crypto/asn1/tasn_enc.c:117: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] (⇐ [2, +oo] + [0, +oo]) Size: [1, +oo] by call to `ASN1_item_ex_i2d`.
Showing all 24 steps of the trace


crypto/asn1/tasn_enc.c:110:15: Call
108.           unsigned char *p, *buf;
109.           int len;
110.           len = ASN1_item_ex_i2d(&val, NULL, it, -1, flags);
                     ^
111.           if (len <= 0)
112.               return len;

crypto/asn1/tasn_enc.c:140:9: Assignment
  138.   
  139.       if ((it->itype != ASN1_ITYPE_PRIMITIVE) && !*pval)
  140.           return 0;
                 ^
  141.   
  142.       if (aux && aux->asn1_cb)

crypto/asn1/tasn_enc.c:110:9: Assignment
108.           unsigned char *p, *buf;
109.           int len;
110.           len = ASN1_item_ex_i2d(&val, NULL, it, -1, flags);
               ^
111.           if (len <= 0)
112.               return len;

crypto/asn1/tasn_enc.c:113:15: Call
111.           if (len <= 0)
112.               return len;
113.           buf = OPENSSL_malloc(len);
                     ^
114.           if (buf == NULL)
115.               return -1;

crypto/mem.c:125:9: Assignment
  123.   
  124.       if (num <= 0)
  125.           return NULL;
                 ^
  126.   
  127.       allow_customize = 0;

crypto/asn1/tasn_enc.c:113:9: Assignment
111.           if (len <= 0)
112.               return len;
113.           buf = OPENSSL_malloc(len);
               ^
114.           if (buf == NULL)
115.               return -1;

crypto/asn1/tasn_enc.c:116:9: Assignment
114.           if (buf == NULL)
115.               return -1;
116.           p = buf;
               ^
117.           ASN1_item_ex_i2d(&val, &p, it, -1, flags);
118.           *out = buf;

crypto/asn1/tasn_enc.c:117:9: Call
115.               return -1;
116.           p = buf;
117.           ASN1_item_ex_i2d(&val, &p, it, -1, flags);
               ^
118.           *out = buf;
119.           return len;

crypto/asn1/tasn_enc.c:130:1: Parameter `**out`
  128.    */
  129.   
  130. > int ASN1_item_ex_i2d(ASN1_VALUE **pval, unsigned char **out,
  131.                        const ASN1_ITEM *it, int tag, int aclass)
  132.   {

crypto/asn1/tasn_enc.c:154:16: Call
  152.   
  153.       case ASN1_ITYPE_MSTRING:
  154.           return asn1_i2d_ex_primitive(pval, out, it, -1, aclass);
                        ^
  155.   
  156.       case ASN1_ITYPE_CHOICE:

crypto/asn1/tasn_enc.c:472:1: Parameter `**out`
    470.   }
    471.   
    472. > static int asn1_i2d_ex_primitive(ASN1_VALUE **pval, unsigned char **out,
    473.                                    const ASN1_ITEM *it, int tag, int aclass)
    474.   {

crypto/asn1/tasn_enc.c:517:13: Call
    515.       if (out) {
    516.           if (usetag)
    517.               ASN1_put_object(out, ndef, len, tag, aclass);
                       ^
    518.           asn1_ex_i2c(pval, *out, &utype, it);
    519.           if (ndef)

crypto/asn1/asn1_lib.c:196:1: Parameter `**pp`
      194.    * class 0 is constructed constructed == 2 for indefinite length constructed
      195.    */
      196. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
      197.                        int xclass)
      198.   {

crypto/asn1/asn1_lib.c:199:5: Assignment
      197.                        int xclass)
      198.   {
      199.       unsigned char *p = *pp;
                 ^
      200.       int i, ttag;
      201.   

crypto/asn1/asn1_lib.c:205:11: Assignment
      203.       i |= (xclass & V_ASN1_PRIVATE);
      204.       if (tag < 31)
      205.           *(p++) = i | (tag & V_ASN1_PRIMITIVE_TAG);
                       ^
      206.       else {
      207.           *(p++) = i | V_ASN1_PRIMITIVE_TAG;

crypto/asn1/asn1_lib.c:222:9: Call
      220.           *(p++) = 0x80;
      221.       else
      222.           asn1_put_length(&p, length);
                     ^
      223.       *pp = p;
      224.   }

crypto/asn1/asn1_lib.c:243:14: <Offset trace>
241.       else {
242.           l = length;
243.           for (i = 0; l > 0; i++)
                    ^
244.               l >>= 8;
245.           *(p++) = i | 0x80;

crypto/asn1/asn1_lib.c:243:14: Assignment
        241.       else {
        242.           l = length;
        243.           for (i = 0; l > 0; i++)
                            ^
        244.               l >>= 8;
        245.           *(p++) = i | 0x80;

crypto/asn1/asn1_lib.c:247:16: Assignment
        245.           *(p++) = i | 0x80;
        246.           l = i;
        247.           while (i-- > 0) {
                              ^
        248.               p[i] = length & 0xff;
        249.               length >>= 8;

crypto/asn1/asn1_lib.c:235:1: <Length trace>
233.   }
234.   
235. > static void asn1_put_length(unsigned char **pp, int length)
236.   {
237.       unsigned char *p = *pp;

crypto/asn1/asn1_lib.c:235:1: Parameter `**pp`
        233.   }
        234.   
        235. > static void asn1_put_length(unsigned char **pp, int length)
        236.   {
        237.       unsigned char *p = *pp;

crypto/asn1/asn1_lib.c:237:5: Assignment
        235.   static void asn1_put_length(unsigned char **pp, int length)
        236.   {
        237.       unsigned char *p = *pp;
                   ^
        238.       int i, l;
        239.       if (length <= 127)

crypto/asn1/asn1_lib.c:245:11: Assignment
        243.           for (i = 0; l > 0; i++)
        244.               l >>= 8;
        245.           *(p++) = i | 0x80;
                         ^
        246.           l = i;
        247.           while (i-- > 0) {

crypto/asn1/asn1_lib.c:248:13: Array access: Offset: [2, +oo] (⇐ [2, +oo] + [0, +oo]) Size: [1, +oo] by call to `ASN1_item_ex_i2d` 
        246.           l = i;
        247.           while (i-- > 0) {
        248.               p[i] = length & 0xff;
                           ^
        249.               length >>= 8;
        250.           }
