crypto/x509/x509_lu.c:623: error: BUFFER_OVERRUN_L3
  Offset added: [12, +oo] (⇐ [0, +oo] + 12) Size: [8, +oo] by call to `x509_check_cert_time`.
Showing all 13 steps of the trace


crypto/x509/x509_lu.c:608:10: Call
606.       *issuer = NULL;
607.       xn = X509_get_issuer_name(x);
608.       ok = X509_STORE_get_by_subject(ctx, X509_LU_X509, xn, &obj);
                ^
609.       if (ok != X509_LU_X509) {
610.           if (ok == X509_LU_RETRY) {

crypto/x509/x509_lu.c:296:11: Call
  294.   
  295.       CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
  296.       tmp = X509_OBJECT_retrieve_by_subject(ctx->objs, type, name);
                   ^
  297.       CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
  298.   

crypto/x509/x509_lu.c:472:11: Call
    470.   {
    471.       int idx;
    472.       idx = X509_OBJECT_idx_by_subject(h, type, name);
                     ^
    473.       if (idx == -1)
    474.           return NULL;

crypto/x509/x509_lu.c:465:12: Call
      463.                                  X509_NAME *name)
      464.   {
      465.       return x509_object_idx_cnt(h, type, name, NULL);
                        ^
      466.   }
      467.   

crypto/x509/x509_lu.c:454:17: Call
        452.           for (tidx = idx + 1; tidx < sk_X509_OBJECT_num(h); tidx++) {
        453.               tobj = sk_X509_OBJECT_value(h, tidx);
        454.               if (x509_object_cmp(&tobj, &pstmp))
                               ^
        455.                   break;
        456.               (*pnmatch)++;

crypto/x509/x509_lu.c:158:1: Parameter `(*a)->data.x509->cert_info.subject->data`
          156.   }
          157.   
          158. > static int x509_object_cmp(const X509_OBJECT *const *a,
          159.                              const X509_OBJECT *const *b)
          160.   {

crypto/x509/x509_lu.c:623:13: Call
621.       /* If certificate matches all OK */
622.       if (ctx->check_issued(ctx, x, obj.data.x509)) {
623.           if (x509_check_cert_time(ctx, obj.data.x509, 1)) {
                   ^
624.               *issuer = obj.data.x509;
625.               return 1;

crypto/x509/x509_vfy.c:1488:1: Parameter `*x->cert_info.validity.notBefore->data`
  1486.   }
  1487.   
  1488. > int x509_check_cert_time(X509_STORE_CTX *ctx, X509 *x, int quiet)
  1489.   {
  1490.       time_t *ptime;

crypto/x509/x509_vfy.c:1500:9: Call
  1498.           ptime = NULL;
  1499.   
  1500.       i = X509_cmp_time(X509_get_notBefore(x), ptime);
                  ^
  1501.       if (i == 0) {
  1502.           if (quiet)

crypto/x509/x509_vfy.c:1644:1: <Length trace>
1642.   }
1643.   
1644. > int X509_cmp_time(const ASN1_TIME *ctm, time_t *cmp_time)
1645.   {
1646.       char *str;

crypto/x509/x509_vfy.c:1644:1: Parameter `*ctm->data`
    1642.   }
    1643.   
    1644. > int X509_cmp_time(const ASN1_TIME *ctm, time_t *cmp_time)
    1645.   {
    1646.       char *str;

crypto/x509/x509_vfy.c:1654:5: Assignment
    1652.       p = buff1;
    1653.       remaining = ctm->length;
    1654.       str = (char *)ctm->data;
                ^
    1655.       /*
    1656.        * Note that the following (historical) code allows much more slack in the

crypto/x509/x509_vfy.c:1677:9: Array access: Offset added: [12, +oo] (⇐ [0, +oo] + 12) Size: [8, +oo] by call to `x509_check_cert_time` 
    1675.           if (remaining < min_length || remaining > max_length)
    1676.               return 0;
    1677.           memcpy(p, str, 12);
                    ^
    1678.           p += 12;
    1679.           str += 12;
