crypto/x509v3/v3_conf.c:268: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] Size: [1, +oo] by call to `X509V3_EXT_conf`.
Showing all 21 steps of the trace


crypto/x509v3/v3_conf.c:268:14: Call
266.   	for(i = 0; i < sk_num(nval); i++) {
267.   		val = (CONF_VALUE *)sk_value(nval, i);
268.   		if(!(ext = X509V3_EXT_conf(conf, ctx, val->name, val->value)))
                    ^
269.   								return 0;
270.   		if(crl) X509_CRL_add_ext(crl, ext, -1);

crypto/x509v3/v3_conf.c:87:8: Call
  85.   	if((ext_type = v3_check_generic(&value))) 
  86.   		return v3_generic_extension(name, value, crit, ext_type);
  87.   	ret = do_ext_conf(conf, ctx, OBJ_sn2nid(name), crit, value);
               ^
  88.   	if(!ret) {
  89.   		X509V3err(X509V3_F_X509V3_EXT_CONF,X509V3_R_ERROR_IN_EXTENSION);

crypto/x509v3/v3_conf.c:132:15: Call
    130.   	if(method->v2i) {
    131.   		if(*value == '@') nval = CONF_get_section(conf, value + 1);
    132.   		else nval = X509V3_parse_list(value);
                         ^
    133.   		if(!nval) {
    134.   			X509V3err(X509V3_F_X509V3_EXT_CONF,X509V3_R_INVALID_EXTENSION_STRING);

crypto/x509v3/v3_utl.c:244:12: Call
      242.   			} else if(c == ',') {
      243.   				*p = 0;
      244.   				ntmp = strip_spaces(q);
                        ^
      245.   				q = p + 1;
      246.   #ifdef DEBUG

crypto/x509v3/v3_utl.c:309:1: Parameter `name->strlen`
        307.   
        308.   /* Delete leading and trailing spaces from a string */
        309. > static char *strip_spaces(char *name)
        310.   {
        311.   	char *p, *q;

crypto/x509v3/v3_utl.c:253:5: Call
      251.   					goto err;
      252.   				}
      253.   				X509V3_add_value(ntmp, NULL, &values);
                 ^
      254.   			}
      255.   			break ;

crypto/x509v3/v3_utl.c:74:2: Assignment
        72.   {
        73.   	CONF_VALUE *vtmp = NULL;
        74.   	char *tname = NULL, *tvalue = NULL;
               ^
        75.   	if(name && !(tname = BUF_strdup(name))) goto err;
        76.   	if(value && !(tvalue = BUF_strdup(value))) goto err;;

crypto/x509v3/v3_utl.c:80:2: Assignment
        78.   	if(!*extlist && !(*extlist = sk_new(NULL))) goto err;
        79.   	vtmp->section = NULL;
        80.   	vtmp->name = tname;
               ^
        81.   	vtmp->value = tvalue;
        82.   	if(!sk_push(*extlist, (char *)vtmp)) goto err;

crypto/x509v3/v3_conf.c:268:14: Call
266.   	for(i = 0; i < sk_num(nval); i++) {
267.   		val = (CONF_VALUE *)sk_value(nval, i);
268.   		if(!(ext = X509V3_EXT_conf(conf, ctx, val->name, val->value)))
                    ^
269.   								return 0;
270.   		if(crl) X509_CRL_add_ext(crl, ext, -1);

crypto/x509v3/v3_conf.c:78:1: Parameter `*name`
  76.   /* char *name:  Name    */
  77.   /* char *value:  Value    */
  78. > X509_EXTENSION *X509V3_EXT_conf(LHASH *conf, X509V3_CTX *ctx, char *name,
  79.   	     char *value)
  80.   {

crypto/x509v3/v3_conf.c:86:10: Call
  84.   	crit = v3_check_critical(&value);
  85.   	if((ext_type = v3_check_generic(&value))) 
  86.   		return v3_generic_extension(name, value, crit, ext_type);
                 ^
  87.   	ret = do_ext_conf(conf, ctx, OBJ_sn2nid(name), crit, value);
  88.   	if(!ret) {

crypto/x509v3/v3_conf.c:195:1: Parameter `*ext`
    193.   
    194.   /* Create a generic extension: for now just handle RAW type */
    195. > static X509_EXTENSION *v3_generic_extension(const char *ext, char *value,
    196.   	     int crit, int type)
    197.   {

crypto/x509v3/v3_conf.c:203:12: Call
    201.   ASN1_OCTET_STRING *oct=NULL;
    202.   X509_EXTENSION *extension=NULL;
    203.   if(!(obj = OBJ_txt2obj(ext, 0))) {
                      ^
    204.   	X509V3err(X509V3_F_V3_GENERIC_EXTENSION,X509V3_R_EXTENSION_NAME_ERROR);
    205.   	ERR_add_error_data(2, "name=", ext);

crypto/objects/obj_dat.c:384:1: Parameter `*s`
      382.    */
      383.   
      384. > ASN1_OBJECT *OBJ_txt2obj(const char *s, int no_name)
      385.   	{
      386.   	int nid = NID_undef;

crypto/objects/obj_dat.c:398:4: Call
      396.   
      397.   	/* Work out size of content octets */
      398.   	i=a2d_ASN1_OBJECT(NULL,0,s,-1);
                ^
      399.   	if (i <= 0) {
      400.   		/* Clear the error */

crypto/asn1/a_object.c:83:1: <Length trace>
81.   	}
82.   
83. > int a2d_ASN1_OBJECT(unsigned char *out, int olen, const char *buf, int num)
84.   	{
85.   	int i,first,len=0,c;

crypto/asn1/a_object.c:83:1: Parameter `*buf`
        81.   	}
        82.   
        83. > int a2d_ASN1_OBJECT(unsigned char *out, int olen, const char *buf, int num)
        84.   	{
        85.   	int i,first,len=0,c;

crypto/asn1/a_object.c:95:2: Assignment
        93.   		num=strlen(buf);
        94.   
        95.   	p=buf;
               ^
        96.   	c= *(p++);
        97.   	num--;

crypto/asn1/a_object.c:96:7: Assignment
        94.   
        95.   	p=buf;
        96.   	c= *(p++);
                    ^
        97.   	num--;
        98.   	if ((c >= '0') && (c <= '2'))

crypto/asn1/a_object.c:113:7: Assignment
        111.   		goto err;
        112.   		}
        113.   	c= *(p++);
                     ^
        114.   	num--;
        115.   	for (;;)

crypto/asn1/a_object.c:128:7: Array access: Offset: [2, +oo] Size: [1, +oo] by call to `X509V3_EXT_conf` 
        126.   			if (num <= 0) break;
        127.   			num--;
        128.   			c= *(p++);
                     ^
        129.   			if ((c == ' ') || (c == '.'))
        130.   				break;
