crypto/pem/pem_sign.c:93: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] (⇐ [0, +oo] + 2) Size: [1, +oo] by call to `EVP_EncodeBlock`.
Showing all 9 steps of the trace


crypto/pem/pem_sign.c:84:9: Call
82.       unsigned int m_len;
83.   
84.       m = OPENSSL_malloc(EVP_PKEY_size(pkey) + 2);
              ^
85.       if (m == NULL) {
86.           PEMerr(PEM_F_PEM_SIGNFINAL, ERR_R_MALLOC_FAILURE);

crypto/evp/p_lib.c:104:5: Assignment
  102.       if (pkey && pkey->ameth && pkey->ameth->pkey_size)
  103.           return pkey->ameth->pkey_size(pkey);
  104.       return 0;
             ^
  105.   }
  106.   

crypto/pem/pem_sign.c:84:9: Call
82.       unsigned int m_len;
83.   
84.       m = OPENSSL_malloc(EVP_PKEY_size(pkey) + 2);
              ^
85.       if (m == NULL) {
86.           PEMerr(PEM_F_PEM_SIGNFINAL, ERR_R_MALLOC_FAILURE);

crypto/mem.c:125:9: Assignment
  123.   
  124.       if (num <= 0)
  125.           return NULL;
                 ^
  126.   
  127.       allow_customize = 0;

crypto/pem/pem_sign.c:84:5: Assignment
82.       unsigned int m_len;
83.   
84.       m = OPENSSL_malloc(EVP_PKEY_size(pkey) + 2);
          ^
85.       if (m == NULL) {
86.           PEMerr(PEM_F_PEM_SIGNFINAL, ERR_R_MALLOC_FAILURE);

crypto/pem/pem_sign.c:93:9: Call
91.           goto err;
92.   
93.       i = EVP_EncodeBlock(sigret, m, m_len);
              ^
94.       *siglen = i;
95.       ret = 1;

crypto/evp/encode.c:220:1: <Length trace>
218.   }
219.   
220. > int EVP_EncodeBlock(unsigned char *t, const unsigned char *f, int dlen)
221.   {
222.       int i, ret = 0;

crypto/evp/encode.c:220:1: Parameter `*f`
  218.   }
  219.   
  220. > int EVP_EncodeBlock(unsigned char *t, const unsigned char *f, int dlen)
  221.   {
  222.       int i, ret = 0;

crypto/evp/encode.c:228:49: Array access: Offset: [2, +oo] (⇐ [0, +oo] + 2) Size: [1, +oo] by call to `EVP_EncodeBlock` 
  226.           if (i >= 3) {
  227.               l = (((unsigned long)f[0]) << 16L) |
  228.                   (((unsigned long)f[1]) << 8L) | f[2];
                                                         ^
  229.               *(t++) = conv_bin2ascii(l >> 18L);
  230.               *(t++) = conv_bin2ascii(l >> 12L);
