ssl/s2_srvr.c:900: error: BUFFER_OVERRUN_L1
  Offset: [7, +oo] Size: 1 by call to `i2d_X509`.
Showing all 45 steps of the trace


ssl/s2_srvr.c:875:15: Call
873.   		}
874.   
875.   	x509=(X509 *)d2i_X509(NULL,&p,(long)s->s2->tmp.clen);
                     ^
876.   	if (x509 == NULL)
877.   		{

crypto/asn1/x_x509.c:104:2: Assignment
  102.   	ret->name=X509_NAME_oneline(ret->cert_info->subject,NULL,0);
  103.   
  104.   	M_ASN1_D2I_Finish(a,X509_free,ASN1_F_D2I_X509);
          ^
  105.   	}
  106.   

ssl/s2_srvr.c:875:2: Assignment
873.   		}
874.   
875.   	x509=(X509 *)d2i_X509(NULL,&p,(long)s->s2->tmp.clen);
        ^
876.   	if (x509 == NULL)
877.   		{

ssl/s2_srvr.c:882:45: Call
880.   		}
881.   
882.   	if (((sk=sk_X509_new_null()) == NULL) || (!sk_X509_push(sk,x509)))
                                                   ^
883.   		{
884.   		SSLerr(SSL_F_REQUEST_CERTIFICATE,ERR_R_MALLOC_FAILURE);

crypto/x509/x509_vfy.c:633:1: Parameter `*v`
  631.   	}
  632.   
  633. > IMPLEMENT_STACK_OF(X509)
  634.   IMPLEMENT_ASN1_SET_OF(X509)
  635.   

crypto/x509/x509_vfy.c:633:1: Call
  631.   	}
  632.   
  633. > IMPLEMENT_STACK_OF(X509)
  634.   IMPLEMENT_ASN1_SET_OF(X509)
  635.   

crypto/stack/stack.c:233:1: Parameter `*data`
    231.   	}
    232.   
    233. > int sk_push(STACK *st, char *data)
    234.   	{
    235.   	return(sk_insert(st,data,st->num));

crypto/stack/stack.c:235:9: Call
    233.   int sk_push(STACK *st, char *data)
    234.   	{
    235.   	return(sk_insert(st,data,st->num));
                   ^
    236.   	}
    237.   

crypto/stack/stack.c:134:1: Parameter `**st->data`
      132.   	}
      133.   
      134. > int sk_insert(STACK *st, char *data, int loc)
      135.   	{
      136.   	char **s;

ssl/s2_srvr.c:900:5: Call
898.   		EVP_VerifyUpdate(&ctx,ccd,SSL2_MIN_CERT_CHALLENGE_LENGTH);
899.   
900.   		i=i2d_X509(s->cert->pkeys[SSL_PKEY_RSA_ENC].x509,NULL);
           ^
901.   		buf2=(unsigned char *)Malloc((unsigned int)i);
902.   		if (buf2 == NULL)

crypto/asn1/x_x509.c:75:1: Parameter `**pp`
  73.   	}
  74.   
  75. > int i2d_X509(X509 *a, unsigned char **pp)
  76.   	{
  77.   	M_ASN1_I2D_vars(a);

crypto/asn1/x_x509.c:83:2: Assignment
  81.   	M_ASN1_I2D_len(a->signature,	i2d_ASN1_BIT_STRING);
  82.   
  83.   	M_ASN1_I2D_seq_total();
         ^
  84.   
  85.   	M_ASN1_I2D_put(a->cert_info,	i2d_X509_CINF);

crypto/asn1/x_x509.c:83:2: Call
  81.   	M_ASN1_I2D_len(a->signature,	i2d_ASN1_BIT_STRING);
  82.   
  83.   	M_ASN1_I2D_seq_total();
         ^
  84.   
  85.   	M_ASN1_I2D_put(a->cert_info,	i2d_X509_CINF);

crypto/asn1/asn1_lib.c:180:1: Parameter `**pp`
    178.   /* class 0 is constructed
    179.    * constructed == 2 for indefinitle length constructed */
    180. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
    181.   	     int xclass)
    182.   	{

crypto/asn1/asn1_lib.c:183:2: Assignment
    181.   	     int xclass)
    182.   	{
    183.   	unsigned char *p= *pp;
            ^
    184.   	int i;
    185.   

crypto/asn1/asn1_lib.c:189:5: Assignment
    187.   	i|=(xclass&V_ASN1_PRIVATE);
    188.   	if (tag < 31)
    189.   		*(p++)=i|(tag&V_ASN1_PRIMITIVE_TAG);
               ^
    190.   	else
    191.   		{

crypto/asn1/asn1_lib.c:201:5: Assignment
    199.   		}
    200.   	if ((constructed == 2) && (length == 0))
    201.   		*(p++)=0x80; /* der_put_length would output 0 instead */
               ^
    202.   	else
    203.   		asn1_put_length(&p,length);

crypto/asn1/asn1_lib.c:204:2: Assignment
    202.   	else
    203.   		asn1_put_length(&p,length);
    204.   	*pp=p;
            ^
    205.   	}
    206.   

crypto/asn1/x_x509.c:85:2: Call
  83.   	M_ASN1_I2D_seq_total();
  84.   
  85.   	M_ASN1_I2D_put(a->cert_info,	i2d_X509_CINF);
         ^
  86.   	M_ASN1_I2D_put(a->sig_alg,	i2d_X509_ALGOR);
  87.   	M_ASN1_I2D_put(a->signature,	i2d_ASN1_BIT_STRING);

crypto/asn1/x_cinf.c:63:1: Parameter `**pp`
    61.   #include <openssl/asn1_mac.h>
    62.   
    63. > int i2d_X509_CINF(X509_CINF *a, unsigned char **pp)
    64.   	{
    65.   	int v1=0,v2=0;

crypto/asn1/x_cinf.c:81:2: Assignment
    79.   					     V_ASN1_SEQUENCE,v2);
    80.   
    81.   	M_ASN1_I2D_seq_total();
           ^
    82.   
    83.   	M_ASN1_I2D_put_EXP_opt(a->version,i2d_ASN1_INTEGER,0,v1);

crypto/asn1/x_cinf.c:81:2: Call
    79.   					     V_ASN1_SEQUENCE,v2);
    80.   
    81.   	M_ASN1_I2D_seq_total();
           ^
    82.   
    83.   	M_ASN1_I2D_put_EXP_opt(a->version,i2d_ASN1_INTEGER,0,v1);

crypto/asn1/asn1_lib.c:180:1: Parameter `**pp`
      178.   /* class 0 is constructed
      179.    * constructed == 2 for indefinitle length constructed */
      180. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
      181.   	     int xclass)
      182.   	{

crypto/asn1/asn1_lib.c:183:2: Assignment
      181.   	     int xclass)
      182.   	{
      183.   	unsigned char *p= *pp;
              ^
      184.   	int i;
      185.   

crypto/asn1/asn1_lib.c:189:5: Assignment
      187.   	i|=(xclass&V_ASN1_PRIVATE);
      188.   	if (tag < 31)
      189.   		*(p++)=i|(tag&V_ASN1_PRIMITIVE_TAG);
                 ^
      190.   	else
      191.   		{

crypto/asn1/asn1_lib.c:201:5: Assignment
      199.   		}
      200.   	if ((constructed == 2) && (length == 0))
      201.   		*(p++)=0x80; /* der_put_length would output 0 instead */
                 ^
      202.   	else
      203.   		asn1_put_length(&p,length);

crypto/asn1/asn1_lib.c:204:2: Assignment
      202.   	else
      203.   		asn1_put_length(&p,length);
      204.   	*pp=p;
              ^
      205.   	}
      206.   

crypto/asn1/x_cinf.c:83:2: Call
    81.   	M_ASN1_I2D_seq_total();
    82.   
    83.   	M_ASN1_I2D_put_EXP_opt(a->version,i2d_ASN1_INTEGER,0,v1);
           ^
    84.   	M_ASN1_I2D_put(a->serialNumber,		i2d_ASN1_INTEGER);
    85.   	M_ASN1_I2D_put(a->signature,		i2d_X509_ALGOR);

crypto/asn1/asn1_lib.c:180:1: Parameter `**pp`
      178.   /* class 0 is constructed
      179.    * constructed == 2 for indefinitle length constructed */
      180. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
      181.   	     int xclass)
      182.   	{

crypto/asn1/asn1_lib.c:183:2: Assignment
      181.   	     int xclass)
      182.   	{
      183.   	unsigned char *p= *pp;
              ^
      184.   	int i;
      185.   

crypto/asn1/asn1_lib.c:189:5: Assignment
      187.   	i|=(xclass&V_ASN1_PRIVATE);
      188.   	if (tag < 31)
      189.   		*(p++)=i|(tag&V_ASN1_PRIMITIVE_TAG);
                 ^
      190.   	else
      191.   		{

crypto/asn1/asn1_lib.c:201:5: Assignment
      199.   		}
      200.   	if ((constructed == 2) && (length == 0))
      201.   		*(p++)=0x80; /* der_put_length would output 0 instead */
                 ^
      202.   	else
      203.   		asn1_put_length(&p,length);

crypto/asn1/asn1_lib.c:204:2: Assignment
      202.   	else
      203.   		asn1_put_length(&p,length);
      204.   	*pp=p;
              ^
      205.   	}
      206.   

crypto/asn1/x_cinf.c:83:2: Call
    81.   	M_ASN1_I2D_seq_total();
    82.   
    83.   	M_ASN1_I2D_put_EXP_opt(a->version,i2d_ASN1_INTEGER,0,v1);
           ^
    84.   	M_ASN1_I2D_put(a->serialNumber,		i2d_ASN1_INTEGER);
    85.   	M_ASN1_I2D_put(a->signature,		i2d_X509_ALGOR);

crypto/asn1/a_int.c:88:1: Parameter `**pp`
      86.    */
      87.   
      88. > int i2d_ASN1_INTEGER(ASN1_INTEGER *a, unsigned char **pp)
      89.   	{
      90.   	int pad=0,ret,r,i,t;

crypto/asn1/a_int.c:124:2: Assignment
      122.   	r=ASN1_object_size(0,ret,V_ASN1_INTEGER);
      123.   	if (pp == NULL) return(r);
      124.   	p= *pp;
              ^
      125.   
      126.   	ASN1_put_object(&p,0,ret,V_ASN1_INTEGER,V_ASN1_UNIVERSAL);

crypto/asn1/a_int.c:126:2: Call
      124.   	p= *pp;
      125.   
      126.   	ASN1_put_object(&p,0,ret,V_ASN1_INTEGER,V_ASN1_UNIVERSAL);
              ^
      127.   	if (pad) *(p++)=pb;
      128.   	if (a->length == 0) *(p++)=0;

crypto/asn1/asn1_lib.c:180:1: Parameter `**pp`
        178.   /* class 0 is constructed
        179.    * constructed == 2 for indefinitle length constructed */
        180. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
        181.   	     int xclass)
        182.   	{

crypto/asn1/asn1_lib.c:183:2: Assignment
        181.   	     int xclass)
        182.   	{
        183.   	unsigned char *p= *pp;
                ^
        184.   	int i;
        185.   

crypto/asn1/asn1_lib.c:189:5: Assignment
        187.   	i|=(xclass&V_ASN1_PRIVATE);
        188.   	if (tag < 31)
        189.   		*(p++)=i|(tag&V_ASN1_PRIMITIVE_TAG);
                   ^
        190.   	else
        191.   		{

crypto/asn1/asn1_lib.c:203:3: Call
        201.   		*(p++)=0x80; /* der_put_length would output 0 instead */
        202.   	else
        203.   		asn1_put_length(&p,length);
                 ^
        204.   	*pp=p;
        205.   	}

crypto/asn1/asn1_lib.c:207:1: <Length trace>
205.   	}
206.   
207. > static void asn1_put_length(unsigned char **pp, int length)
208.   	{
209.   	unsigned char *p= *pp;

crypto/asn1/asn1_lib.c:207:1: Parameter `**pp`
          205.   	}
          206.   
          207. > static void asn1_put_length(unsigned char **pp, int length)
          208.   	{
          209.   	unsigned char *p= *pp;

crypto/asn1/asn1_lib.c:209:2: Assignment
          207.   static void asn1_put_length(unsigned char **pp, int length)
          208.   	{
          209.   	unsigned char *p= *pp;
                  ^
          210.   	int i,l;
          211.   	if (length <= 127)

crypto/asn1/asn1_lib.c:218:3: Array access: Offset: [7, +oo] Size: 1 by call to `i2d_X509` 
          216.   		for (i=0; l > 0; i++)
          217.   			l>>=8;
          218.   		*(p++)=i|0x80;
                   ^
          219.   		l=i;
          220.   		while (i-- > 0)
