crypto/rsa/rsa_sign.c:110: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] (⇐ [2, +oo] + [0, +oo]) Size: [0, +oo] by call to `i2d_X509_SIG`.
Showing all 22 steps of the trace


crypto/rsa/rsa_sign.c:96:4: Call
94.   	sig.digest->length=m_len;
95.   
96.   	i=i2d_X509_SIG(&sig,NULL);
         ^
97.   	j=RSA_size(rsa);
98.   	if ((i-RSA_PKCS1_PADDING) > j)

crypto/asn1/x_sig.c:70:2: Assignment
  68.   int i2d_X509_SIG(X509_SIG *a, unsigned char **pp)
  69.   	{
  70.   	M_ASN1_I2D_vars(a);
         ^
  71.   
  72.   	M_ASN1_I2D_len(a->algor,	i2d_X509_ALGOR);

crypto/rsa/rsa_sign.c:96:2: Assignment
94.   	sig.digest->length=m_len;
95.   
96.   	i=i2d_X509_SIG(&sig,NULL);
       ^
97.   	j=RSA_size(rsa);
98.   	if ((i-RSA_PKCS1_PADDING) > j)

crypto/rsa/rsa_sign.c:103:21: Array declaration
101.   		return(0);
102.   		}
103.   	s=(unsigned char *)Malloc((unsigned int)j+1);
                           ^
104.   	if (s == NULL)
105.   		{

crypto/rsa/rsa_sign.c:103:2: Assignment
101.   		return(0);
102.   		}
103.   	s=(unsigned char *)Malloc((unsigned int)j+1);
        ^
104.   	if (s == NULL)
105.   		{

crypto/rsa/rsa_sign.c:109:2: Assignment
107.   		return(0);
108.   		}
109.   	p=s;
        ^
110.   	i2d_X509_SIG(&sig,&p);
111.   	i=RSA_private_encrypt(i,s,sigret,rsa,RSA_PKCS1_PADDING);

crypto/rsa/rsa_sign.c:110:2: Call
108.   		}
109.   	p=s;
110.   	i2d_X509_SIG(&sig,&p);
        ^
111.   	i=RSA_private_encrypt(i,s,sigret,rsa,RSA_PKCS1_PADDING);
112.   	if (i <= 0)

crypto/asn1/x_sig.c:68:1: Parameter `**pp`
  66.    */
  67.   
  68. > int i2d_X509_SIG(X509_SIG *a, unsigned char **pp)
  69.   	{
  70.   	M_ASN1_I2D_vars(a);

crypto/asn1/x_sig.c:75:2: Assignment
  73.   	M_ASN1_I2D_len(a->digest,	i2d_ASN1_OCTET_STRING);
  74.   
  75.   	M_ASN1_I2D_seq_total();
         ^
  76.   
  77.   	M_ASN1_I2D_put(a->algor,	i2d_X509_ALGOR);

crypto/asn1/x_sig.c:75:2: Call
  73.   	M_ASN1_I2D_len(a->digest,	i2d_ASN1_OCTET_STRING);
  74.   
  75.   	M_ASN1_I2D_seq_total();
         ^
  76.   
  77.   	M_ASN1_I2D_put(a->algor,	i2d_X509_ALGOR);

crypto/asn1/asn1_lib.c:186:1: Parameter `**pp`
    184.   /* class 0 is constructed
    185.    * constructed == 2 for indefinitle length constructed */
    186. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
    187.   	     int xclass)
    188.   	{

crypto/asn1/asn1_lib.c:189:2: Assignment
    187.   	     int xclass)
    188.   	{
    189.   	unsigned char *p= *pp;
            ^
    190.   	int i;
    191.   

crypto/asn1/asn1_lib.c:195:5: Assignment
    193.   	i|=(xclass&V_ASN1_PRIVATE);
    194.   	if (tag < 31)
    195.   		*(p++)=i|(tag&V_ASN1_PRIMATIVE_TAG);
               ^
    196.   	else
    197.   		{

crypto/asn1/asn1_lib.c:209:3: Call
    207.   		*(p++)=0x80; /* der_put_length would output 0 instead */
    208.   	else
    209.   		asn1_put_length(&p,length);
             ^
    210.   	*pp=p;
    211.   	}

crypto/asn1/asn1_lib.c:222:8: <Offset trace>
220.   		{
221.   		l=length;
222.   		for (i=0; l > 0; i++)
              ^
223.   			l>>=8;
224.   		*(p++)=i|0x80;

crypto/asn1/asn1_lib.c:222:8: Assignment
      220.   		{
      221.   		l=length;
      222.   		for (i=0; l > 0; i++)
                    ^
      223.   			l>>=8;
      224.   		*(p++)=i|0x80;

crypto/asn1/asn1_lib.c:226:10: Assignment
      224.   		*(p++)=i|0x80;
      225.   		l=i;
      226.   		while (i-- > 0)
                      ^
      227.   			{
      228.   			p[i]=length&0xff;

crypto/asn1/asn1_lib.c:213:1: <Length trace>
211.   	}
212.   
213. > static void asn1_put_length(unsigned char **pp, int length)
214.   	{
215.   	unsigned char *p= *pp;

crypto/asn1/asn1_lib.c:213:1: Parameter `**pp`
      211.   	}
      212.   
      213. > static void asn1_put_length(unsigned char **pp, int length)
      214.   	{
      215.   	unsigned char *p= *pp;

crypto/asn1/asn1_lib.c:215:2: Assignment
      213.   static void asn1_put_length(unsigned char **pp, int length)
      214.   	{
      215.   	unsigned char *p= *pp;
              ^
      216.   	int i,l;
      217.   	if (length <= 127)

crypto/asn1/asn1_lib.c:224:5: Assignment
      222.   		for (i=0; l > 0; i++)
      223.   			l>>=8;
      224.   		*(p++)=i|0x80;
                 ^
      225.   		l=i;
      226.   		while (i-- > 0)

crypto/asn1/asn1_lib.c:228:4: Array access: Offset: [2, +oo] (⇐ [2, +oo] + [0, +oo]) Size: [0, +oo] by call to `i2d_X509_SIG` 
      226.   		while (i-- > 0)
      227.   			{
      228.   			p[i]=length&0xff;
                ^
      229.   			length>>=8;
      230.   			}
