apps/ts.c:660: error: BUFFER_OVERRUN_L2
  Offset added: [-oo, 40] (⇐ [0, 20] + [-oo, 20]) Size: 20.
Showing all 6 steps of the trace


apps/ts.c:654:7: <Offset trace>
652.   
653.   	/* Find the first non-zero byte and creating ASN1_INTEGER object. */
654.   	for (i = 0; i < len && !buf[i]; ++i);
             ^
655.   	if (!(nonce = ASN1_INTEGER_new())) goto err;
656.   	OPENSSL_free(nonce->data);

apps/ts.c:654:7: Assignment
652.   
653.   	/* Find the first non-zero byte and creating ASN1_INTEGER object. */
654.   	for (i = 0; i < len && !buf[i]; ++i);
             ^
655.   	if (!(nonce = ASN1_INTEGER_new())) goto err;
656.   	OPENSSL_free(nonce->data);

apps/ts.c:658:2: Assignment
656.   	OPENSSL_free(nonce->data);
657.   	/* Allocate at least one byte. */
658.   	nonce->length = len - i;
        ^
659.   	if (!(nonce->data = OPENSSL_malloc(nonce->length + 1))) goto err;
660.   	memcpy(nonce->data, buf + i, nonce->length);

apps/ts.c:642:1: <Length trace>
640.   	}
641.   
642. > static ASN1_INTEGER *create_nonce(int bits)
643.   	{
644.   	unsigned char buf[20];

apps/ts.c:642:1: Array declaration
640.   	}
641.   
642. > static ASN1_INTEGER *create_nonce(int bits)
643.   	{
644.   	unsigned char buf[20];

apps/ts.c:660:2: Array access: Offset added: [-oo, 40] (⇐ [0, 20] + [-oo, 20]) Size: 20
658.   	nonce->length = len - i;
659.   	if (!(nonce->data = OPENSSL_malloc(nonce->length + 1))) goto err;
660.   	memcpy(nonce->data, buf + i, nonce->length);
        ^
661.   
662.   	return nonce;
