crypto/pkcs7/pk7_mime.c:238: error: BUFFER_OVERRUN_L3
  Offset: 1 Size: [0, +oo] by call to `sk_value`.
Showing all 12 steps of the trace


crypto/pkcs7/pk7_mime.c:229:9: Call
227.   			return NULL;
228.   		}
229.   		ret = multi_split(bio, prm->param_value, &parts);
               ^
230.   		sk_pop_free(headers, mime_hdr_free);
231.   		if(!ret || (sk_num(parts) != 2) ) {

crypto/pkcs7/pk7_mime.c:366:10: Call
  364.   	state = 0;
  365.   	first = 1;
  366.   	parts = sk_new(NULL);
                  ^
  367.   	*ret = parts;
  368.   	while ((len = BIO_gets(bio, linebuf, MAX_SMLEN)) > 0) {

crypto/stack/stack.c:119:26: Array declaration
    117.   	if ((ret=(STACK *)Malloc(sizeof(STACK))) == NULL)
    118.   		goto err0;
    119.   	if ((ret->data=(char **)Malloc(sizeof(char *)*MIN_NODES)) == NULL)
                                    ^
    120.   		goto err1;
    121.   	for (i=0; i<MIN_NODES; i++)

crypto/stack/stack.c:119:7: Assignment
    117.   	if ((ret=(STACK *)Malloc(sizeof(STACK))) == NULL)
    118.   		goto err0;
    119.   	if ((ret->data=(char **)Malloc(sizeof(char *)*MIN_NODES)) == NULL)
                 ^
    120.   		goto err1;
    121.   	for (i=0; i<MIN_NODES; i++)

crypto/pkcs7/pk7_mime.c:230:3: Call
228.   		}
229.   		ret = multi_split(bio, prm->param_value, &parts);
230.   		sk_pop_free(headers, mime_hdr_free);
         ^
231.   		if(!ret || (sk_num(parts) != 2) ) {
232.   			PKCS7err(PKCS7_F_SMIME_READ_PKCS7, PKCS7_R_NO_MULTIPART_BODY_FAILURE);

crypto/stack/stack.c:265:1: Parameter `*st->data`
  263.   	}
  264.   
  265. > void sk_pop_free(STACK *st, void (*func)())
  266.   	{
  267.   	int i;

crypto/pkcs7/pk7_mime.c:238:17: Call
236.   
237.   		/* Parse the signature piece */
238.   		p7in = (BIO *)sk_value(parts, 1);
                       ^
239.   
240.   		if (!(headers = mime_parse_hdr(p7in))) {

crypto/stack/stack.c:289:1: <Offset trace>
287.   }
288.   
289. > char *sk_value(STACK *st, int i)
290.   {
291.   	if(st == NULL) return NULL;

crypto/stack/stack.c:289:1: Parameter `i`
  287.   }
  288.   
  289. > char *sk_value(STACK *st, int i)
  290.   {
  291.   	if(st == NULL) return NULL;

crypto/stack/stack.c:289:1: <Length trace>
287.   }
288.   
289. > char *sk_value(STACK *st, int i)
290.   {
291.   	if(st == NULL) return NULL;

crypto/stack/stack.c:289:1: Parameter `*st->data`
  287.   }
  288.   
  289. > char *sk_value(STACK *st, int i)
  290.   {
  291.   	if(st == NULL) return NULL;

crypto/stack/stack.c:292:9: Array access: Offset: 1 Size: [0, +oo] by call to `sk_value` 
  290.   {
  291.   	if(st == NULL) return NULL;
  292.   	return st->data[i];
                 ^
  293.   }
  294.   
