ssl/s2_srvr.c:884: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, +oo] by call to `i2d_X509`.
Showing all 15 steps of the trace


ssl/s2_srvr.c:876:5: Call
874.   		EVP_VerifyUpdate(&ctx,ccd,SSL2_MIN_CERT_CHALLENGE_LENGTH);
875.   
876.   		i=i2d_X509(s->session->sess_cert->pkeys[SSL_PKEY_RSA_ENC].x509,NULL);
           ^
877.   		buf2=(unsigned char *)Malloc((unsigned int)i);
878.   		if (buf2 == NULL)

crypto/asn1/x_x509.c:77:2: Assignment
  75.   int i2d_X509(X509 *a, unsigned char **pp)
  76.   	{
  77.   	M_ASN1_I2D_vars(a);
         ^
  78.   
  79.   	M_ASN1_I2D_len(a->cert_info,	i2d_X509_CINF);

ssl/s2_srvr.c:876:3: Assignment
874.   		EVP_VerifyUpdate(&ctx,ccd,SSL2_MIN_CERT_CHALLENGE_LENGTH);
875.   
876.   		i=i2d_X509(s->session->sess_cert->pkeys[SSL_PKEY_RSA_ENC].x509,NULL);
         ^
877.   		buf2=(unsigned char *)Malloc((unsigned int)i);
878.   		if (buf2 == NULL)

ssl/s2_srvr.c:877:25: Array declaration
875.   
876.   		i=i2d_X509(s->session->sess_cert->pkeys[SSL_PKEY_RSA_ENC].x509,NULL);
877.   		buf2=(unsigned char *)Malloc((unsigned int)i);
                               ^
878.   		if (buf2 == NULL)
879.   			{

ssl/s2_srvr.c:877:3: Assignment
875.   
876.   		i=i2d_X509(s->session->sess_cert->pkeys[SSL_PKEY_RSA_ENC].x509,NULL);
877.   		buf2=(unsigned char *)Malloc((unsigned int)i);
         ^
878.   		if (buf2 == NULL)
879.   			{

ssl/s2_srvr.c:883:3: Assignment
881.   			goto msg_end;
882.   			}
883.   		p2=buf2;
         ^
884.   		i=i2d_X509(s->session->sess_cert->pkeys[SSL_PKEY_RSA_ENC].x509,&p2);
885.   		EVP_VerifyUpdate(&ctx,buf2,(unsigned int)i);

ssl/s2_srvr.c:884:5: Call
882.   			}
883.   		p2=buf2;
884.   		i=i2d_X509(s->session->sess_cert->pkeys[SSL_PKEY_RSA_ENC].x509,&p2);
           ^
885.   		EVP_VerifyUpdate(&ctx,buf2,(unsigned int)i);
886.   		Free(buf2);

crypto/asn1/x_x509.c:75:1: Parameter `**pp`
  73.   	}
  74.   
  75. > int i2d_X509(X509 *a, unsigned char **pp)
  76.   	{
  77.   	M_ASN1_I2D_vars(a);

crypto/asn1/x_x509.c:83:2: Assignment
  81.   	M_ASN1_I2D_len(a->signature,	i2d_ASN1_BIT_STRING);
  82.   
  83.   	M_ASN1_I2D_seq_total();
         ^
  84.   
  85.   	M_ASN1_I2D_put(a->cert_info,	i2d_X509_CINF);

crypto/asn1/x_x509.c:83:2: Call
  81.   	M_ASN1_I2D_len(a->signature,	i2d_ASN1_BIT_STRING);
  82.   
  83.   	M_ASN1_I2D_seq_total();
         ^
  84.   
  85.   	M_ASN1_I2D_put(a->cert_info,	i2d_X509_CINF);

crypto/asn1/asn1_lib.c:180:1: <Length trace>
178.   /* class 0 is constructed
179.    * constructed == 2 for indefinitle length constructed */
180. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
181.   	     int xclass)
182.   	{

crypto/asn1/asn1_lib.c:180:1: Parameter `**pp`
    178.   /* class 0 is constructed
    179.    * constructed == 2 for indefinitle length constructed */
    180. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
    181.   	     int xclass)
    182.   	{

crypto/asn1/asn1_lib.c:183:2: Assignment
    181.   	     int xclass)
    182.   	{
    183.   	unsigned char *p= *pp;
            ^
    184.   	int i;
    185.   

crypto/asn1/asn1_lib.c:192:5: Assignment
    190.   	else
    191.   		{
    192.   		*(p++)=i|V_ASN1_PRIMATIVE_TAG;
               ^
    193.   		while (tag > 0x7f)
    194.   			{

crypto/asn1/asn1_lib.c:198:3: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `i2d_X509` 
    196.   			tag>>=7;
    197.   			}
    198.   		*(p++)=(tag&0x7f);
             ^
    199.   		}
    200.   	if ((constructed == 2) && (length == 0))
