crypto/pkcs12/p12_crt.c:117: error: BUFFER_OVERRUN_L3
  Offset: [0, 3] Size: [0, 4] by call to `PKCS12_pack_p7encdata`.
Showing all 22 steps of the trace


crypto/pkcs12/p12_crt.c:108:15: Call
106.   		for(i = 0; i < sk_num(ca); i++) {
107.   			tcert = (X509 *)sk_value(ca, i);
108.   			if(!(bag = M_PKCS12_x5092certbag(tcert))) return NULL;
                     ^
109.   			if(!sk_push(bags, (char *)bag)) {
110.   				PKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE);

crypto/pkcs12/p12_add.c:79:18: Call
  77.   		return NULL;
  78.   	}
  79.   	if (!(safebag = PKCS12_SAFEBAG_new ())) {
                         ^
  80.   		PKCS12err(PKCS12_F_PKCS12_PACK_SAFEBAG, ERR_R_MALLOC_FAILURE);
  81.   		return NULL;

crypto/pkcs12/p12_sbag.c:149:2: Call
    147.   	ret->type=NULL;
    148.   	ret->value.other=NULL;
    149.   	M_ASN1_New(ret->attrib, sk_new_null);
            ^
    150.   	ret->rest=NULL;
    151.   	return (ret);

crypto/stack/stack.c:125:2: Assignment
      123.   	ret->comp=c;
      124.   	ret->num_alloc=MIN_NODES;
      125.   	ret->num=0;
              ^
      126.   	ret->sorted=0;
      127.   	return(ret);

crypto/pkcs12/p12_crt.c:109:8: Call
107.   			tcert = (X509 *)sk_value(ca, i);
108.   			if(!(bag = M_PKCS12_x5092certbag(tcert))) return NULL;
109.   			if(!sk_push(bags, (char *)bag)) {
              ^
110.   				PKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE);
111.   				return NULL;

crypto/stack/stack.c:237:1: Parameter `st->num`
  235.   	}
  236.   
  237. > int sk_push(STACK *st, char *data)
  238.   	{
  239.   	return(sk_insert(st,data,st->num));

crypto/stack/stack.c:239:9: Call
  237.   int sk_push(STACK *st, char *data)
  238.   	{
  239.   	return(sk_insert(st,data,st->num));
                 ^
  240.   	}
  241.   

crypto/stack/stack.c:134:1: Parameter `st->num`
    132.   	}
    133.   
    134. > int sk_insert(STACK *st, char *data, int loc)
    135.   	{
    136.   	char **s;

crypto/pkcs12/p12_crt.c:117:13: Call
115.   
116.   	/* Turn certbags into encrypted authsafe */
117.   	authsafe = PKCS12_pack_p7encdata (nid_cert, pass, -1, NULL, 0,
                   ^
118.   					  iter, bags);
119.   	sk_pop_free(bags, PKCS12_SAFEBAG_free);

crypto/pkcs12/p12_add.c:150:1: Parameter `bags->num`
  148.   /* Turn a stack of SAFEBAGS into a PKCS#7 encrypted data ContentInfo */
  149.   
  150. > PKCS7 *PKCS12_pack_p7encdata (int pbe_nid, const char *pass, int passlen,
  151.   	     unsigned char *salt, int saltlen, int iter, STACK *bags)
  152.   {

crypto/pkcs12/p12_add.c:174:2: Call
  172.   	ASN1_OCTET_STRING_free(p7->d.encrypted->enc_data->enc_data);
  173.   	if (!(p7->d.encrypted->enc_data->enc_data =
  174.   	PKCS12_i2d_encrypt (pbe, i2d_PKCS12_SAFEBAG, pass, passlen,
          ^
  175.   				 (char *)bags, 1))) {
  176.   		PKCS12err(PKCS12_F_PKCS12_PACK_P7ENCDATA, PKCS12_R_ENCRYPT_ERROR);

crypto/pkcs12/p12_decr.c:149:1: Parameter `obj->num`
    147.    */
    148.   
    149. > ASN1_OCTET_STRING *PKCS12_i2d_encrypt (X509_ALGOR *algor, int (*i2d)(),
    150.   				       const char *pass, int passlen,
    151.   				       char *obj, int seq)

crypto/pkcs12/p12_decr.c:160:19: Call
    158.   		return NULL;
    159.   	}
    160.   	if (seq) inlen = i2d_ASN1_SET((STACK *)obj, NULL, i2d, V_ASN1_SEQUENCE,
                             ^
    161.   						 V_ASN1_UNIVERSAL, IS_SEQUENCE);
    162.   	else inlen = i2d (obj, NULL);

crypto/asn1/a_set.c:122:14: <Offset trace>
120.   we will store the SET blobs */
121.   
122.           for (i=0; i<sk_num(a); i++)
                    ^
123.   	        {
124.                   rgSetBlob[i].pbData = p;  /* catch each set encode blob */

crypto/asn1/a_set.c:122:14: Assignment
      120.   we will store the SET blobs */
      121.   
      122.           for (i=0; i<sk_num(a); i++)
                          ^
      123.   	        {
      124.                   rgSetBlob[i].pbData = p;  /* catch each set encode blob */

crypto/asn1/a_set.c:86:1: <Length trace>
84.   
85.   /* int is_set:  if TRUE, then sort the contents (i.e. it isn't a SEQUENCE)    */
86. > int i2d_ASN1_SET(STACK *a, unsigned char **pp, int (*func)(), int ex_tag,
87.   	     int ex_class, int is_set)
88.   	{

crypto/asn1/a_set.c:86:1: Parameter `a->num`
      84.   
      85.   /* int is_set:  if TRUE, then sort the contents (i.e. it isn't a SEQUENCE)    */
      86. > int i2d_ASN1_SET(STACK *a, unsigned char **pp, int (*func)(), int ex_tag,
      87.   	     int ex_class, int is_set)
      88.   	{

crypto/asn1/a_set.c:119:39: Call
      117.   
      118.           pStart  = p; /* Catch the beg of Setblobs*/
      119.           rgSetBlob = (MYBLOB *)Malloc( sk_num(a) * sizeof(MYBLOB)); /* In this array
                                                   ^
      120.   we will store the SET blobs */
      121.   

crypto/stack/stack.c:289:17: Assignment
        287.   int sk_num(STACK *st)
        288.   {
        289.   	if(st == NULL) return -1;
                               ^
        290.   	return st->num;
        291.   }

crypto/asn1/a_set.c:119:31: Array declaration
      117.   
      118.           pStart  = p; /* Catch the beg of Setblobs*/
      119.           rgSetBlob = (MYBLOB *)Malloc( sk_num(a) * sizeof(MYBLOB)); /* In this array
                                           ^
      120.   we will store the SET blobs */
      121.   

crypto/asn1/a_set.c:119:9: Assignment
      117.   
      118.           pStart  = p; /* Catch the beg of Setblobs*/
      119.           rgSetBlob = (MYBLOB *)Malloc( sk_num(a) * sizeof(MYBLOB)); /* In this array
                     ^
      120.   we will store the SET blobs */
      121.   

crypto/asn1/a_set.c:124:17: Array access: Offset: [0, 3] Size: [0, 4] by call to `PKCS12_pack_p7encdata` 
      122.           for (i=0; i<sk_num(a); i++)
      123.   	        {
      124.                   rgSetBlob[i].pbData = p;  /* catch each set encode blob */
                             ^
      125.                   func(sk_value(a,i),&p);
      126.                   rgSetBlob[i].cbData = p - rgSetBlob[i].pbData; /* Length of this
