crypto/ct/ct_log.c:135: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] Size: [1, +oo] by call to `CTLOG_new_from_base64`.
Showing all 30 steps of the trace


crypto/ct/ct_log.c:135:12: Call
133.       }
134.   
135.       return CTLOG_new_from_base64(ct_log, pkey_base64, description);
                  ^
136.   }
137.   

crypto/ct/ct_b64.c:124:1: Parameter `pkey_base64->strlen`
  122.    * -1 on internal (malloc) failure
  123.    */
  124. > int CTLOG_new_from_base64(CTLOG **ct_log, const char *pkey_base64, const char *name)
  125.   {
  126.       unsigned char *pkey_der = NULL;

crypto/ct/ct_b64.c:127:24: Call
  125.   {
  126.       unsigned char *pkey_der = NULL;
  127.       int pkey_der_len = ct_base64_decode(pkey_base64, &pkey_der);
                                ^
  128.       const unsigned char *p;
  129.       EVP_PKEY *pkey = NULL;

crypto/ct/ct_b64.c:24:1: Parameter `**out`
    22.    * the caller. Do not provide a pre-allocated string in |out|.
    23.    */
    24. > static int ct_base64_decode(const char *in, unsigned char **out)
    25.   {
    26.       size_t inlen = strlen(in);

crypto/ct/ct_b64.c:141:5: Assignment
  139.       }
  140.   
  141.       p = pkey_der;
             ^
  142.       pkey = d2i_PUBKEY(NULL, &p, pkey_der_len);
  143.       OPENSSL_free(pkey_der);

crypto/ct/ct_b64.c:142:12: Call
  140.   
  141.       p = pkey_der;
  142.       pkey = d2i_PUBKEY(NULL, &p, pkey_der_len);
                    ^
  143.       OPENSSL_free(pkey_der);
  144.       if (pkey == NULL) {

crypto/x509/x_pubkey.c:181:1: Parameter `**pp`
    179.    */
    180.   
    181. > EVP_PKEY *d2i_PUBKEY(EVP_PKEY **a, const unsigned char **pp, long length)
    182.   {
    183.       X509_PUBKEY *xpk;

crypto/x509/x_pubkey.c:186:5: Assignment
    184.       EVP_PKEY *pktmp;
    185.       const unsigned char *q;
    186.       q = *pp;
               ^
    187.       xpk = d2i_X509_PUBKEY(NULL, &q, length);
    188.       if (!xpk)

crypto/x509/x_pubkey.c:187:11: Call
    185.       const unsigned char *q;
    186.       q = *pp;
    187.       xpk = d2i_X509_PUBKEY(NULL, &q, length);
                     ^
    188.       if (!xpk)
    189.           return NULL;

crypto/x509/x_pubkey.c:57:1: Parameter `**in`
      55.   } ASN1_SEQUENCE_END_cb(X509_PUBKEY, X509_PUBKEY)
      56.   
      57. > IMPLEMENT_ASN1_FUNCTIONS(X509_PUBKEY)
      58.   
      59.   int X509_PUBKEY_set(X509_PUBKEY **x, EVP_PKEY *pkey)

crypto/x509/x_pubkey.c:57:1: Call
      55.   } ASN1_SEQUENCE_END_cb(X509_PUBKEY, X509_PUBKEY)
      56.   
      57. > IMPLEMENT_ASN1_FUNCTIONS(X509_PUBKEY)
      58.   
      59.   int X509_PUBKEY_set(X509_PUBKEY **x, EVP_PKEY *pkey)

crypto/asn1/tasn_dec.c:95:1: Parameter `**in`
        93.    */
        94.   
        95. > ASN1_VALUE *ASN1_item_d2i(ASN1_VALUE **pval,
        96.                             const unsigned char **in, long len,
        97.                             const ASN1_ITEM *it)

crypto/asn1/tasn_dec.c:104:9: Call
        102.           pval = &ptmpval;
        103.       asn1_tlc_clear_nc(&c);
        104.       if (ASN1_item_ex_d2i(pval, in, len, it, -1, 0, 0, &c) > 0)
                       ^
        105.           return *pval;
        106.       return NULL;

crypto/asn1/tasn_dec.c:109:1: Parameter `**in`
          107.   }
          108.   
          109. > int ASN1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in, long len,
          110.                        const ASN1_ITEM *it,
          111.                        int tag, int aclass, char opt, ASN1_TLC *ctx)

crypto/asn1/tasn_dec.c:114:10: Call
          112.   {
          113.       int rv;
          114.       rv = asn1_item_embed_d2i(pval, in, len, it, tag, aclass, opt, ctx);
                          ^
          115.       if (rv <= 0)
          116.           ASN1_item_ex_free(pval, it);

crypto/asn1/tasn_dec.c:125:1: Parameter `**in`
            123.    */
            124.   
            125. > static int asn1_item_embed_d2i(ASN1_VALUE **pval, const unsigned char **in,
            126.                                  long len, const ASN1_ITEM *it,
            127.                                  int tag, int aclass, char opt, ASN1_TLC *ctx)

crypto/asn1/tasn_dec.c:169:9: Assignment
            167.   
            168.       case ASN1_ITYPE_MSTRING:
            169.           p = *in;
                           ^
            170.           /* Just read in tag and class */
            171.           ret = asn1_check_tlen(NULL, &otag, &oclass, NULL, NULL,

crypto/asn1/tasn_dec.c:171:15: Call
            169.           p = *in;
            170.           /* Just read in tag and class */
            171.           ret = asn1_check_tlen(NULL, &otag, &oclass, NULL, NULL,
                                 ^
            172.                                 &p, len, -1, 0, 1, ctx);
            173.           if (!ret) {

crypto/asn1/tasn_dec.c:1060:1: Parameter `**in`
              1058.    */
              1059.   
              1060. > static int asn1_check_tlen(long *olen, int *otag, unsigned char *oclass,
              1061.                              char *inf, char *cst,
              1062.                              const unsigned char **in, long len,

crypto/asn1/tasn_dec.c:1069:5: Assignment
              1067.       long plen;
              1068.       const unsigned char *p, *q;
              1069.       p = *in;
                          ^
              1070.       q = p;
              1071.   

crypto/asn1/tasn_dec.c:1079:13: Call
              1077.           p += ctx->hdrlen;
              1078.       } else {
              1079.           i = ASN1_get_object(&p, &plen, &ptag, &pclass, len);
                                  ^
              1080.           if (ctx) {
              1081.               ctx->ret = i;

crypto/asn1/asn1_lib.c:43:1: Parameter `**pp`
                41.   }
                42.   
                43. > int ASN1_get_object(const unsigned char **pp, long *plength, int *ptag,
                44.                       int *pclass, long omax)
                45.   {

crypto/asn1/asn1_lib.c:48:5: Assignment
                46.       int i, ret;
                47.       long l;
                48.       const unsigned char *p = *pp;
                          ^
                49.       int tag, xclass, inf;
                50.       long max = omax;

crypto/asn1/asn1_lib.c:77:9: Assignment
                75.       } else {
                76.           tag = i;
                77.           p++;
                              ^
                78.           if (--max == 0)
                79.               goto err;

crypto/asn1/asn1_lib.c:83:10: Call
                81.       *ptag = tag;
                82.       *pclass = xclass;
                83.       if (!asn1_get_length(&p, &inf, plength, max))
                               ^
                84.           goto err;
                85.   

crypto/asn1/asn1_lib.c:104:1: <Length trace>
102.   }
103.   
104. > static int asn1_get_length(const unsigned char **pp, int *inf, long *rl,
105.                              long max)
106.   {

crypto/asn1/asn1_lib.c:104:1: Parameter `**pp`
                  102.   }
                  103.   
                  104. > static int asn1_get_length(const unsigned char **pp, int *inf, long *rl,
                  105.                              long max)
                  106.   {

crypto/asn1/asn1_lib.c:107:5: Assignment
                  105.                              long max)
                  106.   {
                  107.       const unsigned char *p = *pp;
                             ^
                  108.       unsigned long ret = 0;
                  109.       unsigned long i;

crypto/asn1/asn1_lib.c:120:15: Assignment
                  118.           *inf = 0;
                  119.           i = *p & 0x7f;
                  120.           if (*(p++) & 0x80) {
                                       ^
                  121.               if (max < (long)i + 1)
                  122.                   return 0;

crypto/asn1/asn1_lib.c:124:25: Array access: Offset: [2, +oo] Size: [1, +oo] by call to `CTLOG_new_from_base64` 
                  122.                   return 0;
                  123.               /* Skip leading zeroes */
                  124.               while (i && *p == 0) {
                                                 ^
                  125.                   p++;
                  126.                   i--;
