crypto/pkcs7/pk7_doit.c:586: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] (⇐ [2, +oo] + [0, +oo]) Size: [0, +oo] by call to `i2d_ASN1_SET`.
Showing all 22 steps of the trace


crypto/pkcs7/pk7_doit.c:582:7: Call
580.   				/* Now sign the mess */
581.   				EVP_SignInit(&ctx_tmp,md_tmp);
582.   				x=i2d_ASN1_SET(sk,NULL,i2d_X509_ATTRIBUTE,
             ^
583.   					V_ASN1_SET,V_ASN1_UNIVERSAL, IS_SET);
584.   				pp=(unsigned char *)Malloc(x);

crypto/asn1/a_set.c:96:17: Assignment
  94.           int totSize;
  95.   
  96.   	if (a == NULL) return(0);
                        ^
  97.   	for (i=sk_num(a)-1; i>=0; i--)
  98.   		ret+=func(sk_value(a,i),NULL);

crypto/pkcs7/pk7_doit.c:582:5: Assignment
580.   				/* Now sign the mess */
581.   				EVP_SignInit(&ctx_tmp,md_tmp);
582.   				x=i2d_ASN1_SET(sk,NULL,i2d_X509_ATTRIBUTE,
           ^
583.   					V_ASN1_SET,V_ASN1_UNIVERSAL, IS_SET);
584.   				pp=(unsigned char *)Malloc(x);

crypto/pkcs7/pk7_doit.c:584:25: Array declaration
582.   				x=i2d_ASN1_SET(sk,NULL,i2d_X509_ATTRIBUTE,
583.   					V_ASN1_SET,V_ASN1_UNIVERSAL, IS_SET);
584.   				pp=(unsigned char *)Malloc(x);
                               ^
585.   				p=pp;
586.   				i2d_ASN1_SET(sk,&p,i2d_X509_ATTRIBUTE,

crypto/pkcs7/pk7_doit.c:584:5: Assignment
582.   				x=i2d_ASN1_SET(sk,NULL,i2d_X509_ATTRIBUTE,
583.   					V_ASN1_SET,V_ASN1_UNIVERSAL, IS_SET);
584.   				pp=(unsigned char *)Malloc(x);
           ^
585.   				p=pp;
586.   				i2d_ASN1_SET(sk,&p,i2d_X509_ATTRIBUTE,

crypto/pkcs7/pk7_doit.c:585:5: Assignment
583.   					V_ASN1_SET,V_ASN1_UNIVERSAL, IS_SET);
584.   				pp=(unsigned char *)Malloc(x);
585.   				p=pp;
           ^
586.   				i2d_ASN1_SET(sk,&p,i2d_X509_ATTRIBUTE,
587.   					V_ASN1_SET,V_ASN1_UNIVERSAL, IS_SET);

crypto/pkcs7/pk7_doit.c:586:5: Call
584.   				pp=(unsigned char *)Malloc(x);
585.   				p=pp;
586.   				i2d_ASN1_SET(sk,&p,i2d_X509_ATTRIBUTE,
           ^
587.   					V_ASN1_SET,V_ASN1_UNIVERSAL, IS_SET);
588.   				EVP_SignUpdate(&ctx_tmp,pp,x);

crypto/asn1/a_set.c:86:1: Parameter `**pp`
  84.   
  85.   /* int is_set:  if TRUE, then sort the contents (i.e. it isn't a SEQUENCE)    */
  86. > int i2d_ASN1_SET(STACK *a, unsigned char **pp, int (*func)(), int ex_tag,
  87.   	     int ex_class, int is_set)
  88.   	{

crypto/asn1/a_set.c:102:2: Assignment
  100.   	if (pp == NULL) return(r);
  101.   
  102.   	p= *pp;
          ^
  103.   	ASN1_put_object(&p,1,ret,ex_tag,ex_class);
  104.   

crypto/asn1/a_set.c:103:2: Call
  101.   
  102.   	p= *pp;
  103.   	ASN1_put_object(&p,1,ret,ex_tag,ex_class);
          ^
  104.   
  105.   /* Modified by gp@nsj.co.jp */

crypto/asn1/asn1_lib.c:180:1: Parameter `**pp`
    178.   /* class 0 is constructed
    179.    * constructed == 2 for indefinitle length constructed */
    180. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
    181.   	     int xclass)
    182.   	{

crypto/asn1/asn1_lib.c:183:2: Assignment
    181.   	     int xclass)
    182.   	{
    183.   	unsigned char *p= *pp;
            ^
    184.   	int i;
    185.   

crypto/asn1/asn1_lib.c:189:5: Assignment
    187.   	i|=(xclass&V_ASN1_PRIVATE);
    188.   	if (tag < 31)
    189.   		*(p++)=i|(tag&V_ASN1_PRIMATIVE_TAG);
               ^
    190.   	else
    191.   		{

crypto/asn1/asn1_lib.c:203:3: Call
    201.   		*(p++)=0x80; /* der_put_length would output 0 instead */
    202.   	else
    203.   		asn1_put_length(&p,length);
             ^
    204.   	*pp=p;
    205.   	}

crypto/asn1/asn1_lib.c:216:8: <Offset trace>
214.   		{
215.   		l=length;
216.   		for (i=0; l > 0; i++)
              ^
217.   			l>>=8;
218.   		*(p++)=i|0x80;

crypto/asn1/asn1_lib.c:216:8: Assignment
      214.   		{
      215.   		l=length;
      216.   		for (i=0; l > 0; i++)
                    ^
      217.   			l>>=8;
      218.   		*(p++)=i|0x80;

crypto/asn1/asn1_lib.c:220:10: Assignment
      218.   		*(p++)=i|0x80;
      219.   		l=i;
      220.   		while (i-- > 0)
                      ^
      221.   			{
      222.   			p[i]=length&0xff;

crypto/asn1/asn1_lib.c:207:1: <Length trace>
205.   	}
206.   
207. > static void asn1_put_length(unsigned char **pp, int length)
208.   	{
209.   	unsigned char *p= *pp;

crypto/asn1/asn1_lib.c:207:1: Parameter `**pp`
      205.   	}
      206.   
      207. > static void asn1_put_length(unsigned char **pp, int length)
      208.   	{
      209.   	unsigned char *p= *pp;

crypto/asn1/asn1_lib.c:209:2: Assignment
      207.   static void asn1_put_length(unsigned char **pp, int length)
      208.   	{
      209.   	unsigned char *p= *pp;
              ^
      210.   	int i,l;
      211.   	if (length <= 127)

crypto/asn1/asn1_lib.c:218:5: Assignment
      216.   		for (i=0; l > 0; i++)
      217.   			l>>=8;
      218.   		*(p++)=i|0x80;
                 ^
      219.   		l=i;
      220.   		while (i-- > 0)

crypto/asn1/asn1_lib.c:222:4: Array access: Offset: [2, +oo] (⇐ [2, +oo] + [0, +oo]) Size: [0, +oo] by call to `i2d_ASN1_SET` 
      220.   		while (i-- > 0)
      221.   			{
      222.   			p[i]=length&0xff;
                ^
      223.   			length>>=8;
      224.   			}
