crypto/cms/cms_smime.c:692: error: BUFFER_OVERRUN_L3
  Offset added: [4, +oo] (⇐ 4 + [0, +oo]) Size: [1, +oo] by call to `CMS_RecipientInfo_decrypt`.
Showing all 17 steps of the trace


crypto/cms/cms_smime.c:692:17: Call
690.           if (!id || (CMS_RecipientInfo_kekri_id_cmp(ri, id, idlen) == 0)) {
691.               CMS_RecipientInfo_set0_key(ri, key, keylen);
692.               r = CMS_RecipientInfo_decrypt(cms, ri);
                       ^
693.               CMS_RecipientInfo_set0_key(ri, NULL, 0);
694.               if (r > 0)

crypto/cms/cms_env.c:738:1: Parameter `ri->d.pwri->encryptedKey->length`
  736.   }
  737.   
  738. > int CMS_RecipientInfo_decrypt(CMS_ContentInfo *cms, CMS_RecipientInfo *ri)
  739.   {
  740.       switch (ri->type) {

crypto/cms/cms_smime.c:692:17: Call
690.           if (!id || (CMS_RecipientInfo_kekri_id_cmp(ri, id, idlen) == 0)) {
691.               CMS_RecipientInfo_set0_key(ri, key, keylen);
692.               r = CMS_RecipientInfo_decrypt(cms, ri);
                       ^
693.               CMS_RecipientInfo_set0_key(ri, NULL, 0);
694.               if (r > 0)

crypto/cms/cms_env.c:738:1: Parameter `ri->d.pwri->encryptedKey->length`
  736.   }
  737.   
  738. > int CMS_RecipientInfo_decrypt(CMS_ContentInfo *cms, CMS_RecipientInfo *ri)
  739.   {
  740.       switch (ri->type) {

crypto/cms/cms_env.c:748:16: Call
  746.   
  747.       case CMS_RECIPINFO_PASS:
  748.           return cms_RecipientInfo_pwri_crypt(cms, ri, 0);
                        ^
  749.   
  750.       default:

crypto/cms/cms_pwri.c:275:1: Parameter `ri->d.pwri->encryptedKey->length`
    273.   /* Encrypt/Decrypt content key in PWRI recipient info */
    274.   
    275. > int cms_RecipientInfo_pwri_crypt(CMS_ContentInfo *cms, CMS_RecipientInfo *ri,
    276.                                    int en_de)
    277.   {

crypto/cms/cms_pwri.c:368:14: Call
    366.               goto err;
    367.           }
    368.           if (!kek_unwrap_key(key, &keylen,
                        ^
    369.                               pwri->encryptedKey->data,
    370.                               pwri->encryptedKey->length, kekctx)) {

crypto/cms/cms_pwri.c:210:13: <Offset trace>
208.           || !EVP_DecryptInit_ex(ctx, NULL, NULL, NULL, NULL)
209.           /* Decrypt again */
210.           || !EVP_DecryptUpdate(ctx, tmp, &outl, tmp, inlen))
                   ^
211.           goto err;
212.       /* Check check bytes */

crypto/cms/cms_pwri.c:210:13: Call
      208.           || !EVP_DecryptInit_ex(ctx, NULL, NULL, NULL, NULL)
      209.           /* Decrypt again */
      210.           || !EVP_DecryptUpdate(ctx, tmp, &outl, tmp, inlen))
                         ^
      211.           goto err;
      212.       /* Check check bytes */

crypto/evp/evp_enc.c:421:1: Parameter `ctx->buf[*]`
        419.   }
        420.   
        421. > int EVP_DecryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,
        422.                         const unsigned char *in, int inl)
        423.   {

crypto/cms/cms_pwri.c:221:5: Assignment
      219.           goto err;
      220.       }
      221.       *outlen = (size_t)tmp[0];
                 ^
      222.       memcpy(out, tmp + 4, *outlen);
      223.       rv = 1;

crypto/cms/cms_pwri.c:176:1: <Length trace>
174.    */
175.   
176. > static int kek_unwrap_key(unsigned char *out, size_t *outlen,
177.                             const unsigned char *in, size_t inlen,
178.                             EVP_CIPHER_CTX *ctx)

crypto/cms/cms_pwri.c:176:1: Parameter `inlen`
      174.    */
      175.   
      176. > static int kek_unwrap_key(unsigned char *out, size_t *outlen,
      177.                             const unsigned char *in, size_t inlen,
      178.                             EVP_CIPHER_CTX *ctx)

crypto/cms/cms_pwri.c:191:11: Call
      189.           return 0;
      190.       }
      191.       tmp = OPENSSL_malloc(inlen);
                       ^
      192.       if (tmp == NULL)
      193.           return 0;

crypto/mem.c:166:9: Assignment
        164.   
        165.       if (num == 0)
        166.           return NULL;
                       ^
        167.   
        168.       FAILTEST();

crypto/cms/cms_pwri.c:191:5: Assignment
      189.           return 0;
      190.       }
      191.       tmp = OPENSSL_malloc(inlen);
                 ^
      192.       if (tmp == NULL)
      193.           return 0;

crypto/cms/cms_pwri.c:222:5: Array access: Offset added: [4, +oo] (⇐ 4 + [0, +oo]) Size: [1, +oo] by call to `CMS_RecipientInfo_decrypt` 
      220.       }
      221.       *outlen = (size_t)tmp[0];
      222.       memcpy(out, tmp + 4, *outlen);
                 ^
      223.       rv = 1;
      224.    err:
