crypto/asn1/n_pkey.c:149: error: BUFFER_OVERRUN_L3
  Offset added: [4, +oo] (⇐ [4, +oo] + [0, 1]) Size: [0, +oo] by call to `i2d_RSAPrivateKey`.
Showing all 23 steps of the trace


crypto/asn1/n_pkey.c:110:7: Call
108.   	pkey->algor->parameter->type=V_ASN1_NULL;
109.   
110.   	l[0]=i2d_RSAPrivateKey(a,NULL);
             ^
111.   	pkey->private_key->length=l[0];
112.   

crypto/asn1/i2d_r_pr.c:75:17: Assignment
  73.   	unsigned char *p;
  74.   
  75.   	if (a == NULL) return(0);
                        ^
  76.   
  77.   	num[1]=a->n;

crypto/asn1/n_pkey.c:110:2: Assignment
108.   	pkey->algor->parameter->type=V_ASN1_NULL;
109.   
110.   	l[0]=i2d_RSAPrivateKey(a,NULL);
        ^
111.   	pkey->private_key->length=l[0];
112.   

crypto/asn1/n_pkey.c:143:48: Array declaration
141.   	if (pkey->private_key->data != NULL)
142.   		Free((char *)pkey->private_key->data);
143.   	if ((pkey->private_key->data=(unsigned char *)Malloc(l[0])) == NULL)
                                                      ^
144.   		{
145.   		ASN1err(ASN1_F_I2D_NETSCAPE_RSA,ERR_R_MALLOC_FAILURE);

crypto/asn1/n_pkey.c:143:7: Assignment
141.   	if (pkey->private_key->data != NULL)
142.   		Free((char *)pkey->private_key->data);
143.   	if ((pkey->private_key->data=(unsigned char *)Malloc(l[0])) == NULL)
             ^
144.   		{
145.   		ASN1err(ASN1_F_I2D_NETSCAPE_RSA,ERR_R_MALLOC_FAILURE);

crypto/asn1/n_pkey.c:148:2: Assignment
146.   		goto err;
147.   		}
148.   	zz=pkey->private_key->data;
        ^
149.   	i2d_RSAPrivateKey(a,&zz);
150.   

crypto/asn1/n_pkey.c:149:2: Call
147.   		}
148.   	zz=pkey->private_key->data;
149.   	i2d_RSAPrivateKey(a,&zz);
        ^
150.   
151.   	if ((os2.data=(unsigned char *)Malloc(os2.length)) == NULL)

crypto/asn1/i2d_r_pr.c:86:2: Assignment
  84.   	num[8]=a->iqmp;
  85.   
  86.   	bs.length=1;
         ^
  87.   	bs.data=data;
  88.   	bs.type=V_ASN1_INTEGER;

crypto/asn1/i2d_r_pr.c:91:6: Call
  89.   	data[0]=a->version&0x7f;
  90.   
  91.   	tot=i2d_ASN1_INTEGER(&(bs),NULL);
             ^
  92.   	for (i=1; i<9; i++)
  93.   		{

crypto/asn1/a_int.c:63:1: Parameter `a->length`
    61.   #include <openssl/asn1.h>
    62.   
    63. > int i2d_ASN1_INTEGER(ASN1_INTEGER *a, unsigned char **pp)
    64.   	{
    65.   	int pad=0,ret,r,i,t;

crypto/asn1/i2d_r_pr.c:108:2: Call
  106.   	ASN1_put_object(&p,1,tot,V_ASN1_SEQUENCE,V_ASN1_UNIVERSAL);
  107.   
  108.   	i2d_ASN1_INTEGER(&bs,&p);
          ^
  109.   
  110.   	bs.data=(unsigned char *)Malloc(max+4);

crypto/asn1/a_int.c:63:1: <Offset trace>
61.   #include <openssl/asn1.h>
62.   
63. > int i2d_ASN1_INTEGER(ASN1_INTEGER *a, unsigned char **pp)
64.   	{
65.   	int pad=0,ret,r,i,t;

crypto/asn1/a_int.c:63:1: Parameter `a->length`
    61.   #include <openssl/asn1.h>
    62.   
    63. > int i2d_ASN1_INTEGER(ASN1_INTEGER *a, unsigned char **pp)
    64.   	{
    65.   	int pad=0,ret,r,i,t;

crypto/asn1/a_int.c:63:1: <Length trace>
61.   #include <openssl/asn1.h>
62.   
63. > int i2d_ASN1_INTEGER(ASN1_INTEGER *a, unsigned char **pp)
64.   	{
65.   	int pad=0,ret,r,i,t;

crypto/asn1/a_int.c:63:1: Parameter `**pp`
    61.   #include <openssl/asn1.h>
    62.   
    63. > int i2d_ASN1_INTEGER(ASN1_INTEGER *a, unsigned char **pp)
    64.   	{
    65.   	int pad=0,ret,r,i,t;

crypto/asn1/a_int.c:90:2: Assignment
    88.   	r=ASN1_object_size(0,ret,V_ASN1_INTEGER);
    89.   	if (pp == NULL) return(r);
    90.   	p= *pp;
           ^
    91.   
    92.   	ASN1_put_object(&p,0,ret,V_ASN1_INTEGER,V_ASN1_UNIVERSAL);

crypto/asn1/a_int.c:92:2: Call
    90.   	p= *pp;
    91.   
    92.   	ASN1_put_object(&p,0,ret,V_ASN1_INTEGER,V_ASN1_UNIVERSAL);
           ^
    93.   	if (pad) *(p++)=pb;
    94.   	if (a->length == 0)

crypto/asn1/asn1_lib.c:180:1: Parameter `**pp`
      178.   /* class 0 is constructed
      179.    * constructed == 2 for indefinitle length constructed */
      180. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
      181.   	     int xclass)
      182.   	{

crypto/asn1/asn1_lib.c:183:2: Assignment
      181.   	     int xclass)
      182.   	{
      183.   	unsigned char *p= *pp;
              ^
      184.   	int i;
      185.   

crypto/asn1/asn1_lib.c:189:5: Assignment
      187.   	i|=(xclass&V_ASN1_PRIVATE);
      188.   	if (tag < 31)
      189.   		*(p++)=i|(tag&V_ASN1_PRIMATIVE_TAG);
                 ^
      190.   	else
      191.   		{

crypto/asn1/asn1_lib.c:201:5: Assignment
      199.   		}
      200.   	if ((constructed == 2) && (length == 0))
      201.   		*(p++)=0x80; /* der_put_length would output 0 instead */
                 ^
      202.   	else
      203.   		asn1_put_length(&p,length);

crypto/asn1/asn1_lib.c:204:2: Assignment
      202.   	else
      203.   		asn1_put_length(&p,length);
      204.   	*pp=p;
              ^
      205.   	}
      206.   

crypto/asn1/a_int.c:98:3: Array access: Offset added: [4, +oo] (⇐ [4, +oo] + [0, 1]) Size: [0, +oo] by call to `i2d_RSAPrivateKey` 
    96.   	else if (t == V_ASN1_INTEGER)
    97.   		{
    98.   		memcpy(p,a->data,(unsigned int)a->length);
             ^
    99.   		p+=a->length;
    100.   		}
