crypto/pem/pem_lib.c:257: error: BUFFER_OVERRUN_L3
  Offset: [-12, +oo] Size: [1, 241] by call to `check_pem`.
Showing all 10 steps of the trace


crypto/pem/pem_lib.c:252:14: Call
250.           pem_free(header, flags, 0);
251.           pem_free(data, flags, len);
252.           if (!PEM_read_bio_ex(bp, &nm, &header, &data, &len, flags)) {
                    ^
253.               if (ERR_GET_REASON(ERR_peek_error()) == PEM_R_NO_START_LINE)
254.                   ERR_add_error_data(2, "Expecting: ", name);

crypto/pem/pem_lib.c:951:5: Assignment
  949.       }
  950.       BIO_read(headerB, *header, headerlen);
  951.       (*header)[headerlen] = '\0';
             ^
  952.       BIO_read(dataB, *data, len);
  953.       *len_out = len;

crypto/pem/pem_lib.c:257:15: Call
255.               return 0;
256.           }
257.       } while (!check_pem(nm, name));
                     ^
258.       if (!PEM_get_EVP_CIPHER_INFO(header, &cipher))
259.           goto err;

crypto/pem/pem_lib.c:128:1: Parameter `*nm`
  126.   #endif
  127.   
  128. > static int check_pem(const char *nm, const char *name)
  129.   {
  130.       /* Normal matching nm and name */

crypto/pem/pem_lib.c:143:16: Call
  141.           if (strcmp(nm, PEM_STRING_PKCS8INF) == 0)
  142.               return 1;
  143.           slen = pem_check_suffix(nm, "PRIVATE KEY");
                        ^
  144.           if (slen > 0) {
  145.               /*

crypto/pem/pem_lib.c:978:1: <Length trace>
976.    */
977.   
978. > int pem_check_suffix(const char *pem_str, const char *suffix)
979.   {
980.       int pem_len = strlen(pem_str);

crypto/pem/pem_lib.c:978:1: Parameter `*pem_str`
    976.    */
    977.   
    978. > int pem_check_suffix(const char *pem_str, const char *suffix)
    979.   {
    980.       int pem_len = strlen(pem_str);

crypto/pem/pem_lib.c:985:5: Assignment
    983.       if (suffix_len + 1 >= pem_len)
    984.           return 0;
    985.       p = pem_str + pem_len - suffix_len;
               ^
    986.       if (strcmp(p, suffix))
    987.           return 0;

crypto/pem/pem_lib.c:988:5: Assignment
    986.       if (strcmp(p, suffix))
    987.           return 0;
    988.       p--;
               ^
    989.       if (*p != ' ')
    990.           return 0;

crypto/pem/pem_lib.c:989:9: Array access: Offset: [-12, +oo] Size: [1, 241] by call to `check_pem` 
    987.           return 0;
    988.       p--;
    989.       if (*p != ' ')
                   ^
    990.           return 0;
    991.       return p - pem_str;
