apps/ca.c:2015: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] Size: [1, +oo] by call to `NETSCAPE_SPKI_b64_decode`.
Showing all 22 steps of the trace


apps/ca.c:2034:11: Call
2032.   			}
2033.   
2034.   		if ((ne=X509_NAME_ENTRY_create_by_NID(&ne,nid,j,
                  ^
2035.   			(unsigned char *)buf,
2036.   			strlen(buf))) == NULL)

crypto/x509/x509name.c:239:1: Parameter `(*ne)->value->data->strlen`
  237.   	}
  238.   
  239. > X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_NID(X509_NAME_ENTRY **ne, int nid,
  240.   	     int type, unsigned char *bytes, int len)
  241.   	{

apps/ca.c:2015:12: Call
2013.   			if (strcmp(type, "SPKAC") == 0)
2014.   				{
2015.   				spki = NETSCAPE_SPKI_b64_decode(cv->value, -1);
                   ^
2016.   				if (spki == NULL)
2017.   					{

crypto/x509/x509spki.c:79:1: Parameter `len`
  77.   /* Load a Netscape SPKI from a base64 encoded string */
  78.   
  79. > NETSCAPE_SPKI * NETSCAPE_SPKI_b64_decode(char *str, int len)
  80.   {
  81.   	unsigned char *spki_der, *p;

crypto/x509/x509spki.c:85:19: Array declaration
  83.   	NETSCAPE_SPKI *spki;
  84.   	if(len <= 0) len = strlen(str);
  85.   	if (!(spki_der = Malloc(len + 1))) {
                          ^
  86.   		X509err(X509_F_NETSCAPE_SPKI_B64_DECODE, ERR_R_MALLOC_FAILURE);
  87.   		return NULL;

crypto/x509/x509spki.c:85:8: Assignment
  83.   	NETSCAPE_SPKI *spki;
  84.   	if(len <= 0) len = strlen(str);
  85.   	if (!(spki_der = Malloc(len + 1))) {
               ^
  86.   		X509err(X509_F_NETSCAPE_SPKI_B64_DECODE, ERR_R_MALLOC_FAILURE);
  87.   		return NULL;

crypto/x509/x509spki.c:96:2: Assignment
  94.   		return NULL;
  95.   	}
  96.   	p = spki_der;
         ^
  97.   	spki = d2i_NETSCAPE_SPKI(NULL, &p, spki_len);
  98.   	Free(spki_der);

crypto/x509/x509spki.c:97:9: Call
  95.   	}
  96.   	p = spki_der;
  97.   	spki = d2i_NETSCAPE_SPKI(NULL, &p, spki_len);
                 ^
  98.   	Free(spki_der);
  99.   	return spki;

crypto/asn1/x_spki.c:132:1: Parameter `**pp`
    130.   	}
    131.   
    132. > NETSCAPE_SPKI *d2i_NETSCAPE_SPKI(NETSCAPE_SPKI **a, unsigned char **pp,
    133.   	     long length)
    134.   	{

crypto/asn1/x_spki.c:137:2: Assignment
    135.   	M_ASN1_D2I_vars(a,NETSCAPE_SPKI *,NETSCAPE_SPKI_new);
    136.   
    137.   	M_ASN1_D2I_Init();
            ^
    138.   	M_ASN1_D2I_start_sequence();
    139.   	M_ASN1_D2I_get(ret->spkac,d2i_NETSCAPE_SPKAC);

crypto/asn1/x_spki.c:138:2: Call
    136.   
    137.   	M_ASN1_D2I_Init();
    138.   	M_ASN1_D2I_start_sequence();
            ^
    139.   	M_ASN1_D2I_get(ret->spkac,d2i_NETSCAPE_SPKAC);
    140.   	M_ASN1_D2I_get(ret->sig_algor,d2i_X509_ALGOR);

crypto/asn1/asn1_lib.c:277:1: Parameter `*c->p`
      275.   	}
      276.   
      277. > int asn1_GetSequence(ASN1_CTX *c, long *length)
      278.   	{
      279.   	unsigned char *q;

crypto/asn1/asn1_lib.c:282:9: Call
      280.   
      281.   	q=c->p;
      282.   	c->inf=ASN1_get_object(&(c->p),&(c->slen),&(c->tag),&(c->xclass),
                     ^
      283.   		*length);
      284.   	if (c->inf & 0x80)

crypto/asn1/asn1_lib.c:83:1: Parameter `**pp`
        81.   
        82.   
        83. > int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
        84.   	     long omax)
        85.   	{

crypto/asn1/asn1_lib.c:88:2: Assignment
        86.   	int i,ret;
        87.   	long l;
        88.   	unsigned char *p= *pp;
               ^
        89.   	int tag,xclass,inf;
        90.   	long max=omax;

crypto/asn1/asn1_lib.c:114:3: Assignment
        112.   		{ 
        113.   		tag=i;
        114.   		p++;
                 ^
        115.   		if (--max == 0) goto err;
        116.   		}

crypto/asn1/asn1_lib.c:119:7: Call
        117.   	*ptag=tag;
        118.   	*pclass=xclass;
        119.   	if (!asn1_get_length(&p,&inf,plength,(int)max)) goto err;
                     ^
        120.   
        121.   #if 0

crypto/asn1/asn1_lib.c:143:1: <Length trace>
141.   	}
142.   
143. > static int asn1_get_length(unsigned char **pp, int *inf, long *rl, int max)
144.   	{
145.   	unsigned char *p= *pp;

crypto/asn1/asn1_lib.c:143:1: Parameter `**pp`
          141.   	}
          142.   
          143. > static int asn1_get_length(unsigned char **pp, int *inf, long *rl, int max)
          144.   	{
          145.   	unsigned char *p= *pp;

crypto/asn1/asn1_lib.c:145:2: Assignment
          143.   static int asn1_get_length(unsigned char **pp, int *inf, long *rl, int max)
          144.   	{
          145.   	unsigned char *p= *pp;
                  ^
          146.   	long ret=0;
          147.   	int i;

crypto/asn1/asn1_lib.c:160:9: Assignment
          158.   		*inf=0;
          159.   		i= *p&0x7f;
          160.   		if (*(p++) & 0x80)
                         ^
          161.   			{
          162.   			if (max-- == 0) return(0);

crypto/asn1/asn1_lib.c:166:11: Array access: Offset: [2, +oo] Size: [1, +oo] by call to `NETSCAPE_SPKI_b64_decode` 
          164.   				{
          165.   				ret<<=8L;
          166.   				ret|= *(p++);
                           ^
          167.   				if (max-- == 0) return(0);
          168.   				}
