crypto/pem/pem_pkey.c:130: error: BUFFER_OVERRUN_L3
  Offset: [-11, +oo] Size: [1, 241] by call to `pem_check_suffix`.
Showing all 10 steps of the trace


crypto/pem/pem_pkey.c:125:10: Call
123.       EVP_PKEY *ret = NULL;
124.   
125.       if (!PEM_bytes_read_bio(&data, &len, &nm, PEM_STRING_PARAMETERS,
                ^
126.                               bp, 0, NULL))
127.           return NULL;

crypto/pem/pem_lib.c:283:12: Call
  281.                          const char *name, BIO *bp, pem_password_cb *cb,
  282.                          void *u) {
  283.       return pem_bytes_read_bio_flags(pdata, plen, pnm, name, bp, cb, u,
                    ^
  284.                                       PEM_FLAG_EAY_COMPATIBLE);
  285.   }

crypto/pem/pem_lib.c:252:14: Call
    250.           pem_free(header, flags, 0);
    251.           pem_free(data, flags, len);
    252.           if (!PEM_read_bio_ex(bp, &nm, &header, &data, &len, flags)) {
                        ^
    253.               if (ERR_GET_REASON(ERR_peek_error()) == PEM_R_NO_START_LINE)
    254.                   ERR_add_error_data(2, "Expecting: ", name);

crypto/pem/pem_lib.c:951:5: Assignment
      949.       }
      950.       BIO_read(headerB, *header, headerlen);
      951.       (*header)[headerlen] = '\0';
                 ^
      952.       BIO_read(dataB, *data, len);
      953.       *len_out = len;

crypto/pem/pem_pkey.c:130:17: Call
128.       p = data;
129.   
130.       if ((slen = pem_check_suffix(nm, "PARAMETERS")) > 0) {
                       ^
131.           ret = EVP_PKEY_new();
132.           if (ret == NULL)

crypto/pem/pem_lib.c:978:1: <Length trace>
976.    */
977.   
978. > int pem_check_suffix(const char *pem_str, const char *suffix)
979.   {
980.       int pem_len = strlen(pem_str);

crypto/pem/pem_lib.c:978:1: Parameter `*pem_str`
  976.    */
  977.   
  978. > int pem_check_suffix(const char *pem_str, const char *suffix)
  979.   {
  980.       int pem_len = strlen(pem_str);

crypto/pem/pem_lib.c:985:5: Assignment
  983.       if (suffix_len + 1 >= pem_len)
  984.           return 0;
  985.       p = pem_str + pem_len - suffix_len;
             ^
  986.       if (strcmp(p, suffix))
  987.           return 0;

crypto/pem/pem_lib.c:988:5: Assignment
  986.       if (strcmp(p, suffix))
  987.           return 0;
  988.       p--;
             ^
  989.       if (*p != ' ')
  990.           return 0;

crypto/pem/pem_lib.c:989:9: Array access: Offset: [-11, +oo] Size: [1, 241] by call to `pem_check_suffix` 
  987.           return 0;
  988.       p--;
  989.       if (*p != ' ')
                 ^
  990.           return 0;
  991.       return p - pem_str;
