐ [4, +oo] + [0, 8]) Size: [0, +oo] by call to `PKCS12_pack_p7encdata`.
Showing all 24 steps of the trace


apps/pkcs12.c:381:13: Call
379.   	if (!twopass) strcpy(macpass, pass);
380.   	/* Turn certbags into encrypted authsafe */
381.   	authsafe = PKCS12_pack_p7encdata (cert_pbe, cpass, -1, NULL, 0,
                   ^
382.   								 iter, bags);
383.   	sk_pop_free(bags, PKCS12_SAFEBAG_free);

crypto/pkcs12/p12_add.c:150:1: Parameter `saltlen`
  148.   /* Turn a stack of SAFEBAGS into a PKCS#7 encrypted data ContentInfo */
  149.   
  150. > PKCS7 *PKCS12_pack_p7encdata (int pbe_nid, const char *pass, int passlen,
  151.   	     unsigned char *salt, int saltlen, int iter, STACK *bags)
  152.   {

crypto/pkcs12/p12_add.c:166:14: Call
  164.   	ASN1_INTEGER_set (p7->d.encrypted->version, 0);
  165.   	p7->d.encrypted->enc_data->content_type = OBJ_nid2obj(NID_pkcs7_data);
  166.   	if (!(pbe = PKCS5_pbe_set (pbe_nid, iter, salt, saltlen))) {
                      ^
  167.   		PKCS12err(PKCS12_F_PKCS12_PACK_P7ENCDATA, ERR_R_MALLOC_FAILURE);
  168.   		return NULL;

crypto/asn1/p5_pbe.c:112:1: Parameter `saltlen`
    110.   /* Return an algorithm identifier for a PKCS#5 PBE algorithm */
    111.   
    112. > X509_ALGOR *PKCS5_pbe_set(int alg, int iter, unsigned char *salt,
    113.   	     int saltlen)
    114.   {

crypto/asn1/p5_pbe.c:132:2: Assignment
    130.   		return NULL;
    131.   	}
    132.   	pbe->salt->length = saltlen;
            ^
    133.   	if (salt) memcpy (pbe->salt->data, salt, saltlen);
    134.   	else RAND_bytes (pbe->salt->data, saltlen);

crypto/asn1/p5_pbe.c:135:15: Call
    133.   	if (salt) memcpy (pbe->salt->data, salt, saltlen);
    134.   	else RAND_bytes (pbe->salt->data, saltlen);
    135.   	if (!(plen = i2d_PBEPARAM (pbe, NULL))) {
                         ^
    136.   		ASN1err(ASN1_F_ASN1_PBE_SET,ASN1_R_ENCODE_ERROR);
    137.   		return NULL;

crypto/asn1/p5_pbe.c:68:1: Parameter `a->iter->length`
      66.   #define PKCS5_SALT_LEN	8
      67.   
      68. > int i2d_PBEPARAM(PBEPARAM *a, unsigned char **pp)
      69.   {
      70.   	M_ASN1_I2D_vars(a);

crypto/asn1/p5_pbe.c:144:2: Call
    142.   	}
    143.   	ptmp = pdata;
    144.   	i2d_PBEPARAM (pbe, &ptmp);
            ^
    145.   	PBEPARAM_free (pbe);
    146.   

crypto/asn1/p5_pbe.c:68:1: Parameter `a->salt->length`
      66.   #define PKCS5_SALT_LEN	8
      67.   
      68. > int i2d_PBEPARAM(PBEPARAM *a, unsigned char **pp)
      69.   {
      70.   	M_ASN1_I2D_vars(a);

crypto/asn1/p5_pbe.c:76:2: Call
      74.   	M_ASN1_I2D_seq_total ();
      75.   
      76.   	M_ASN1_I2D_put (a->salt, i2d_ASN1_OCTET_STRING);
             ^
      77.   	M_ASN1_I2D_put (a->iter, i2d_ASN1_INTEGER);
      78.   	M_ASN1_I2D_finish();

crypto/asn1/a_octet.c:63:1: Parameter `**pp`
        61.   #include <openssl/asn1.h>
        62.   
        63. > int i2d_ASN1_OCTET_STRING(ASN1_OCTET_STRING *a, unsigned char **pp)
        64.   	{
        65.   	return(i2d_ASN1_bytes((ASN1_STRING *)a,pp,

crypto/asn1/a_octet.c:65:9: Call
        63.   int i2d_ASN1_OCTET_STRING(ASN1_OCTET_STRING *a, unsigned char **pp)
        64.   	{
        65.   	return(i2d_ASN1_bytes((ASN1_STRING *)a,pp,
                      ^
        66.   		V_ASN1_OCTET_STRING,V_ASN1_UNIVERSAL));
        67.   	}

crypto/asn1/a_bytes.c:141:1: <Offset trace>
139.   	}
140.   
141. > int i2d_ASN1_bytes(ASN1_STRING *a, unsigned char **pp, int tag, int xclass)
142.   	{
143.   	int ret,r,constructed;

crypto/asn1/a_bytes.c:141:1: Parameter `a->length`
          139.   	}
          140.   
          141. > int i2d_ASN1_bytes(ASN1_STRING *a, unsigned char **pp, int tag, int xclass)
          142.   	{
          143.   	int ret,r,constructed;

crypto/asn1/a_bytes.c:141:1: <Length trace>
139.   	}
140.   
141. > int i2d_ASN1_bytes(ASN1_STRING *a, unsigned char **pp, int tag, int xclass)
142.   	{
143.   	int ret,r,constructed;

crypto/asn1/a_bytes.c:141:1: Parameter `**pp`
          139.   	}
          140.   
          141. > int i2d_ASN1_bytes(ASN1_STRING *a, unsigned char **pp, int tag, int xclass)
          142.   	{
          143.   	int ret,r,constructed;

crypto/asn1/a_bytes.c:154:2: Assignment
          152.   	r=ASN1_object_size(0,ret,tag);
          153.   	if (pp == NULL) return(r);
          154.   	p= *pp;
                  ^
          155.   
          156.   	if ((tag == V_ASN1_SEQUENCE) || (tag == V_ASN1_SET))

crypto/asn1/a_bytes.c:160:2: Call
          158.   	else
          159.   		constructed=0;
          160.   	ASN1_put_object(&p,constructed,ret,tag,xclass);
                  ^
          161.   	memcpy(p,a->data,a->length);
          162.   	p+=a->length;

crypto/asn1/asn1_lib.c:180:1: Parameter `**pp`
            178.   /* class 0 is constructed
            179.    * constructed == 2 for indefinitle length constructed */
            180. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
            181.   	     int xclass)
            182.   	{

crypto/asn1/asn1_lib.c:183:2: Assignment
            181.   	     int xclass)
            182.   	{
            183.   	unsigned char *p= *pp;
                    ^
            184.   	int i;
            185.   

crypto/asn1/asn1_lib.c:189:5: Assignment
            187.   	i|=(xclass&V_ASN1_PRIVATE);
            188.   	if (tag < 31)
            189.   		*(p++)=i|(tag&V_ASN1_PRIMITIVE_TAG);
                       ^
            190.   	else
            191.   		{

crypto/asn1/asn1_lib.c:201:5: Assignment
            199.   		}
            200.   	if ((constructed == 2) && (length == 0))
            201.   		*(p++)=0x80; /* der_put_length would output 0 instead */
                       ^
            202.   	else
            203.   		asn1_put_length(&p,length);

crypto/asn1/asn1_lib.c:204:2: Assignment
            202.   	else
            203.   		asn1_put_length(&p,length);
            204.   	*pp=p;
                    ^
            205.   	}
            206.   

crypto/asn1/a_bytes.c:161:2: Array access: Offset added: [4, +oo] (⇐ [4, +oo] + [0, 8]) Size: [0, +oo] by call to `PKCS12_pack_p7encdata` 
          159.   		constructed=0;
          160.   	ASN1_put_object(&p,constructed,ret,tag,xclass);
          161.   	memcpy(p,a->data,a->length);
                  ^
          162.   	p+=a->length;
          163.   	*pp= p;
