apps/spkac.c:234: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, +oo] by call to `NETSCAPE_SPKI_get_pubkey`.
Showing all 19 steps of the trace


apps/spkac.c:215:9: Call
213.   	}
214.   
215.   	spki = NETSCAPE_SPKI_b64_decode(spkstr, -1);
               ^
216.   	if(!spki) {
217.   		BIO_printf(bio_err, "Error loading SPKAC\n");

crypto/x509/x509spki.c:97:9: Call
  95.   	}
  96.   	p = spki_der;
  97.   	spki = d2i_NETSCAPE_SPKI(NULL, &p, spki_len);
                 ^
  98.   	Free(spki_der);
  99.   	return spki;

crypto/asn1/x_spki.c:132:1: Parameter `(*a)->spkac->pubkey->algor->parameter->value.ptr->data`
    130.   	}
    131.   
    132. > NETSCAPE_SPKI *d2i_NETSCAPE_SPKI(NETSCAPE_SPKI **a, unsigned char **pp,
    133.   	     long length)
    134.   	{

apps/spkac.c:234:11: Call
232.   	if(verify) {
233.   		EVP_PKEY *pktmp;
234.   		pktmp = NETSCAPE_SPKI_get_pubkey(spki);
                 ^
235.   		i = NETSCAPE_SPKI_verify(spki, pktmp);
236.   		EVP_PKEY_free(pktmp);

crypto/x509/x509spki.c:70:1: Parameter `*x->spkac->pubkey->algor->parameter->value.sequence->data`
  68.   }
  69.   
  70. > EVP_PKEY *NETSCAPE_SPKI_get_pubkey(NETSCAPE_SPKI *x)
  71.   {
  72.   	if ((x == NULL) || (x->spkac == NULL))

crypto/x509/x509spki.c:74:9: Call
  72.   	if ((x == NULL) || (x->spkac == NULL))
  73.   		return(NULL);
  74.   	return(X509_PUBKEY_get(x->spkac->pubkey));
                ^
  75.   }
  76.   

crypto/asn1/x_pubkey.c:201:1: Parameter `*key->algor->parameter->value.sequence->data`
    199.   	}
    200.   
    201. > EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)
    202.   	{
    203.   	EVP_PKEY *ret=NULL;

crypto/asn1/x_pubkey.c:238:4: Assignment
    236.   			{
    237.   			ret->pkey.dsa->write_params=0;
    238.   			p=a->parameter->value.sequence->data;
              ^
    239.   			j=a->parameter->value.sequence->length;
    240.   			if (!d2i_DSAparams(&ret->pkey.dsa,&p,(long)j))

crypto/asn1/x_pubkey.c:240:9: Call
    238.   			p=a->parameter->value.sequence->data;
    239.   			j=a->parameter->value.sequence->length;
    240.   			if (!d2i_DSAparams(&ret->pkey.dsa,&p,(long)j))
                   ^
    241.   				goto err;
    242.   			}

crypto/asn1/d2i_dsap.c:71:1: Parameter `**pp`
      69.   #endif
      70.   
      71. > DSA *d2i_DSAparams(DSA **a, unsigned char **pp, long length)
      72.   	{
      73.   	int i=ERR_R_NESTED_ASN1_ERROR;

crypto/asn1/d2i_dsap.c:77:2: Assignment
      75.   	M_ASN1_D2I_vars(a,DSA *,DSA_new);
      76.   
      77.   	M_ASN1_D2I_Init();
             ^
      78.   	M_ASN1_D2I_start_sequence();
      79.   	M_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);

crypto/asn1/d2i_dsap.c:78:2: Call
      76.   
      77.   	M_ASN1_D2I_Init();
      78.   	M_ASN1_D2I_start_sequence();
             ^
      79.   	M_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);
      80.   	if ((ret->p=BN_bin2bn(bs->data,bs->length,ret->p)) == NULL) goto err_bn;

crypto/asn1/asn1_lib.c:277:1: Parameter `*c->p`
        275.   	}
        276.   
        277. > int asn1_GetSequence(ASN1_CTX *c, long *length)
        278.   	{
        279.   	unsigned char *q;

crypto/asn1/asn1_lib.c:282:9: Call
        280.   
        281.   	q=c->p;
        282.   	c->inf=ASN1_get_object(&(c->p),&(c->slen),&(c->tag),&(c->xclass),
                       ^
        283.   		*length);
        284.   	if (c->inf & 0x80)

crypto/asn1/asn1_lib.c:83:1: <Length trace>
81.   
82.   
83. > int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
84.   	     long omax)
85.   	{

crypto/asn1/asn1_lib.c:83:1: Parameter `**pp`
          81.   
          82.   
          83. > int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
          84.   	     long omax)
          85.   	{

crypto/asn1/asn1_lib.c:88:2: Assignment
          86.   	int i,ret;
          87.   	long l;
          88.   	unsigned char *p= *pp;
                 ^
          89.   	int tag,xclass,inf;
          90.   	long max=omax;

crypto/asn1/asn1_lib.c:98:3: Assignment
          96.   	if (i == V_ASN1_PRIMITIVE_TAG)
          97.   		{		/* high-tag */
          98.   		p++;
                   ^
          99.   		if (--max == 0) goto err;
          100.   		l=0;

crypto/asn1/asn1_lib.c:101:10: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `NETSCAPE_SPKI_get_pubkey` 
          99.   		if (--max == 0) goto err;
          100.   		l=0;
          101.   		while (*p&0x80)
                          ^
          102.   			{
          103.   			l<<=7L;
