apps/pkeyutl.c:315: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] (⇐ [0, +oo] + -1) Size: [1, +oo] by call to `ASN1_parse_dump`.
Showing all 18 steps of the trace


apps/pkeyutl.c:124:5: Assignment
122.       char *infile = NULL, *outfile = NULL, *sigfile = NULL, *passinarg = NULL;
123.       char hexdump = 0, asn1parse = 0, rev = 0, *prog;
124.       unsigned char *buf_in = NULL, *buf_out = NULL, *sig = NULL;
           ^
125.       OPTION_CHOICE o;
126.       int buf_inlen = 0, siglen = -1, keyform = FORMAT_PEM, peerform =

apps/pkeyutl.c:315:14: Call
313.   
314.       if (asn1parse) {
315.           if (!ASN1_parse_dump(out, buf_out, buf_outlen, 1, -1))
                    ^
316.               ERR_print_errors(bio_err);
317.       } else if (hexdump)

crypto/asn1/asn1_par.c:112:1: Parameter `*pp`
  110.   }
  111.   
  112. > int ASN1_parse_dump(BIO *bp, const unsigned char *pp, long len, int indent,
  113.                       int dump)
  114.   {

crypto/asn1/asn1_par.c:115:13: Call
  113.                       int dump)
  114.   {
  115.       return (asn1_parse2(bp, &pp, len, 0, 0, indent, dump));
                     ^
  116.   }
  117.   

crypto/asn1/asn1_par.c:118:1: Parameter `**pp`
    116.   }
    117.   
    118. > static int asn1_parse2(BIO *bp, const unsigned char **pp, long length,
    119.                          int offset, int depth, int indent, int dump)
    120.   {

crypto/asn1/asn1_par.c:136:5: Assignment
    134.   
    135.       dump_indent = 6;            /* Because we know BIO_dump_indent() */
    136.       p = *pp;
               ^
    137.       tot = p + length;
    138.       op = p - 1;

crypto/asn1/asn1_par.c:140:9: Assignment
    138.       op = p - 1;
    139.       while ((p < tot) && (op < p)) {
    140.           op = p;
                   ^
    141.           j = ASN1_get_object(&p, &len, &tag, &xclass, length);
    142.           if (j & 0x80) {

crypto/asn1/asn1_par.c:217:17: Assignment
    215.                       goto end;
    216.               } else if (tag == V_ASN1_OBJECT) {
    217.                   opp = op;
                           ^
    218.                   if (d2i_ASN1_OBJECT(&o, &opp, len + hl) != NULL) {
    219.                       if (BIO_write(bp, ":", 1) <= 0)

crypto/asn1/asn1_par.c:218:21: Call
    216.               } else if (tag == V_ASN1_OBJECT) {
    217.                   opp = op;
    218.                   if (d2i_ASN1_OBJECT(&o, &opp, len + hl) != NULL) {
                               ^
    219.                       if (BIO_write(bp, ":", 1) <= 0)
    220.                           goto end;

crypto/asn1/a_object.c:243:1: Parameter `**pp`
      241.   }
      242.   
      243. > ASN1_OBJECT *d2i_ASN1_OBJECT(ASN1_OBJECT **a, const unsigned char **pp,
      244.                                long length)
      245.   {

crypto/asn1/a_object.c:251:5: Assignment
      249.       int inf, i;
      250.       ASN1_OBJECT *ret = NULL;
      251.       p = *pp;
                 ^
      252.       inf = ASN1_get_object(&p, &len, &tag, &xclass, length);
      253.       if (inf & 0x80) {

crypto/asn1/a_object.c:252:11: Call
      250.       ASN1_OBJECT *ret = NULL;
      251.       p = *pp;
      252.       inf = ASN1_get_object(&p, &len, &tag, &xclass, length);
                       ^
      253.       if (inf & 0x80) {
      254.           i = ASN1_R_BAD_OBJECT_HEADER;

crypto/asn1/asn1_lib.c:92:1: Parameter `**pp`
        90.   }
        91.   
        92. > int ASN1_get_object(const unsigned char **pp, long *plength, int *ptag,
        93.                       int *pclass, long omax)
        94.   {

crypto/asn1/a_object.c:262:11: Call
      260.           goto err;
      261.       }
      262.       ret = c2i_ASN1_OBJECT(a, &p, len);
                       ^
      263.       if (ret)
      264.           *pp = p;

crypto/asn1/a_object.c:271:1: <Length trace>
269.   }
270.   
271. > ASN1_OBJECT *c2i_ASN1_OBJECT(ASN1_OBJECT **a, const unsigned char **pp,
272.                                long len)
273.   {

crypto/asn1/a_object.c:271:1: Parameter `**pp`
        269.   }
        270.   
        271. > ASN1_OBJECT *c2i_ASN1_OBJECT(ASN1_OBJECT **a, const unsigned char **pp,
        272.                                long len)
        273.   {

crypto/asn1/a_object.c:284:53: Assignment
        282.        * see: X.690 8.19.2
        283.        */
        284.       if (len <= 0 || len > INT_MAX || pp == NULL || (p = *pp) == NULL ||
                                                                   ^
        285.           p[len - 1] & 0x80) {
        286.           ASN1err(ASN1_F_C2I_ASN1_OBJECT, ASN1_R_INVALID_OBJECT_ENCODING);

crypto/asn1/a_object.c:315:36: Array access: Offset: [-1, +oo] (⇐ [0, +oo] + -1) Size: [1, +oo] by call to `ASN1_parse_dump` 
        313.       }
        314.       for (i = 0; i < length; i++, p++) {
        315.           if (*p == 0x80 && (!i || !(p[-1] & 0x80))) {
                                                  ^
        316.               ASN1err(ASN1_F_C2I_ASN1_OBJECT, ASN1_R_INVALID_OBJECT_ENCODING);
        317.               return NULL;
