apps/ca.c:1354: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, +oo] by call to `X509_REQ_get_pubkey`.
Showing all 20 steps of the trace


apps/ca.c:1343:11: Call
1341.   		goto err;
1342.   		}
1343.   	if ((req=PEM_read_bio_X509_REQ(in,NULL,NULL)) == NULL)
                  ^
1344.   		{
1345.   		BIO_printf(bio_err,"Error reading certificate request in %s\n",

crypto/pem/pem_all.c:70:1: Call
  68.   IMPLEMENT_PEM_rw(X509, X509, PEM_STRING_X509, X509)
  69.   
  70. > IMPLEMENT_PEM_rw(X509_REQ, X509_REQ, PEM_STRING_X509_REQ, X509_REQ)
  71.   
  72.   IMPLEMENT_PEM_rw(X509_CRL, X509_CRL, PEM_STRING_X509_CRL, X509_CRL)

crypto/pem/pem_lib.c:221:9: Call
    219.   			int klen;
    220.   			char psbuf[PEM_BUFSIZE];
    221.   			p8 = d2i_X509_SIG((X509_SIG **)x, &p, len);
                   ^
    222.   			if(!p8) goto p8err;
    223.   			if (cb) klen=cb(psbuf,PEM_BUFSIZE,0);

crypto/asn1/x_sig.c:78:1: Parameter `(*a)->algor->parameter->value.ptr->data`
      76.   	}
      77.   
      78. > X509_SIG *d2i_X509_SIG(X509_SIG **a, unsigned char **pp, long length)
      79.   	{
      80.   	M_ASN1_D2I_vars(a,X509_SIG *,X509_SIG_new);

apps/ca.c:1354:13: Call
1352.   	BIO_printf(bio_err,"Check that the request matches the signature\n");
1353.   
1354.   	if ((pktmp=X509_REQ_get_pubkey(req)) == NULL)
                    ^
1355.   		{
1356.   		BIO_printf(bio_err,"error unpacking public key\n");

crypto/x509/x509_req.c:109:1: Parameter `*req->req_info->pubkey->algor->parameter->value.sequence->data`
  107.   	}
  108.   
  109. > EVP_PKEY *X509_REQ_get_pubkey(X509_REQ *req)
  110.   	{
  111.   	if ((req == NULL) || (req->req_info == NULL))

crypto/x509/x509_req.c:113:9: Call
  111.   	if ((req == NULL) || (req->req_info == NULL))
  112.   		return(NULL);
  113.   	return(X509_PUBKEY_get(req->req_info->pubkey));
                 ^
  114.   	}
  115.   

crypto/asn1/x_pubkey.c:200:1: Parameter `*key->algor->parameter->value.sequence->data`
    198.   	}
    199.   
    200. > EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)
    201.   	{
    202.   	EVP_PKEY *ret=NULL;

crypto/asn1/x_pubkey.c:237:4: Assignment
    235.   			{
    236.   			ret->pkey.dsa->write_params=0;
    237.   			p=a->parameter->value.sequence->data;
              ^
    238.   			j=a->parameter->value.sequence->length;
    239.   			if (!d2i_DSAparams(&ret->pkey.dsa,&p,(long)j))

crypto/asn1/x_pubkey.c:239:9: Call
    237.   			p=a->parameter->value.sequence->data;
    238.   			j=a->parameter->value.sequence->length;
    239.   			if (!d2i_DSAparams(&ret->pkey.dsa,&p,(long)j))
                   ^
    240.   				goto err;
    241.   			}

crypto/asn1/d2i_dsap.c:71:1: Parameter `**pp`
      69.   #endif
      70.   
      71. > DSA *d2i_DSAparams(DSA **a, unsigned char **pp, long length)
      72.   	{
      73.   	int i=ERR_R_NESTED_ASN1_ERROR;

crypto/asn1/d2i_dsap.c:77:2: Assignment
      75.   	M_ASN1_D2I_vars(a,DSA *,DSA_new);
      76.   
      77.   	M_ASN1_D2I_Init();
             ^
      78.   	M_ASN1_D2I_start_sequence();
      79.   	M_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);

crypto/asn1/d2i_dsap.c:78:2: Call
      76.   
      77.   	M_ASN1_D2I_Init();
      78.   	M_ASN1_D2I_start_sequence();
             ^
      79.   	M_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);
      80.   	if ((ret->p=BN_bin2bn(bs->data,bs->length,ret->p)) == NULL) goto err_bn;

crypto/asn1/asn1_lib.c:277:1: Parameter `*c->p`
        275.   	}
        276.   
        277. > int asn1_GetSequence(ASN1_CTX *c, long *length)
        278.   	{
        279.   	unsigned char *q;

crypto/asn1/asn1_lib.c:282:9: Call
        280.   
        281.   	q=c->p;
        282.   	c->inf=ASN1_get_object(&(c->p),&(c->slen),&(c->tag),&(c->xclass),
                       ^
        283.   		*length);
        284.   	if (c->inf & 0x80)

crypto/asn1/asn1_lib.c:83:1: <Length trace>
81.   
82.   
83. > int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
84.   	     long omax)
85.   	{

crypto/asn1/asn1_lib.c:83:1: Parameter `**pp`
          81.   
          82.   
          83. > int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
          84.   	     long omax)
          85.   	{

crypto/asn1/asn1_lib.c:88:2: Assignment
          86.   	int i,ret;
          87.   	long l;
          88.   	unsigned char *p= *pp;
                 ^
          89.   	int tag,xclass,inf;
          90.   	long max=omax;

crypto/asn1/asn1_lib.c:98:3: Assignment
          96.   	if (i == V_ASN1_PRIMITIVE_TAG)
          97.   		{		/* high-tag */
          98.   		p++;
                   ^
          99.   		if (--max == 0) goto err;
          100.   		l=0;

crypto/asn1/asn1_lib.c:101:10: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `X509_REQ_get_pubkey` 
          99.   		if (--max == 0) goto err;
          100.   		l=0;
          101.   		while (*p&0x80)
                          ^
          102.   			{
          103.   			l<<=7L;
