crypto/rsa/rsa_ossl.c:193: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] Size: [1, +oo] by call to `RSA_padding_add_PKCS1_type_2`.
Showing all 13 steps of the trace


crypto/rsa/rsa_ossl.c:184:11: Call
182.       f = BN_CTX_get(ctx);
183.       ret = BN_CTX_get(ctx);
184.       num = BN_num_bytes(rsa->n);
                 ^
185.       buf = OPENSSL_malloc(num);
186.       if (f == NULL || ret == NULL || buf == NULL) {

crypto/bn/bn_lib.c:221:9: Assignment
  219.   
  220.       if (BN_is_zero(a))
  221.           return 0;
                 ^
  222.       return ((i * BN_BITS2) + BN_num_bits_word(a->d[i]));
  223.   }

crypto/rsa/rsa_ossl.c:184:5: Assignment
182.       f = BN_CTX_get(ctx);
183.       ret = BN_CTX_get(ctx);
184.       num = BN_num_bytes(rsa->n);
           ^
185.       buf = OPENSSL_malloc(num);
186.       if (f == NULL || ret == NULL || buf == NULL) {

crypto/rsa/rsa_ossl.c:185:11: Call
183.       ret = BN_CTX_get(ctx);
184.       num = BN_num_bytes(rsa->n);
185.       buf = OPENSSL_malloc(num);
                 ^
186.       if (f == NULL || ret == NULL || buf == NULL) {
187.           RSAerr(RSA_F_RSA_OSSL_PUBLIC_ENCRYPT, ERR_R_MALLOC_FAILURE);

crypto/mem.c:125:9: Assignment
  123.   
  124.       if (num <= 0)
  125.           return NULL;
                 ^
  126.   
  127.       allow_customize = 0;

crypto/rsa/rsa_ossl.c:185:5: Assignment
183.       ret = BN_CTX_get(ctx);
184.       num = BN_num_bytes(rsa->n);
185.       buf = OPENSSL_malloc(num);
           ^
186.       if (f == NULL || ret == NULL || buf == NULL) {
187.           RSAerr(RSA_F_RSA_OSSL_PUBLIC_ENCRYPT, ERR_R_MALLOC_FAILURE);

crypto/rsa/rsa_ossl.c:193:13: Call
191.       switch (padding) {
192.       case RSA_PKCS1_PADDING:
193.           i = RSA_padding_add_PKCS1_type_2(buf, num, from, flen);
                   ^
194.           break;
195.       case RSA_PKCS1_OAEP_PADDING:

crypto/rsa/rsa_pk1.c:145:1: <Length trace>
143.   }
144.   
145. > int RSA_padding_add_PKCS1_type_2(unsigned char *to, int tlen,
146.                                    const unsigned char *from, int flen)
147.   {

crypto/rsa/rsa_pk1.c:145:1: Parameter `*to`
  143.   }
  144.   
  145. > int RSA_padding_add_PKCS1_type_2(unsigned char *to, int tlen,
  146.                                    const unsigned char *from, int flen)
  147.   {

crypto/rsa/rsa_pk1.c:157:5: Assignment
  155.       }
  156.   
  157.       p = (unsigned char *)to;
             ^
  158.   
  159.       *(p++) = 0;

crypto/rsa/rsa_pk1.c:159:7: Assignment
  157.       p = (unsigned char *)to;
  158.   
  159.       *(p++) = 0;
               ^
  160.       *(p++) = 2;                 /* Public Key BT (Block Type) */
  161.   

crypto/rsa/rsa_pk1.c:160:7: Assignment
  158.   
  159.       *(p++) = 0;
  160.       *(p++) = 2;                 /* Public Key BT (Block Type) */
               ^
  161.   
  162.       /* pad out with non-zero random data */

crypto/rsa/rsa_pk1.c:168:13: Array access: Offset: [2, +oo] Size: [1, +oo] by call to `RSA_padding_add_PKCS1_type_2` 
  166.           return (0);
  167.       for (i = 0; i < j; i++) {
  168.           if (*p == '\0')
                     ^
  169.               do {
  170.                   if (RAND_bytes(p, 1) <= 0)
