apps/pkcs12.c:364: error: BUFFER_OVERRUN_L3
  Offset added: [4, +oo] (⇐ [4, +oo] + [0, 8]) Size: [0, +oo] by call to `PKCS12_pack_p7encdata`.
Showing all 24 steps of the trace


apps/pkcs12.c:364:13: Call
362.   	if (!twopass) strcpy(macpass, pass);
363.   	/* Turn certbags into encrypted authsafe */
364.   	authsafe = PKCS12_pack_p7encdata (cert_pbe, pass, -1, NULL, 0,
                   ^
365.   								 iter, bags);
366.   	sk_pop_free(bags, PKCS12_SAFEBAG_free);

crypto/pkcs12/p12_add.c:154:1: Parameter `saltlen`
  152.   /* Turn a stack of SAFEBAGS into a PKCS#7 encrypted data ContentInfo */
  153.   
  154. > PKCS7 *PKCS12_pack_p7encdata (int pbe_nid, unsigned char *pass, int passlen,
  155.   	     unsigned char *salt, int saltlen, int iter, STACK *bags)
  156.   {

crypto/pkcs12/p12_add.c:170:14: Call
  168.   	ASN1_INTEGER_set (p7->d.encrypted->version, 0);
  169.   	p7->d.encrypted->enc_data->content_type = OBJ_nid2obj(NID_pkcs7_data);
  170.   	if (!(pbe = PKCS5_pbe_set (pbe_nid, iter, salt, saltlen))) {
                      ^
  171.   		PKCS12err(PKCS12_F_PKCS12_PACK_P7ENCDATA, ERR_R_MALLOC_FAILURE);
  172.   		return NULL;

crypto/asn1/p5_pbe.c:117:1: Parameter `saltlen`
    115.   /* Return an algorithm identifier for a PKCS#5 PBE algorithm */
    116.   
    117. > X509_ALGOR *PKCS5_pbe_set(int alg, int iter, unsigned char *salt,
    118.   	     int saltlen)
    119.   {

crypto/asn1/p5_pbe.c:137:2: Assignment
    135.   		return NULL;
    136.   	}
    137.   	pbe->salt->length = saltlen;
            ^
    138.   	if (salt) memcpy (pbe->salt->data, salt, saltlen);
    139.   	else RAND_bytes (pbe->salt->data, saltlen);

crypto/asn1/p5_pbe.c:140:15: Call
    138.   	if (salt) memcpy (pbe->salt->data, salt, saltlen);
    139.   	else RAND_bytes (pbe->salt->data, saltlen);
    140.   	if (!(plen = i2d_PBEPARAM (pbe, NULL))) {
                         ^
    141.   		ASN1err(ASN1_F_ASN1_PBE_SET,ASN1_R_ENCODE_ERROR);
    142.   		return NULL;

crypto/asn1/p5_pbe.c:73:1: Parameter `a->iter->length`
      71.    */
      72.   
      73. > int i2d_PBEPARAM(PBEPARAM *a, unsigned char **pp)
      74.   {
      75.   	M_ASN1_I2D_vars(a);

crypto/asn1/p5_pbe.c:149:2: Call
    147.   	}
    148.   	ptmp = pdata;
    149.   	i2d_PBEPARAM (pbe, &ptmp);
            ^
    150.   	PBEPARAM_free (pbe);
    151.   

crypto/asn1/p5_pbe.c:73:1: Parameter `a->salt->length`
      71.    */
      72.   
      73. > int i2d_PBEPARAM(PBEPARAM *a, unsigned char **pp)
      74.   {
      75.   	M_ASN1_I2D_vars(a);

crypto/asn1/p5_pbe.c:81:2: Call
      79.   	M_ASN1_I2D_seq_total ();
      80.   
      81.   	M_ASN1_I2D_put (a->salt, i2d_ASN1_OCTET_STRING);
             ^
      82.   	M_ASN1_I2D_put (a->iter, i2d_ASN1_INTEGER);
      83.   	M_ASN1_I2D_finish();

crypto/asn1/a_octet.c:66:1: Parameter `**pp`
        64.    */
        65.   
        66. > int i2d_ASN1_OCTET_STRING(ASN1_OCTET_STRING *a, unsigned char **pp)
        67.   	{
        68.   	return(i2d_ASN1_bytes((ASN1_STRING *)a,pp,

crypto/asn1/a_octet.c:68:9: Call
        66.   int i2d_ASN1_OCTET_STRING(ASN1_OCTET_STRING *a, unsigned char **pp)
        67.   	{
        68.   	return(i2d_ASN1_bytes((ASN1_STRING *)a,pp,
                      ^
        69.   		V_ASN1_OCTET_STRING,V_ASN1_UNIVERSAL));
        70.   	}

crypto/asn1/a_bytes.c:150:1: <Offset trace>
148.   	}
149.   
150. > int i2d_ASN1_bytes(ASN1_STRING *a, unsigned char **pp, int tag, int xclass)
151.   	{
152.   	int ret,r,constructed;

crypto/asn1/a_bytes.c:150:1: Parameter `a->length`
          148.   	}
          149.   
          150. > int i2d_ASN1_bytes(ASN1_STRING *a, unsigned char **pp, int tag, int xclass)
          151.   	{
          152.   	int ret,r,constructed;

crypto/asn1/a_bytes.c:150:1: <Length trace>
148.   	}
149.   
150. > int i2d_ASN1_bytes(ASN1_STRING *a, unsigned char **pp, int tag, int xclass)
151.   	{
152.   	int ret,r,constructed;

crypto/asn1/a_bytes.c:150:1: Parameter `**pp`
          148.   	}
          149.   
          150. > int i2d_ASN1_bytes(ASN1_STRING *a, unsigned char **pp, int tag, int xclass)
          151.   	{
          152.   	int ret,r,constructed;

crypto/asn1/a_bytes.c:163:2: Assignment
          161.   	r=ASN1_object_size(0,ret,tag);
          162.   	if (pp == NULL) return(r);
          163.   	p= *pp;
                  ^
          164.   
          165.   	if ((tag == V_ASN1_SEQUENCE) || (tag == V_ASN1_SET))

crypto/asn1/a_bytes.c:169:2: Call
          167.   	else
          168.   		constructed=0;
          169.   	ASN1_put_object(&p,constructed,ret,tag,xclass);
                  ^
          170.   	memcpy(p,a->data,a->length);
          171.   	p+=a->length;

crypto/asn1/asn1_lib.c:186:1: Parameter `**pp`
            184.   /* class 0 is constructed
            185.    * constructed == 2 for indefinitle length constructed */
            186. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
            187.   	     int xclass)
            188.   	{

crypto/asn1/asn1_lib.c:189:2: Assignment
            187.   	     int xclass)
            188.   	{
            189.   	unsigned char *p= *pp;
                    ^
            190.   	int i;
            191.   

crypto/asn1/asn1_lib.c:195:5: Assignment
            193.   	i|=(xclass&V_ASN1_PRIVATE);
            194.   	if (tag < 31)
            195.   		*(p++)=i|(tag&V_ASN1_PRIMATIVE_TAG);
                       ^
            196.   	else
            197.   		{

crypto/asn1/asn1_lib.c:207:5: Assignment
            205.   		}
            206.   	if ((constructed == 2) && (length == 0))
            207.   		*(p++)=0x80; /* der_put_length would output 0 instead */
                       ^
            208.   	else
            209.   		asn1_put_length(&p,length);

crypto/asn1/asn1_lib.c:210:2: Assignment
            208.   	else
            209.   		asn1_put_length(&p,length);
            210.   	*pp=p;
                    ^
            211.   	}
            212.   

crypto/asn1/a_bytes.c:170:2: Array access: Offset added: [4, +oo] (⇐ [4, +oo] + [0, 8]) Size: [0, +oo] by call to `PKCS12_pack_p7encdata` 
          168.   		constructed=0;
          169.   	ASN1_put_object(&p,constructed,ret,tag,xclass);
          170.   	memcpy(p,a->data,a->length);
                  ^
          171.   	p+=a->length;
          172.   	*pp= p;
