fuzz/test-corpus.c:55: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, +oo] by call to `FuzzerTestOneInput`.
Showing all 25 steps of the trace


fuzz/test-corpus.c:51:11: Array declaration
49.       if (f == NULL)
50.           return;
51.       buf = malloc(st.st_size);
                ^
52.       if (buf != NULL) {
53.           s = fread(buf, 1, st.st_size, f);

fuzz/test-corpus.c:51:5: Assignment
49.       if (f == NULL)
50.           return;
51.       buf = malloc(st.st_size);
          ^
52.       if (buf != NULL) {
53.           s = fread(buf, 1, st.st_size, f);

fuzz/test-corpus.c:55:9: Call
53.           s = fread(buf, 1, st.st_size, f);
54.           OPENSSL_assert(s == (size_t)st.st_size);
55.           FuzzerTestOneInput(buf, s);
              ^
56.           free(buf);
57.       }

fuzz/x509.c:28:1: Parameter `*buf`
  26.   }
  27.   
  28. > int FuzzerTestOneInput(const uint8_t *buf, size_t len)
  29.   {
  30.       const unsigned char *p = buf;

fuzz/x509.c:30:5: Assignment
  28.   int FuzzerTestOneInput(const uint8_t *buf, size_t len)
  29.   {
  30.       const unsigned char *p = buf;
            ^
  31.       unsigned char *der = NULL;
  32.   

fuzz/x509.c:33:18: Call
  31.       unsigned char *der = NULL;
  32.   
  33.       X509 *x509 = d2i_X509(NULL, &p, len);
                         ^
  34.       if (x509 != NULL) {
  35.           BIO *bio = BIO_new(BIO_s_null());

crypto/x509/x_x509.c:118:1: Parameter `**in`
    116.   } ASN1_SEQUENCE_END_ref(X509, X509)
    117.   
    118. > IMPLEMENT_ASN1_FUNCTIONS(X509)
    119.   IMPLEMENT_ASN1_DUP_FUNCTION(X509)
    120.   

crypto/x509/x_x509.c:118:1: Call
    116.   } ASN1_SEQUENCE_END_ref(X509, X509)
    117.   
    118. > IMPLEMENT_ASN1_FUNCTIONS(X509)
    119.   IMPLEMENT_ASN1_DUP_FUNCTION(X509)
    120.   

crypto/asn1/tasn_dec.c:105:1: Parameter `**in`
      103.    */
      104.   
      105. > ASN1_VALUE *ASN1_item_d2i(ASN1_VALUE **pval,
      106.                             const unsigned char **in, long len,
      107.                             const ASN1_ITEM *it)

crypto/asn1/tasn_dec.c:114:9: Call
      112.           pval = &ptmpval;
      113.       asn1_tlc_clear_nc(&c);
      114.       if (ASN1_item_ex_d2i(pval, in, len, it, -1, 0, 0, &c) > 0)
                     ^
      115.           return *pval;
      116.       return NULL;

crypto/asn1/tasn_dec.c:119:1: Parameter `**in`
        117.   }
        118.   
        119. > int ASN1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in, long len,
        120.                        const ASN1_ITEM *it,
        121.                        int tag, int aclass, char opt, ASN1_TLC *ctx)

crypto/asn1/tasn_dec.c:124:10: Call
        122.   {
        123.       int rv;
        124.       rv = asn1_item_embed_d2i(pval, in, len, it, tag, aclass, opt, ctx, 0);
                        ^
        125.       if (rv <= 0)
        126.           ASN1_item_ex_free(pval, it);

crypto/asn1/tasn_dec.c:135:1: Parameter `**in`
          133.    */
          134.   
          135. > static int asn1_item_embed_d2i(ASN1_VALUE **pval, const unsigned char **in,
          136.                                  long len, const ASN1_ITEM *it,
          137.                                  int tag, int aclass, char opt, ASN1_TLC *ctx,

crypto/asn1/tasn_dec.c:178:20: Call
          176.                   goto err;
          177.               }
          178.               return asn1_template_ex_d2i(pval, in, len,
                                    ^
          179.                                           it->templates, opt, ctx, depth);
          180.           }

crypto/asn1/tasn_dec.c:437:1: Parameter `**in`
            435.    */
            436.   
            437. > static int asn1_template_ex_d2i(ASN1_VALUE **val,
            438.                                   const unsigned char **in, long inlen,
            439.                                   const ASN1_TEMPLATE *tt, char opt,

crypto/asn1/tasn_dec.c:452:5: Assignment
            450.       aclass = flags & ASN1_TFLG_TAG_CLASS;
            451.   
            452.       p = *in;
                       ^
            453.   
            454.       /* Check if EXPLICIT tag expected */

crypto/asn1/tasn_dec.c:461:15: Call
            459.            * where it starts: so read in EXPLICIT header to get the info.
            460.            */
            461.           ret = asn1_check_tlen(&len, NULL, NULL, &exp_eoc, &cst,
                                 ^
            462.                                 &p, inlen, tt->tag, aclass, opt, ctx);
            463.           q = p;

crypto/asn1/tasn_dec.c:1078:1: Parameter `**in`
              1076.    */
              1077.   
              1078. > static int asn1_check_tlen(long *olen, int *otag, unsigned char *oclass,
              1079.                              char *inf, char *cst,
              1080.                              const unsigned char **in, long len,

crypto/asn1/tasn_dec.c:1087:5: Assignment
              1085.       long plen;
              1086.       const unsigned char *p, *q;
              1087.       p = *in;
                          ^
              1088.       q = p;
              1089.   

crypto/asn1/tasn_dec.c:1097:13: Call
              1095.           p += ctx->hdrlen;
              1096.       } else {
              1097.           i = ASN1_get_object(&p, &plen, &ptag, &pclass, len);
                                  ^
              1098.           if (ctx) {
              1099.               ctx->ret = i;

crypto/asn1/asn1_lib.c:44:1: <Length trace>
42.   }
43.   
44. > int ASN1_get_object(const unsigned char **pp, long *plength, int *ptag,
45.                       int *pclass, long omax)
46.   {

crypto/asn1/asn1_lib.c:44:1: Parameter `**pp`
                42.   }
                43.   
                44. > int ASN1_get_object(const unsigned char **pp, long *plength, int *ptag,
                45.                       int *pclass, long omax)
                46.   {

crypto/asn1/asn1_lib.c:49:5: Assignment
                47.       int i, ret;
                48.       long l;
                49.       const unsigned char *p = *pp;
                          ^
                50.       int tag, xclass, inf;
                51.       long max = omax;

crypto/asn1/asn1_lib.c:59:9: Assignment
                57.       i = *p & V_ASN1_PRIMITIVE_TAG;
                58.       if (i == V_ASN1_PRIMITIVE_TAG) { /* high-tag */
                59.           p++;
                              ^
                60.           if (--max == 0)
                61.               goto err;

crypto/asn1/asn1_lib.c:63:16: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `FuzzerTestOneInput` 
                61.               goto err;
                62.           l = 0;
                63.           while (*p & 0x80) {
                                     ^
                64.               l <<= 7L;
                65.               l |= *(p++) & 0x7f;
