crypto/ct/ct_oct.c:462: error: BUFFER_OVERRUN_L3
  Offset added: [44, +oo] (⇐ 43 + [1, +oo]) Size: [1, +oo] by call to `i2o_SCT`.
Showing all 22 steps of the trace


crypto/ct/ct_oct.c:458:28: Call
456.               p2 = p;
457.               p += 2;
458.               if ((sct_len = i2o_SCT(sk_SCT_value(a, i), &p)) == -1)
                                  ^
459.                   goto err;
460.               s2n(sct_len, p2);

crypto/ct/ct_oct.c:306:1: Parameter `sct->ext_len`
  304.   }
  305.   
  306. > int i2o_SCT(const SCT *sct, unsigned char **out)
  307.   {
  308.       size_t len;

crypto/ct/ct_oct.c:458:28: Call
456.               p2 = p;
457.               p += 2;
458.               if ((sct_len = i2o_SCT(sk_SCT_value(a, i), &p)) == -1)
                                  ^
459.                   goto err;
460.               s2n(sct_len, p2);

crypto/ct/ct_oct.c:306:1: Parameter `sct->ext_len`
  304.   }
  305.   
  306. > int i2o_SCT(const SCT *sct, unsigned char **out)
  307.   {
  308.       size_t len;

crypto/ct/ct_oct.c:462:26: Call
460.               s2n(sct_len, p2);
461.           } else {
462.             if ((sct_len = i2o_SCT(sk_SCT_value(a, i), NULL)) == -1)
                                ^
463.                 goto err;
464.           }

crypto/ct/ct_oct.c:306:1: <Offset trace>
304.   }
305.   
306. > int i2o_SCT(const SCT *sct, unsigned char **out)
307.   {
308.       size_t len;

crypto/ct/ct_oct.c:306:1: Parameter `sct->ext_len`
  304.   }
  305.   
  306. > int i2o_SCT(const SCT *sct, unsigned char **out)
  307.   {
  308.       size_t len;

crypto/ct/ct_oct.c:306:1: <Length trace>
304.   }
305.   
306. > int i2o_SCT(const SCT *sct, unsigned char **out)
307.   {
308.       size_t len;

crypto/ct/ct_oct.c:306:1: Parameter `**out`
  304.   }
  305.   
  306. > int i2o_SCT(const SCT *sct, unsigned char **out)
  307.   {
  308.       size_t len;

crypto/ct/ct_oct.c:330:9: Assignment
  328.   
  329.       if (*out != NULL) {
  330.           p = *out;
                 ^
  331.           *out += len;
  332.       } else {

crypto/ct/ct_oct.c:342:10: Assignment
  340.   
  341.       if (sct->version == SCT_V1) {
  342.           *p++ = sct->version;
                  ^
  343.           memcpy(p, sct->log_id, SCT_V1_HASHLEN);
  344.           p += SCT_V1_HASHLEN;

crypto/ct/ct_oct.c:344:9: Assignment
  342.           *p++ = sct->version;
  343.           memcpy(p, sct->log_id, SCT_V1_HASHLEN);
  344.           p += SCT_V1_HASHLEN;
                 ^
  345.           l2n8(sct->timestamp, p);
  346.           s2n(sct->ext_len, p);

crypto/ct/ct_oct.c:345:9: Assignment
  343.           memcpy(p, sct->log_id, SCT_V1_HASHLEN);
  344.           p += SCT_V1_HASHLEN;
  345.           l2n8(sct->timestamp, p);
                 ^
  346.           s2n(sct->ext_len, p);
  347.           if (sct->ext_len > 0) {

crypto/ct/ct_oct.c:345:9: Assignment
  343.           memcpy(p, sct->log_id, SCT_V1_HASHLEN);
  344.           p += SCT_V1_HASHLEN;
  345.           l2n8(sct->timestamp, p);
                 ^
  346.           s2n(sct->ext_len, p);
  347.           if (sct->ext_len > 0) {

crypto/ct/ct_oct.c:345:9: Assignment
  343.           memcpy(p, sct->log_id, SCT_V1_HASHLEN);
  344.           p += SCT_V1_HASHLEN;
  345.           l2n8(sct->timestamp, p);
                 ^
  346.           s2n(sct->ext_len, p);
  347.           if (sct->ext_len > 0) {

crypto/ct/ct_oct.c:345:9: Assignment
  343.           memcpy(p, sct->log_id, SCT_V1_HASHLEN);
  344.           p += SCT_V1_HASHLEN;
  345.           l2n8(sct->timestamp, p);
                 ^
  346.           s2n(sct->ext_len, p);
  347.           if (sct->ext_len > 0) {

crypto/ct/ct_oct.c:345:9: Assignment
  343.           memcpy(p, sct->log_id, SCT_V1_HASHLEN);
  344.           p += SCT_V1_HASHLEN;
  345.           l2n8(sct->timestamp, p);
                 ^
  346.           s2n(sct->ext_len, p);
  347.           if (sct->ext_len > 0) {

crypto/ct/ct_oct.c:345:9: Assignment
  343.           memcpy(p, sct->log_id, SCT_V1_HASHLEN);
  344.           p += SCT_V1_HASHLEN;
  345.           l2n8(sct->timestamp, p);
                 ^
  346.           s2n(sct->ext_len, p);
  347.           if (sct->ext_len > 0) {

crypto/ct/ct_oct.c:345:9: Assignment
  343.           memcpy(p, sct->log_id, SCT_V1_HASHLEN);
  344.           p += SCT_V1_HASHLEN;
  345.           l2n8(sct->timestamp, p);
                 ^
  346.           s2n(sct->ext_len, p);
  347.           if (sct->ext_len > 0) {

crypto/ct/ct_oct.c:345:9: Assignment
  343.           memcpy(p, sct->log_id, SCT_V1_HASHLEN);
  344.           p += SCT_V1_HASHLEN;
  345.           l2n8(sct->timestamp, p);
                 ^
  346.           s2n(sct->ext_len, p);
  347.           if (sct->ext_len > 0) {

crypto/ct/ct_oct.c:346:9: Assignment
  344.           p += SCT_V1_HASHLEN;
  345.           l2n8(sct->timestamp, p);
  346.           s2n(sct->ext_len, p);
                 ^
  347.           if (sct->ext_len > 0) {
  348.               memcpy(p, sct->ext, sct->ext_len);

crypto/ct/ct_oct.c:348:13: Array access: Offset added: [44, +oo] (⇐ 43 + [1, +oo]) Size: [1, +oo] by call to `i2o_SCT` 
  346.           s2n(sct->ext_len, p);
  347.           if (sct->ext_len > 0) {
  348.               memcpy(p, sct->ext, sct->ext_len);
                     ^
  349.               p += sct->ext_len;
  350.           }
