apps/x509.c:1066: error: BUFFER_OVERRUN_L3
  Offset added: [-2, +oo] Size: [1, +oo] by call to `set_cert_times`.
Showing all 26 steps of the trace


apps/x509.c:1064:10: Call
1062.   {
1063.   
1064.       if (!X509_set_issuer_name(x, X509_get_subject_name(x)))
                 ^
1065.           goto err;
1066.       if (!preserve_dates && !set_cert_times(x, NULL, NULL, days))

crypto/x509/x509_set.c:54:12: Call
  52.       if (x == NULL)
  53.           return 0;
  54.       return X509_NAME_set(&x->cert_info.issuer, name);
                   ^
  55.   }
  56.   

crypto/x509/x_name.c:476:17: Call
    474.   int X509_NAME_set(X509_NAME **xn, X509_NAME *name)
    475.   {
    476.       if ((name = X509_NAME_dup(name)) == NULL)
                           ^
    477.           return 0;
    478.       X509_NAME_free(*xn);

crypto/x509/x_name.c:88:1: Call
      86.   IMPLEMENT_ASN1_FUNCTIONS(X509_NAME)
      87.   
      88. > IMPLEMENT_ASN1_DUP_FUNCTION(X509_NAME)
      89.   
      90.   static int x509_name_ex_new(ASN1_VALUE **val, const ASN1_ITEM *it)

crypto/asn1/a_dup.c:59:9: Call
        57.           return NULL;
        58.   
        59.       i = ASN1_item_i2d(x, &b, it);
                      ^
        60.       if (b == NULL) {
        61.           ASN1err(ASN1_F_ASN1_ITEM_DUP, ERR_R_MALLOC_FAILURE);

crypto/asn1/tasn_enc.c:44:12: Call
          42.   int ASN1_item_i2d(ASN1_VALUE *val, unsigned char **out, const ASN1_ITEM *it)
          43.   {
          44.       return asn1_item_flags_i2d(val, out, it, 0);
                           ^
          45.   }
          46.   

crypto/asn1/tasn_enc.c:54:1: Parameter `(*out)->strlen`
            52.    */
            53.   
            54. > static int asn1_item_flags_i2d(ASN1_VALUE *val, unsigned char **out,
            55.                                  const ASN1_ITEM *it, int flags)
            56.   {

apps/x509.c:1066:29: Call
1064.       if (!X509_set_issuer_name(x, X509_get_subject_name(x)))
1065.           goto err;
1066.       if (!preserve_dates && !set_cert_times(x, NULL, NULL, days))
                                    ^
1067.           goto err;
1068.       if (!X509_set_pubkey(x, pkey))

apps/apps.c:2667:1: Parameter `startdate->strlen`
  2665.   }
  2666.   
  2667. > int set_cert_times(X509 *x, const char *startdate, const char *enddate,
  2668.                      int days)
  2669.   {

apps/apps.c:2674:14: Call
  2672.               return 0;
  2673.       } else {
  2674.           if (!ASN1_TIME_set_string_X509(X509_getm_notBefore(x), startdate))
                       ^
  2675.               return 0;
  2676.       }

crypto/asn1/a_time.c:374:1: <Offset trace>
372.   }
373.   
374. > int ASN1_TIME_set_string_X509(ASN1_TIME *s, const char *str)
375.   {
376.       ASN1_TIME t;

crypto/asn1/a_time.c:374:1: Parameter `str->strlen`
    372.   }
    373.   
    374. > int ASN1_TIME_set_string_X509(ASN1_TIME *s, const char *str)
    375.   {
    376.       ASN1_TIME t;

crypto/asn1/a_time.c:380:5: Assignment
    378.       int rv = 0;
    379.   
    380.       t.length = strlen(str);
               ^
    381.       t.data = (unsigned char *)str;
    382.       t.flags = ASN1_STRING_FLAG_X509_TIME;

crypto/asn1/a_time.c:410:13: Assignment
    408.               goto out;
    409.           if (is_utc(tm.tm_year)) {
    410.               t.length -= 2;
                       ^
    411.               /*
    412.                * it's OK to let original t.data go since that's assigned

crypto/asn1/a_time.c:374:1: <Length trace>
372.   }
373.   
374. > int ASN1_TIME_set_string_X509(ASN1_TIME *s, const char *str)
375.   {
376.       ASN1_TIME t;

crypto/asn1/a_time.c:374:1: Parameter `str->strlen`
    372.   }
    373.   
    374. > int ASN1_TIME_set_string_X509(ASN1_TIME *s, const char *str)
    375.   {
    376.       ASN1_TIME t;

crypto/asn1/a_time.c:380:5: Assignment
    378.       int rv = 0;
    379.   
    380.       t.length = strlen(str);
               ^
    381.       t.data = (unsigned char *)str;
    382.       t.flags = ASN1_STRING_FLAG_X509_TIME;

crypto/asn1/a_time.c:410:13: Assignment
    408.               goto out;
    409.           if (is_utc(tm.tm_year)) {
    410.               t.length -= 2;
                       ^
    411.               /*
    412.                * it's OK to let original t.data go since that's assigned

crypto/asn1/a_time.c:416:22: Call
    414.                * new t.data would be freed after ASN1_STRING_copy is done.
    415.                */
    416.               t.data = OPENSSL_zalloc(t.length + 1);
                                ^
    417.               if (t.data == NULL)
    418.                   goto out;

crypto/mem.c:218:1: Parameter `num`
      216.   }
      217.   
      218. > void *CRYPTO_zalloc(size_t num, const char *file, int line)
      219.   {
      220.       void *ret = CRYPTO_malloc(num, file, line);

crypto/mem.c:220:17: Call
      218.   void *CRYPTO_zalloc(size_t num, const char *file, int line)
      219.   {
      220.       void *ret = CRYPTO_malloc(num, file, line);
                             ^
      221.   
      222.       FAILTEST();

crypto/mem.c:198:9: Assignment
        196.   
        197.       if (num == 0)
        198.           return NULL;
                       ^
        199.   
        200.       FAILTEST();

crypto/mem.c:220:5: Assignment
      218.   void *CRYPTO_zalloc(size_t num, const char *file, int line)
      219.   {
      220.       void *ret = CRYPTO_malloc(num, file, line);
                 ^
      221.   
      222.       FAILTEST();

crypto/mem.c:225:5: Assignment
      223.       if (ret != NULL)
      224.           memset(ret, 0, num);
      225.       return ret;
                 ^
      226.   }
      227.   

crypto/asn1/a_time.c:416:13: Assignment
    414.                * new t.data would be freed after ASN1_STRING_copy is done.
    415.                */
    416.               t.data = OPENSSL_zalloc(t.length + 1);
                       ^
    417.               if (t.data == NULL)
    418.                   goto out;

crypto/asn1/a_time.c:419:13: Array access: Offset added: [-2, +oo] Size: [1, +oo] by call to `set_cert_times` 
    417.               if (t.data == NULL)
    418.                   goto out;
    419.               memcpy(t.data, str + 2, t.length);
                       ^
    420.               t.type = V_ASN1_UTCTIME;
    421.           }
