crypto/pkcs7/pk7_smime.c:125: error: BUFFER_OVERRUN_L3
  Offset: [0, 4] Size: [0, 5] by call to `PKCS7_add_attrib_smimecap`.
Showing all 24 steps of the trace


crypto/pkcs7/pk7_smime.c:112:16: Call
110.   				V_ASN1_OBJECT, OBJ_nid2obj(NID_pkcs7_data));
111.   		/* Add SMIMECapabilities */
112.   		if(!(smcap = sk_new(NULL))) {
                      ^
113.   			PKCS7err(PKCS7_F_PKCS7_SIGN,ERR_R_MALLOC_FAILURE);
114.   			return NULL;

crypto/stack/stack.c:125:2: Assignment
  123.   	ret->comp=c;
  124.   	ret->num_alloc=MIN_NODES;
  125.   	ret->num=0;
          ^
  126.   	ret->sorted=0;
  127.   	return(ret);

crypto/pkcs7/pk7_smime.c:117:3: Call
115.   		}
116.   #ifndef NO_DES
117.   		PKCS7_simple_smimecap (smcap, NID_des_ede3_cbc, -1);
         ^
118.   		PKCS7_simple_smimecap (smcap, NID_des_cbc, -1);
119.   #endif

crypto/pkcs7/pk7_attr.c:57:1: Parameter `sk->num`
  55.   
  56.   /* Basic smime-capabilities OID and optional integer arg */
  57. > int PKCS7_simple_smimecap(STACK *sk, int nid, int arg)
  58.   {
  59.   	X509_ALGOR *alg;

crypto/pkcs7/pk7_smime.c:118:3: Call
116.   #ifndef NO_DES
117.   		PKCS7_simple_smimecap (smcap, NID_des_ede3_cbc, -1);
118.   		PKCS7_simple_smimecap (smcap, NID_des_cbc, -1);
         ^
119.   #endif
120.   #ifndef NO_RC2

crypto/pkcs7/pk7_attr.c:57:1: Parameter `sk->num`
  55.   
  56.   /* Basic smime-capabilities OID and optional integer arg */
  57. > int PKCS7_simple_smimecap(STACK *sk, int nid, int arg)
  58.   {
  59.   	X509_ALGOR *alg;

crypto/pkcs7/pk7_smime.c:121:3: Call
119.   #endif
120.   #ifndef NO_RC2
121.   		PKCS7_simple_smimecap (smcap, NID_rc2_cbc, 40);
         ^
122.   		PKCS7_simple_smimecap (smcap, NID_rc2_cbc, 128);
123.   		PKCS7_simple_smimecap (smcap, NID_rc2_cbc, 64);

crypto/pkcs7/pk7_attr.c:57:1: Parameter `sk->num`
  55.   
  56.   /* Basic smime-capabilities OID and optional integer arg */
  57. > int PKCS7_simple_smimecap(STACK *sk, int nid, int arg)
  58.   {
  59.   	X509_ALGOR *alg;

crypto/pkcs7/pk7_smime.c:122:3: Call
120.   #ifndef NO_RC2
121.   		PKCS7_simple_smimecap (smcap, NID_rc2_cbc, 40);
122.   		PKCS7_simple_smimecap (smcap, NID_rc2_cbc, 128);
         ^
123.   		PKCS7_simple_smimecap (smcap, NID_rc2_cbc, 64);
124.   #endif

crypto/pkcs7/pk7_attr.c:57:1: Parameter `sk->num`
  55.   
  56.   /* Basic smime-capabilities OID and optional integer arg */
  57. > int PKCS7_simple_smimecap(STACK *sk, int nid, int arg)
  58.   {
  59.   	X509_ALGOR *alg;

crypto/pkcs7/pk7_smime.c:123:3: Call
121.   		PKCS7_simple_smimecap (smcap, NID_rc2_cbc, 40);
122.   		PKCS7_simple_smimecap (smcap, NID_rc2_cbc, 128);
123.   		PKCS7_simple_smimecap (smcap, NID_rc2_cbc, 64);
         ^
124.   #endif
125.   		PKCS7_add_attrib_smimecap (si, smcap);

crypto/pkcs7/pk7_attr.c:57:1: Parameter `sk->num`
  55.   
  56.   /* Basic smime-capabilities OID and optional integer arg */
  57. > int PKCS7_simple_smimecap(STACK *sk, int nid, int arg)
  58.   {
  59.   	X509_ALGOR *alg;

crypto/pkcs7/pk7_smime.c:125:3: Call
123.   		PKCS7_simple_smimecap (smcap, NID_rc2_cbc, 64);
124.   #endif
125.   		PKCS7_add_attrib_smimecap (si, smcap);
         ^
126.   		sk_pop_free(smcap, X509_ALGOR_free);
127.   	}

crypto/pkcs7/pk7_attr.c:17:1: Parameter `cap->num`
  15.   #include <openssl/err.h>
  16.   
  17. > int PKCS7_add_attrib_smimecap(PKCS7_SIGNER_INFO *si, STACK *cap)
  18.   {
  19.   	ASN1_STRING *seq;

crypto/pkcs7/pk7_attr.c:22:6: Call
  20.   	unsigned char *p, *pp;
  21.   	int len;
  22.   	len=i2d_ASN1_SET(cap,NULL,i2d_X509_ALGOR, V_ASN1_SEQUENCE,
             ^
  23.   						V_ASN1_UNIVERSAL, IS_SEQUENCE);
  24.   	if(!(pp=(unsigned char *)Malloc(len))) {

crypto/asn1/a_set.c:122:14: <Offset trace>
120.   we will store the SET blobs */
121.   
122.           for (i=0; i<sk_num(a); i++)
                    ^
123.   	        {
124.                   rgSetBlob[i].pbData = p;  /* catch each set encode blob */

crypto/asn1/a_set.c:122:14: Assignment
    120.   we will store the SET blobs */
    121.   
    122.           for (i=0; i<sk_num(a); i++)
                        ^
    123.   	        {
    124.                   rgSetBlob[i].pbData = p;  /* catch each set encode blob */

crypto/asn1/a_set.c:86:1: <Length trace>
84.   
85.   /* int is_set:  if TRUE, then sort the contents (i.e. it isn't a SEQUENCE)    */
86. > int i2d_ASN1_SET(STACK *a, unsigned char **pp, int (*func)(), int ex_tag,
87.   	     int ex_class, int is_set)
88.   	{

crypto/asn1/a_set.c:86:1: Parameter `a->num`
    84.   
    85.   /* int is_set:  if TRUE, then sort the contents (i.e. it isn't a SEQUENCE)    */
    86. > int i2d_ASN1_SET(STACK *a, unsigned char **pp, int (*func)(), int ex_tag,
    87.   	     int ex_class, int is_set)
    88.   	{

crypto/asn1/a_set.c:119:39: Call
    117.   
    118.           pStart  = p; /* Catch the beg of Setblobs*/
    119.           rgSetBlob = (MYBLOB *)Malloc( sk_num(a) * sizeof(MYBLOB)); /* In this array
                                                 ^
    120.   we will store the SET blobs */
    121.   

crypto/stack/stack.c:285:17: Assignment
      283.   int sk_num(STACK *st)
      284.   {
      285.   	if(st == NULL) return -1;
                             ^
      286.   	return st->num;
      287.   }

crypto/asn1/a_set.c:119:31: Array declaration
    117.   
    118.           pStart  = p; /* Catch the beg of Setblobs*/
    119.           rgSetBlob = (MYBLOB *)Malloc( sk_num(a) * sizeof(MYBLOB)); /* In this array
                                         ^
    120.   we will store the SET blobs */
    121.   

crypto/asn1/a_set.c:119:9: Assignment
    117.   
    118.           pStart  = p; /* Catch the beg of Setblobs*/
    119.           rgSetBlob = (MYBLOB *)Malloc( sk_num(a) * sizeof(MYBLOB)); /* In this array
                   ^
    120.   we will store the SET blobs */
    121.   

crypto/asn1/a_set.c:124:17: Array access: Offset: [0, 4] Size: [0, 5] by call to `PKCS7_add_attrib_smimecap` 
    122.           for (i=0; i<sk_num(a); i++)
    123.   	        {
    124.                   rgSetBlob[i].pbData = p;  /* catch each set encode blob */
                           ^
    125.                   func(sk_value(a,i),&p);
    126.                   rgSetBlob[i].cbData = p - rgSetBlob[i].pbData; /* Length of this
