apps/req.c:638: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: [0, +oo] by call to `make_REQ`.
Showing all 14 steps of the trace


apps/req.c:632:8: Call
630.   		if (req == NULL)
631.   			{
632.   			req=X509_REQ_new();
              ^
633.   			if (req == NULL)
634.   				{

crypto/asn1/x_req.c:207:2: Call
  205.   	M_ASN1_New_Malloc(ret,X509_REQ);
  206.   	ret->references=1;
  207.   	M_ASN1_New(ret->req_info,X509_REQ_INFO_new);
          ^
  208.   	M_ASN1_New(ret->sig_alg,X509_ALGOR_new);
  209.   	M_ASN1_New(ret->signature,ASN1_BIT_STRING_new);

crypto/asn1/x_req.c:156:2: Call
    154.   	M_ASN1_New(ret->subject,X509_NAME_new);
    155.   	M_ASN1_New(ret->pubkey,X509_PUBKEY_new);
    156.   	M_ASN1_New(ret->attributes,sk_new_null);
            ^
    157.   	ret->req_kludge=0;
    158.   	return(ret);

crypto/stack/stack.c:130:2: Assignment
      128.   	ret->comp=c;
      129.   	ret->num_alloc=MIN_NODES;
      130.   	ret->num=0;
              ^
      131.   	ret->sorted=0;
      132.   	return(ret);

apps/req.c:638:6: Call
636.   				}
637.   
638.   			i=make_REQ(req,pkey,!x509);
            ^
639.   			if (kludge >= 0)
640.   				req->req_info->req_kludge=kludge;

apps/req.c:826:1: Parameter `*req->req_info->subject->entries->data`
  824.   	}
  825.   
  826. > static int make_REQ(X509_REQ *req, EVP_PKEY *pkey, int attribs)
  827.   	{
  828.   	int ret=0,i;

apps/req.c:917:9: Call
  915.   			max=(int)CONF_get_number(req_conf,tmp,buf);
  916.   
  917.   			if (!add_DN_object(ri->subject,v->value,def,value,nid,
                 ^
  918.   				min,max))
  919.   				goto err;

apps/req.c:982:1: Parameter `*n->entries->data`
    980.   	}
    981.   
    982. > static int add_DN_object(X509_NAME *n, char *text, char *def, char *value,
    983.   	     int nid, int min, int max)
    984.   	{

apps/req.c:1027:7: Call
    1025.   		strlen(buf)))
    1026.   		== NULL) goto err;
    1027.   	if (!X509_NAME_add_entry(n,ne,X509_NAME_entry_count(n),0))
                  ^
    1028.   		goto err;
    1029.   

crypto/x509/x509name.c:174:1: <Offset trace>
172.   /* if set is -1, append to previous set, 0 'a new one', and 1,
173.    * prepend to the guy we are about to stomp on. */
174. > int X509_NAME_add_entry(X509_NAME *name, X509_NAME_ENTRY *ne, int loc,
175.   	     int set)
176.   	{

crypto/x509/x509name.c:174:1: Parameter `loc`
      172.   /* if set is -1, append to previous set, 0 'a new one', and 1,
      173.    * prepend to the guy we are about to stomp on. */
      174. > int X509_NAME_add_entry(X509_NAME *name, X509_NAME_ENTRY *ne, int loc,
      175.   	     int set)
      176.   	{

crypto/x509/x509name.c:174:1: <Length trace>
172.   /* if set is -1, append to previous set, 0 'a new one', and 1,
173.    * prepend to the guy we are about to stomp on. */
174. > int X509_NAME_add_entry(X509_NAME *name, X509_NAME_ENTRY *ne, int loc,
175.   	     int set)
176.   	{

crypto/x509/x509name.c:174:1: Parameter `*name->entries->data`
      172.   /* if set is -1, append to previous set, 0 'a new one', and 1,
      173.    * prepend to the guy we are about to stomp on. */
      174. > int X509_NAME_add_entry(X509_NAME *name, X509_NAME_ENTRY *ne, int loc,
      175.   	     int set)
      176.   	{

crypto/x509/x509name.c:198:28: Array access: Offset: [-1, +oo] Size: [0, +oo] by call to `make_REQ` 
      196.   		else
      197.   			{
      198.   			set=((X509_NAME_ENTRY *)sk_value(sk,loc-1))->set;
                                        ^
      199.   			inc=0;
      200.   			}
