crypto/pem/pem_lib.c:292: error: BUFFER_OVERRUN_L3
  Offset: [-12, +oo] Size: [1, 2147483644] by call to `check_pem`.
Showing all 10 steps of the trace


crypto/pem/pem_lib.c:287:14: Call
285.   
286.       for (;;) {
287.           if (!PEM_read_bio(bp, &nm, &header, &data, &len)) {
                    ^
288.               if (ERR_GET_REASON(ERR_peek_error()) == PEM_R_NO_START_LINE)
289.                   ERR_add_error_data(2, "Expecting: ", name);

crypto/pem/pem_lib.c:722:13: Assignment
  720.               }
  721.               memcpy(nameB->data, &(buf[11]), i - 6);
  722.               nameB->data[i - 6] = '\0';
                     ^
  723.               break;
  724.           }

crypto/pem/pem_lib.c:292:13: Call
290.               return 0;
291.           }
292.           if (check_pem(nm, name))
                   ^
293.               break;
294.           OPENSSL_free(nm);

crypto/pem/pem_lib.c:180:1: Parameter `*nm`
  178.   #endif
  179.   
  180. > static int check_pem(const char *nm, const char *name)
  181.   {
  182.       /* Normal matching nm and name */

crypto/pem/pem_lib.c:195:16: Call
  193.           if (strcmp(nm, PEM_STRING_PKCS8INF) == 0)
  194.               return 1;
  195.           slen = pem_check_suffix(nm, "PRIVATE KEY");
                        ^
  196.           if (slen > 0) {
  197.               /*

crypto/pem/pem_lib.c:855:1: <Length trace>
853.    */
854.   
855. > int pem_check_suffix(const char *pem_str, const char *suffix)
856.   {
857.       int pem_len = strlen(pem_str);

crypto/pem/pem_lib.c:855:1: Parameter `*pem_str`
    853.    */
    854.   
    855. > int pem_check_suffix(const char *pem_str, const char *suffix)
    856.   {
    857.       int pem_len = strlen(pem_str);

crypto/pem/pem_lib.c:862:5: Assignment
    860.       if (suffix_len + 1 >= pem_len)
    861.           return 0;
    862.       p = pem_str + pem_len - suffix_len;
               ^
    863.       if (strcmp(p, suffix))
    864.           return 0;

crypto/pem/pem_lib.c:865:5: Assignment
    863.       if (strcmp(p, suffix))
    864.           return 0;
    865.       p--;
               ^
    866.       if (*p != ' ')
    867.           return 0;

crypto/pem/pem_lib.c:866:9: Array access: Offset: [-12, +oo] Size: [1, 2147483644] by call to `check_pem` 
    864.           return 0;
    865.       p--;
    866.       if (*p != ' ')
                   ^
    867.           return 0;
    868.       return p - pem_str;
