apps/cms.c:1018: error: BUFFER_OVERRUN_L3
  Offset: 31 (⇐ 28 + 3) Size: [1, +oo] by call to `CMS_decrypt_set1_key`.
Showing all 15 steps of the trace


apps/cms.c:263:5: Assignment
261.       size_t secret_keylen = 0, secret_keyidlen = 0;
262.       unsigned char *pwri_pass = NULL, *pwri_tmp = NULL;
263.       unsigned char *secret_key = NULL, *secret_keyid = NULL;
           ^
264.       long ltmp;
265.       OPTION_CHOICE o;

apps/cms.c:1018:18: Call
1016.   
1017.           if (secret_key) {
1018.               if (!CMS_decrypt_set1_key(cms,
                         ^
1019.                                         secret_key, secret_keylen,
1020.                                         secret_keyid, secret_keyidlen)) {

crypto/cms/cms_smime.c:715:1: Parameter `*key`
  713.   }
  714.   
  715. > int CMS_decrypt_set1_key(CMS_ContentInfo *cms,
  716.                            unsigned char *key, size_t keylen,
  717.                            unsigned char *id, size_t idlen)

crypto/cms/cms_smime.c:733:13: Call
  731.            */
  732.           if (!id || (CMS_RecipientInfo_kekri_id_cmp(ri, id, idlen) == 0)) {
  733.               CMS_RecipientInfo_set0_key(ri, key, keylen);
                     ^
  734.               r = CMS_RecipientInfo_decrypt(cms, ri);
  735.               CMS_RecipientInfo_set0_key(ri, NULL, 0);

crypto/cms/cms_env.c:639:1: Parameter `*ri->d.kekri->key`
    637.   }
    638.   
    639. > int CMS_RecipientInfo_set0_key(CMS_RecipientInfo *ri,
    640.                                  unsigned char *key, size_t keylen)
    641.   {

crypto/cms/cms_smime.c:734:17: Call
  732.           if (!id || (CMS_RecipientInfo_kekri_id_cmp(ri, id, idlen) == 0)) {
  733.               CMS_RecipientInfo_set0_key(ri, key, keylen);
  734.               r = CMS_RecipientInfo_decrypt(cms, ri);
                         ^
  735.               CMS_RecipientInfo_set0_key(ri, NULL, 0);
  736.               if (r > 0)

crypto/cms/cms_env.c:782:1: Parameter `*ri->d.kekri->key`
    780.   }
    781.   
    782. > int CMS_RecipientInfo_decrypt(CMS_ContentInfo *cms, CMS_RecipientInfo *ri)
    783.   {
    784.       switch (ri->type) {

crypto/cms/cms_env.c:789:16: Call
    787.   
    788.       case CMS_RECIPINFO_KEK:
    789.           return cms_RecipientInfo_kekri_decrypt(cms, ri);
                          ^
    790.   
    791.       case CMS_RECIPINFO_PASS:

crypto/cms/cms_env.c:711:1: Parameter `*ri->d.kekri->key`
      709.   /* Decrypt content key in KEK recipient info */
      710.   
      711. > static int cms_RecipientInfo_kekri_decrypt(CMS_ContentInfo *cms,
      712.                                              CMS_RecipientInfo *ri)
      713.   {

crypto/cms/cms_env.c:745:9: Call
      743.       }
      744.   
      745.       if (AES_set_decrypt_key(kekri->key, kekri->keylen << 3, &actx)) {
                     ^
      746.           CMSerr(CMS_F_CMS_RECIPIENTINFO_KEKRI_DECRYPT,
      747.                  CMS_R_ERROR_SETTING_KEY);

crypto/aes/aes_core.c:1309:1: Parameter `*userKey`
        1307.    * Expand the cipher key into the decryption key schedule.
        1308.    */
        1309. > int AES_set_decrypt_key(const unsigned char *userKey, const int bits,
        1310.                           AES_KEY *key)
        1311.   {

crypto/aes/aes_core.c:1318:14: Call
        1316.   
        1317.       /* first, start with an encryption schedule */
        1318.       status = AES_set_encrypt_key(userKey, bits, key);
                             ^
        1319.       if (status < 0)
        1320.           return status;

crypto/aes/aes_core.c:1208:1: <Length trace>
1206.    * Expand the cipher key into the encryption key schedule.
1207.    */
1208. > int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
1209.                           AES_KEY *key)
1210.   {

crypto/aes/aes_core.c:1208:1: Parameter `*userKey`
          1206.    * Expand the cipher key into the encryption key schedule.
          1207.    */
          1208. > int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
          1209.                           AES_KEY *key)
          1210.   {

crypto/aes/aes_core.c:1274:13: Array access: Offset: 31 (⇐ 28 + 3) Size: [1, +oo] by call to `CMS_decrypt_set1_key` 
          1272.       }
          1273.       rk[6] = GETU32(userKey + 24);
          1274.       rk[7] = GETU32(userKey + 28);
                              ^
          1275.       if (bits == 256) {
          1276.           while (1) {
