crypto/asn1/t_pkey.c:134: error: BUFFER_OVERRUN_L3
  Offset: 1 Size: [0, +oo] by call to `print`.
Showing all 11 steps of the trace


crypto/asn1/t_pkey.c:110:4: Call
108.   	int i,ret=0;
109.   
110.   	i=RSA_size(x);
          ^
111.   	m=(unsigned char *)Malloc((unsigned int)i+10);
112.   	if (m == NULL)

crypto/rsa/rsa_lib.c:190:9: Call
  188.   int RSA_size(RSA *r)
  189.   	{
  190.   	return(BN_num_bytes(r->n));
                 ^
  191.   	}
  192.   

crypto/bn/bn_lib.c:245:19: Assignment
    243.   	bn_check_top(a);
    244.   
    245.   	if (a->top == 0) return(0);
                             ^
    246.   	l=a->d[a->top-1];
    247.   	i=(a->top-1)*BN_BITS2;

crypto/rsa/rsa_lib.c:190:2: Assignment
  188.   int RSA_size(RSA *r)
  189.   	{
  190.   	return(BN_num_bytes(r->n));
          ^
  191.   	}
  192.   

crypto/asn1/t_pkey.c:110:2: Assignment
108.   	int i,ret=0;
109.   
110.   	i=RSA_size(x);
        ^
111.   	m=(unsigned char *)Malloc((unsigned int)i+10);
112.   	if (m == NULL)

crypto/asn1/t_pkey.c:111:21: Array declaration
109.   
110.   	i=RSA_size(x);
111.   	m=(unsigned char *)Malloc((unsigned int)i+10);
                           ^
112.   	if (m == NULL)
113.   		{

crypto/asn1/t_pkey.c:111:2: Assignment
109.   
110.   	i=RSA_size(x);
111.   	m=(unsigned char *)Malloc((unsigned int)i+10);
        ^
112.   	if (m == NULL)
113.   		{

crypto/asn1/t_pkey.c:134:7: Call
132.   	else
133.   		strcpy(str,"modulus:");
134.   	if (!print(bp,str,x->n,m,off)) goto err;
             ^
135.   	s=(x->d == NULL)?"Exponent:":"publicExponent:";
136.   	if (!print(bp,s,x->e,m,off)) goto err;

crypto/asn1/t_pkey.c:221:1: <Length trace>
219.   #endif /* !NO_DSA */
220.   
221. > static int print(BIO *bp, const char *number, BIGNUM *num, unsigned char *buf,
222.   	     int off)
223.   	{

crypto/asn1/t_pkey.c:221:1: Parameter `*buf`
  219.   #endif /* !NO_DSA */
  220.   
  221. > static int print(BIO *bp, const char *number, BIGNUM *num, unsigned char *buf,
  222.   	     int off)
  223.   	{

crypto/asn1/t_pkey.c:251:7: Array access: Offset: 1 Size: [0, +oo] by call to `print` 
  249.   		n=BN_bn2bin(num,&buf[1]);
  250.   	
  251.   		if (buf[1] & 0x80)
               ^
  252.   			n++;
  253.   		else	buf++;
