crypto/pkcs12/p12_decr.c:137: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] (⇐ [0, +oo] + 1) Size: [0, +oo] by call to `d2i_ASN1_SET`.
Showing all 11 steps of the trace


crypto/pkcs12/p12_decr.c:119:7: Call
117.   	int outlen;
118.   
119.   	if (!PKCS12_pbe_crypt (algor, pass, passlen, oct->data, oct->length,
             ^
120.   			       &out, &outlen, 0)) {
121.   		PKCS12err(PKCS12_F_PKCS12_DECRYPT_D2I,PKCS12_R_PKCS12_PBE_CRYPT_ERROR);

crypto/pkcs12/p12_decr.c:71:1: Parameter `**data`
  69.    */
  70.   
  71. > unsigned char * PKCS12_pbe_crypt (X509_ALGOR *algor, const char *pass,
  72.   	     int passlen, unsigned char *in, int inlen, unsigned char **data,
  73.   	     int *datalen, int en_de)

crypto/pkcs12/p12_decr.c:124:2: Assignment
122.   		return NULL;
123.   	}
124.   	p = out;
        ^
125.   #ifdef DEBUG_DECRYPT
126.   	{

crypto/pkcs12/p12_decr.c:137:30: Call
135.   	}
136.   #endif
137.   	if (seq & 1) ret = (char *) d2i_ASN1_SET(NULL, &p, outlen, d2i,
                                    ^
138.   				free_func, V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL);
139.   	else ret = d2i(NULL, &p, outlen);

crypto/asn1/a_set.c:154:1: Parameter `length`
  152.           }
  153.   
  154. > STACK *d2i_ASN1_SET(STACK **a, unsigned char **pp, long length,
  155.   	     char *(*func)(), void (*free_func)(), int ex_tag, int ex_class)
  156.   	{

crypto/asn1/a_set.c:188:3: Assignment
  186.   	 * as the amount of data passed to us */
  187.   	if (c.inf == (V_ASN1_CONSTRUCTED+1))
  188.   		c.slen=length+ *pp-c.p;
           ^
  189.   	c.max=c.p+c.slen;
  190.   

crypto/asn1/a_set.c:189:2: Assignment
  187.   	if (c.inf == (V_ASN1_CONSTRUCTED+1))
  188.   		c.slen=length+ *pp-c.p;
  189.   	c.max=c.p+c.slen;
          ^
  190.   
  191.   	while (c.p < c.max)

crypto/asn1/a_set.c:195:7: Call
  193.   		char *s;
  194.   
  195.   		if (M_ASN1_D2I_end_sequence()) break;
               ^
  196.   		if ((s=func(NULL,&c.p,c.slen,c.max-c.p)) == NULL)
  197.   			{

crypto/asn1/asn1_lib.c:68:1: <Length trace>
66.   const char *ASN1_version="ASN.1" OPENSSL_VERSION_PTEXT;
67.   
68. > int ASN1_check_infinite_end(unsigned char **p, long len)
69.   	{
70.   	/* If there is 0 or 1 byte left, the length check should pick

crypto/asn1/asn1_lib.c:68:1: Parameter `**p`
    66.   const char *ASN1_version="ASN.1" OPENSSL_VERSION_PTEXT;
    67.   
    68. > int ASN1_check_infinite_end(unsigned char **p, long len)
    69.   	{
    70.   	/* If there is 0 or 1 byte left, the length check should pick

crypto/asn1/asn1_lib.c:74:44: Array access: Offset: [1, +oo] (⇐ [0, +oo] + 1) Size: [0, +oo] by call to `d2i_ASN1_SET` 
    72.   	if (len <= 0)
    73.   		return(1);
    74.   	else if ((len >= 2) && ((*p)[0] == 0) && ((*p)[1] == 0))
                                                     ^
    75.   		{
    76.   		(*p)+=2;
